<?php
require __DIR__ . '/_auth.php';

// Om redan inloggad
if (!empty($_SESSION['admin'])) {
    header('Location: index.php'); exit;
}

$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $user = trim($_POST['username'] ?? '');
    $pass = $_POST['password'] ?? '';

    // Enkel fördröjning mot brute-force
    sleep(1);

    if ($user === ADMIN_USER && password_verify($pass, ADMIN_PASS)) {
        $_SESSION['admin'] = true;
        session_regenerate_id(true);
        header('Location: index.php'); exit;
    } else {
        $error = 'Felaktigt användarnamn eller lösenord.';
    }
}
?>
<!DOCTYPE html>
<html lang="sv">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>Logga in – Radio Ultra Admin</title>
<link rel="stylesheet" href="../assets/css/style.css">
</head>
<body>
<div class="login-wrap">
  <h1>🎙️ Radio Ultra</h1>
  <div class="card-form">
    <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
    <form method="post">
      <div class="form-group">
        <label>Användarnamn</label>
        <input name="username" class="form-control" value="<?= htmlspecialchars($_POST['username'] ?? '') ?>" autofocus>
      </div>
      <div class="form-group">
        <label>Lösenord</label>
        <input type="password" name="password" class="form-control">
      </div>
      <button type="submit" class="btn btn-primary" style="width:100%">Logga in</button>
    </form>
  </div>
</div>
</body>
</html>
