<?php
/**
 * modules/auth/login.php — página pública de acceso (ruta /login).
 *
 * La incluye el front controller (index.php). Si no hay ningún usuario, muestra
 * el alta de la PRIMERA cuenta (setup, queda como admin). Si no, login.
 */
if (!defined('IN_APP')) { die('Acceso denegado'); }

// Destino tras login: solo permitimos volver a rutas internas /oauth/ (flujo OAuth).
$return = (isset($_GET['return']) && preg_match('#^/oauth/[a-z]#i', (string)$_GET['return'])) ? (string)$_GET['return'] : '/chat/';

if ($_user !== null) App::redirect($return);

// ¿Hay usuarios? Si no, modo "crear primera cuenta".
$count = (int)($mysqli->query('SELECT COUNT(*) c FROM users')->fetch_assoc()['c'] ?? 0);
$setup = ($count === 0);
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = trim($_POST['email'] ?? '');
    $pass  = (string)($_POST['password'] ?? '');

    if ($setup) {
        $name = trim($_POST['name'] ?? '');
        if ($name === '' || !filter_var($email, FILTER_VALIDATE_EMAIL) || strlen($pass) < 8) {
            $error = App::t('auth.setup_invalid');
        } else {
            $hash = password_hash($pass, PASSWORD_DEFAULT);
            $loc  = App::locale();
            $stmt = $mysqli->prepare(
                'INSERT INTO users (name, email, pass_hash, locale, is_admin, is_active, created_at) VALUES (?,?,?,?,1,1,NOW())'
            );
            $stmt->bind_param('ssss', $name, $email, $hash, $loc);
            if ($stmt->execute()) {
                $auth->createSession($mysqli->insert_id);
                App::redirect($return);
            } else {
                $error = App::t('auth.email_taken');
            }
            $stmt->close();
        }
    } else {
        if ($auth->login($email, $pass)) App::redirect($return);
        $error = $auth->_error ?: App::t('auth.invalid_login');
    }
}

$lang = App::locale();
?><!doctype html>
<html lang="<?= App::e($lang) ?>" class="h-full">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="icon" href="/assets/favicon.svg" type="image/svg+xml">
<link rel="apple-touch-icon" href="/assets/favicon.svg">
<title><?= App::e(App::t($setup ? 'auth.setup_title' : 'auth.login_title')) ?> · <?= App::e(App::t('app.name')) ?></title>
<script>
(function () {
  var t = localStorage.getItem('theme');
  if (t === 'dark' || (!t && window.matchMedia('(prefers-color-scheme: dark)').matches)) {
    document.documentElement.classList.add('dark');
  }
})();
</script>
<link rel="stylesheet" href="/assets/css/style.css">
</head>
<body class="flex min-h-full items-center justify-center bg-paper p-4 text-ink-900 dark:bg-ink-950 dark:text-paper">
  <div class="w-full max-w-sm">
    <div class="mb-6 text-center">
      <div class="mx-auto mb-3 flex h-12 w-12 items-center justify-center rounded-lg bg-primary-600 text-xl font-bold text-white">k</div>
      <h1 class="text-2xl font-semibold"><?= App::e(App::t('app.name')) ?></h1>
      <p class="text-sm text-gray-dark dark:text-gray-light"><?= App::e(App::t('app.tagline')) ?></p>
    </div>

    <div class="rounded-lg border border-gray-200 bg-white p-6 shadow-sm dark:border-ink-700 dark:bg-ink-900">
      <h2 class="mb-4 text-lg font-medium"><?= App::e(App::t($setup ? 'auth.setup_title' : 'auth.login_title')) ?></h2>

      <?php if ($error): ?>
        <div class="mb-4 rounded-lg border border-danger/30 bg-danger/10 px-4 py-3 text-sm text-danger"><?= App::e($error) ?></div>
      <?php endif; ?>
      <?php if ($setup): ?>
        <p class="mb-4 text-sm text-gray-dark dark:text-gray-light"><?= App::e(App::t('auth.setup_hint')) ?></p>
      <?php endif; ?>

      <form method="post" action="/login/<?= isset($_GET["return"]) ? "?return=" . rawurlencode($return) : "" ?>" class="space-y-4">
        <?php if ($setup): ?>
        <div>
          <label class="mb-1 block text-sm font-medium"><?= App::e(App::t('auth.name')) ?></label>
          <input type="text" name="name" required autofocus
                 class="w-full rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm outline-none focus:border-primary-600 dark:border-ink-700 dark:bg-ink-800">
        </div>
        <?php endif; ?>
        <div>
          <label class="mb-1 block text-sm font-medium"><?= App::e(App::t('auth.email')) ?></label>
          <input type="email" name="email" required <?= $setup ? '' : 'autofocus' ?>
                 class="w-full rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm outline-none focus:border-primary-600 dark:border-ink-700 dark:bg-ink-800">
        </div>
        <div>
          <label class="mb-1 block text-sm font-medium"><?= App::e(App::t('auth.password')) ?></label>
          <input type="password" name="password" required
                 class="w-full rounded-lg border border-gray-200 bg-white px-3 py-2 text-sm outline-none focus:border-primary-600 dark:border-ink-700 dark:bg-ink-800">
        </div>
        <button type="submit"
                class="w-full rounded-lg bg-primary-600 px-4 py-2 text-sm font-medium text-white hover:bg-primary-700">
          <?= App::e(App::t($setup ? 'auth.create_account' : 'auth.sign_in')) ?>
        </button>
      </form>
    </div>
  </div>
</body>
</html>
