<?php
// staff/login.php — Manage Operations sign in (phone or email + password).
session_start();
include_once("config/db.php");

if (!empty($_SESSION['staff_id']) && in_array($_SESSION['staff_role'] ?? '', ['waiter','staff'], true)) {
    header("Location: index.php"); exit;
}

$error = "";
if (($_GET['err'] ?? '') === 'inactive') $error = "Your staff account is inactive. Please contact your restaurant admin.";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $identifier = trim($_POST['identifier'] ?? '');
    $password   = (string)($_POST['password'] ?? '');
    if ($identifier === '' || $password === '') {
        $error = "Please enter your details.";
    } else {
        $stmt = $conn->prepare(
            "SELECT u.*, r.status AS restaurant_status
             FROM users u LEFT JOIN restaurants r ON u.restaurant_id = r.id
             WHERE (u.phone = ? OR u.email = ?) AND u.role IN ('waiter','staff') AND u.status = 1 LIMIT 1"
        );
        $stmt->bind_param("ss", $identifier, $identifier);
        $stmt->execute();
        $u = $stmt->get_result()->fetch_assoc();

        if (!$u || !password_verify($password, $u['password'])) {
            $error = "Invalid phone/email or password.";
        } elseif (isset($u['restaurant_status']) && (int)$u['restaurant_status'] !== 1) {
            $error = "Your restaurant account is deactivated. Contact support.";
        } else {
            session_regenerate_id(true);
            $_SESSION['staff_id']   = (int)$u['id'];
            $_SESSION['staff_role'] = $u['role'];
            $_SESSION['staff_name'] = $u['name'];
            header("Location: index.php"); exit;
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
<title>Staff Sign in — Dabil</title>
<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap" rel="stylesheet">
<style>
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
:root{--primary:#225AE3;--primary-dark:#1a47b8;--primary-bg:#EEF3FD;--text:#0F172A;--text-muted:#64748B;--text-light:#94A3B8;--bg:#EDF0F5;--border:#E2E8F0;--field-bg:#F7F9FC;--font:'Plus Jakarta Sans',-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
html,body{height:100%;font-family:var(--font);background:var(--bg);color:var(--text);-webkit-text-size-adjust:100%}
a{text-decoration:none}
.auth-wrap{min-height:100%;display:flex;align-items:center;justify-content:center;padding:calc(env(safe-area-inset-top) + 20px) 16px calc(env(safe-area-inset-bottom) + 24px)}
.auth-card{width:100%;max-width:420px;background:#fff;border-radius:24px;padding:30px 22px;box-shadow:0 12px 40px rgba(15,23,42,.08)}
.auth-logo{display:flex;justify-content:center;margin-bottom:22px}
.auth-logo img{height:34px;width:auto}
.auth-card h1{font-size:1.6rem;font-weight:800;letter-spacing:-.03em;text-align:center;margin-bottom:6px}
.auth-sub{font-size:.9rem;color:var(--text-muted);text-align:center;margin-bottom:24px}
.f-label{display:block;font-size:.84rem;font-weight:700;margin-bottom:8px}
.field{position:relative;margin-bottom:16px}
.field .f-ic{position:absolute;left:16px;top:50%;transform:translateY(-50%);color:var(--text-light);display:flex}
.field input{width:100%;height:54px;border:1.5px solid var(--border);background:var(--field-bg);border-radius:14px;padding:0 48px 0 46px;font-size:max(16px,.95rem);font-family:var(--font);color:var(--text);outline:none;transition:border-color .2s,box-shadow .2s,background .2s}
.field input:focus{border-color:var(--primary);background:#fff;box-shadow:0 0 0 3px rgba(34,90,227,.1)}
.field input::placeholder{color:var(--text-light)}
.field .eye{position:absolute;right:8px;top:50%;transform:translateY(-50%);width:40px;height:40px;border:none;background:none;color:var(--text-light);display:flex;align-items:center;justify-content:center;cursor:pointer}
.forgot{display:block;font-size:.84rem;font-weight:600;color:var(--text-muted);margin:2px 2px 20px}
.btn-primary{width:100%;height:56px;border:none;border-radius:16px;background:var(--primary);color:#fff;font-family:var(--font);font-weight:700;font-size:1rem;cursor:pointer;box-shadow:0 8px 22px rgba(34,90,227,.3);transition:background .15s,transform .12s}
.btn-primary:active{background:var(--primary-dark);transform:scale(.99)}
.banner-err{background:#FEF2F2;border:1px solid #FECACA;color:#B91C1C;font-size:.85rem;border-radius:12px;padding:12px 14px;margin-bottom:16px;text-align:center}
.foot-note{text-align:center;font-size:.78rem;color:var(--text-light);line-height:1.6;margin-top:20px}
</style>
</head>
<body>
<div class="auth-wrap">
  <div class="auth-card">
    <div class="auth-logo"><img src="../customer/assets/img/dlogo.png" alt="Dabil"></div>
    <h1>Welcome Back</h1>
    <p class="auth-sub">Sign in to manage operations</p>

    <?php if ($error): ?><div class="banner-err"><?php echo htmlspecialchars($error); ?></div><?php endif; ?>

    <form method="POST" autocomplete="off">
      <label class="f-label" for="identifier">Phone or Email</label>
      <div class="field">
        <span class="f-ic"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M22 16.92v3a2 2 0 01-2.18 2 19.79 19.79 0 01-8.63-3.07 19.5 19.5 0 01-6-6 19.79 19.79 0 01-3.07-8.67A2 2 0 014.11 2h3a2 2 0 012 1.72c.13.96.36 1.9.7 2.81a2 2 0 01-.45 2.11L8.09 9.91a16 16 0 006 6l1.27-1.27a2 2 0 012.11-.45c.91.34 1.85.57 2.81.7A2 2 0 0122 16.92z"/></svg></span>
        <input type="text" id="identifier" name="identifier" placeholder="Phone number or email" required style="padding-left:46px;padding-right:16px">
      </div>

      <label class="f-label" for="password">Password</label>
      <div class="field">
        <span class="f-ic"><svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><rect x="3" y="11" width="18" height="11" rx="2"/><path d="M7 11V7a5 5 0 0110 0v4"/></svg></span>
        <input type="password" id="password" name="password" placeholder="Your password" required>
        <button type="button" class="eye" id="eyeBtn" aria-label="Show password"></button>
      </div>

      <a href="forgot_password.php" class="forgot">Forgot password?</a>
      <button type="submit" class="btn-primary">Sign In</button>
    </form>

    <p class="foot-note">Staff accounts are created by your restaurant admin.<br>Don't have one? Ask your manager.</p>
  </div>
</div>
<script>
(function(){
  const pw=document.getElementById('password'),eye=document.getElementById('eyeBtn');
  const open='<svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M1 12s4-8 11-8 11 8 11 8-4 8-11 8-11-8-11-8z"/><circle cx="12" cy="12" r="3"/></svg>';
  const off='<svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M17.94 17.94A10.07 10.07 0 0112 20c-7 0-11-8-11-8a18.45 18.45 0 015.06-5.94M9.9 4.24A9.12 9.12 0 0112 4c7 0 11 8 11 8a18.5 18.5 0 01-2.16 3.19m-6.72-1.07a3 3 0 11-4.24-4.24"/><line x1="1" y1="1" x2="23" y2="23"/></svg>';
  eye.innerHTML=open;
  eye.addEventListener('click',()=>{const s=pw.type==='password';pw.type=s?'text':'password';eye.innerHTML=s?off:open;});
})();
</script>
</body>
</html>
