<?php
/*
 *  GNUfault.org - GNUfault's website
 *  Copyright (C) 2026  Connor Thomson
 *
 *  This program is free software: you can redistribute it and/or modify
 *  it under the terms of the GNU Affero General Public License as published by
 *  the Free Software Foundation, either version 3 of the License, or
 *  (at your option) any later version.
 *
 *  This program is distributed in the hope that it will be useful,
 *  but WITHOUT ANY WARRANTY; without even the implied warranty of
 *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 *  GNU Affero General Public License for more details.
 *
 *  You should have received a copy of the GNU Affero General Public License
 *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
 */

define('ROOT', rtrim($_SERVER['DOCUMENT_ROOT'], '/') . '/');

require_once ROOT . '/php/session.php';
require_once ROOT . '/php/database.php';

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $remember = isset($_POST['remember']);

    try {
        $sql = "SELECT id, username, password, verification_code FROM users WHERE username = :username";

        $user = fetch_row($sql, ['username' => $username]);
    } catch (\PDOException $e) {
        echo "Error: " . $e->getMessage();
        exit;
    }

    // The same message either way, so it does not say which usernames exist
    if (!$user || !password_verify($password, $user['password'])) {
        echo "Username or password is not correct!";
        exit;
    }

    if ($user['verification_code'] != '0001') {
        set_user_id((int)$user['id']);

        header("Location: /signup/verify");
        exit;
    }

    sign_in((int)$user['id'], $user['username'], $remember);

    header("Location: /");
}

?>