<?php
session_start();
include '../includes/db.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];

    if (empty($username) || empty($password)) {
        header("Location: index.php?error=الرجاء ملء جميع الحقول");
        exit();
    }

    $stmt = $conn->prepare("SELECT id, username, password FROM users WHERE username = ?");
    $stmt->bind_param("s", $username);
    $stmt->execute();
    $result = $stmt->get_result();

    if ($result->num_rows === 1) {
        $user = $result->fetch_assoc();
        
        if (password_verify($password, $user['password'])) {
            // Password is correct, start session
            $_SESSION['user_id'] = $user['id'];
            $_SESSION['username'] = $user['username'];

            // Load user permissions into session
            include_once '../includes/permissions.php';
            load_user_permissions($user['id'], $conn);
            
            header("Location: dashboard.php");
            exit();
        } else {
            // Incorrect password
            header("Location: index.php?error=اسم المستخدم أو كلمة المرور غير صحيحة");
            exit();
        }
    } else {
        // User not found
        header("Location: index.php?error=اسم المستخدم أو كلمة المرور غير صحيحة");
        exit();
    }

    $stmt->close();
    $conn->close();
} else {
    header("Location: index.php");
    exit();
}
?>