<?php
require_once __DIR__ . '/_auth.php';
admin_start();

if (admin_logged_in()) { header('Location: te-koop.php'); exit; }

$err = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
  if (!csrf_check($_POST['_csrf'] ?? '')) {
    $err = 'Ongeldige sessie. Probeer opnieuw.';
  } else {
    $u = trim($_POST['user'] ?? '');
    $p = $_POST['password'] ?? '';
    if (admin_login($u, $p)) {
      header('Location: te-koop.php');
      exit;
    }
    $err = 'Onjuiste gebruikersnaam of wachtwoord.';
    sleep(1); // brute-force vertraging
  }
}

$admin_title = 'Inloggen';
include __DIR__ . '/_layout.php';
?>

<div style="max-width:380px;margin:60px auto">
  <h1>Admin inloggen</h1>
  <p class="lede">Log in om te-koop schepen te beheren.</p>

  <?php if ($err): ?>
    <div class="flash error"><?= e($err) ?></div>
  <?php endif; ?>

  <form method="post" class="panel">
    <input type="hidden" name="_csrf" value="<?= e(csrf_token()) ?>">
    <div class="field">
      <label for="user">Gebruikersnaam</label>
      <input id="user" name="user" type="text" required autocomplete="username" autofocus>
    </div>
    <div class="field">
      <label for="password">Wachtwoord</label>
      <input id="password" name="password" type="password" required autocomplete="current-password">
    </div>
    <button type="submit" class="btn">Inloggen</button>
  </form>
</div>

</main></body></html>
