<?php
include('conn.php'); // Fail sambungan ke db
session_start();

$error = "";

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $NamaStaff = trim($_POST['NamaStaff']);
    $password = trim($_POST['password']);

    // Cari pengguna berdasarkan NamaStaff
    $stmt = $conn->prepare("SELECT * FROM users WHERE NamaStaff = ?");
    if ($stmt === false) {
        die("MySQL Prepare Error: " . $conn->error);
    }

    $stmt->bind_param("s", $NamaStaff);
    $stmt->execute();
    $result = $stmt->get_result();
    $user = $result->fetch_assoc();

    // Semak jika pengguna wujud dan sahkan kata laluan
    if ($user) {
        if (password_verify($password, $user['password'])) {
            // Set session data
            $_SESSION['user_id']   = $user['id'];
            $_SESSION['user_role'] = $user['role']; 
            $_SESSION['user_name'] = $user['NamaStaff'];
            $_SESSION['bahagian']  = $user['bahagian'];

            header('Location: dashboard.php');
            exit;
        } else {
            $error = "Nama staf atau kata laluan tidak sah!";
        }
    } else {
        $error = "Pengguna tidak ditemui!";
    }

    $stmt->close();
}
?>

<!DOCTYPE html>
<html lang="en">

<!-- header part -->
<?php include('header.php'); ?>
<!-- end header -->

<body class="skin-default card-no-border">
    <div class="preloader">
        <div class="loader">
            <div class="loader__figure"></div>
            <p class="loader__label">SPNR Surat/Memo</p>
        </div>
    </div>

    <section id="wrapper">
        <div class="login-register" style="background-image:url(../assets/images/background/login-register.jpg);">
            <div class="login-box card">
                <div class="card-body">
                    <form class="form-horizontal form-material" id="loginform" method="post" action="">
                        <h4 class="text-center m-b-20">Sistem Pengurusan Nombor Rujukan Surat / Memo</h4>

                        <div class="form-group">
                            <div class="col-xs-12">
                                <input type="text" name="NamaStaff" class="form-control" placeholder="Nama Pengguna" required>
                            </div>
                        </div>

                        <div class="form-group">
                            <div class="col-xs-12">
                                <input type="password" name="password" class="form-control" placeholder="Kata Laluan" required>
                            </div>
                        </div>

                        <div class="form-group row">
                            <div class="col-md-12">
                                <div class="d-flex no-block align-items-center">
                                    <div class="ms-auto">
                                        <a href="forgot_password.php" id="to-recover" class="text-muted">
                                            <i class="fas fa-lock m-r-5"></i> Lupa Kata Laluan?
                                        </a>
                                    </div>
                                </div>
                            </div>
                        </div>

                        <div class="form-group text-center">
                            <div class="col-xs-12 p-b-20">
                                <button class="btn w-100 btn-lg btn-info btn-rounded text-white" type="submit">
                                    Log Masuk
                                </button>
                            </div>
                        </div>

                        <?php if (!empty($error)) echo "<div class='alert alert-danger text-center mt-3'>$error</div>"; ?>
                    </form>
                </div>
            </div>
        </div>
    </section>

    <?php include('jquery.php'); ?>
</body>
</html>