<?php
require __DIR__ . '/../db.php';
session_start();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
  header("Location: login.php");
  exit;
}

$email = trim($_POST['email'] ?? '');
$pass  = $_POST['password'] ?? '';

$stmt = $pdo->prepare("SELECT * FROM admins WHERE email = ? LIMIT 1");
$stmt->execute([$email]);
$admin = $stmt->fetch();

if ($admin && password_verify($pass, $admin['password_hash'])) {
    $_SESSION['admin'] = [
        'id'    => $admin['id'],
        'email' => $admin['email'],
        'name'  => $admin['full_name']
    ];

    header("Location: dashboard.php");
    exit;
}

header("Location: login.php?e=" . urlencode("Invalid email or password"));
exit;
