<?php
declare(strict_types=1);

/**
 * auth_login.php
 * Validates email/password against userdb table.
 */
session_start();
require __DIR__ . '/db.php';

$email = trim((string)($_POST['email'] ?? ''));
$pass  = (string)($_POST['password'] ?? '');

if ($email === '' || $pass === '') {
  header("Location: login.php");
  exit;
}

$stmt = $pdo->prepare("SELECT id, password_hash, status FROM userdb WHERE email = :email LIMIT 1");
$stmt->execute([':email' => $email]);
$user = $stmt->fetch();

if (!$user || $user['status'] !== 'active' || !password_verify($pass, $user['password_hash'])) {
  // Avoid leaking whether email exists
  header("Location: login.php");
  exit;
}

session_regenerate_id(true);
$_SESSION['user_id'] = (int)$user['id'];

header("Location: dashboard.php");
exit;
