Untitled

<?php
require_once '../includes/config.php';

header('Content-Type: application/json');
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: GET, POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, Authorization');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['success' => false, 'message' => 'Method not allowed']);
    exit;
}

$raw = file_get_contents('php://input');
$data = json_decode($raw, true);

if (!isset($data['username']) || !isset($data['password'])) {
    http_response_code(400);
    echo json_encode(['success' => false, 'message' => 'Username and password are required']);
    exit;
}

$username = trim($data['username']);
$password = trim($data['password']);

if ($username === '' || $password === '') {
    http_response_code(400);
    echo json_encode(['success' => false, 'message' => 'Username and password cannot be empty']);
    exit;
}
try {
    $conn = getDBConnection();
    $stmt = $conn->prepare("
        SELECT user_id, username, password, email, full_name, user_type, is_active
        FROM users
        WHERE username = ? OR email = ?
    ");
    $stmt->execute([$username, $username]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$user) {
        http_response_code(401);
        echo json_encode(['success' => false, 'message' => 'Invalid username or password']);
        exit;
    }

    if (empty($user['is_active']) && $user['is_active'] !== '1' && $user['is_active'] !== 1) {
        http_response_code(403);
        echo json_encode(['success' => false, 'message' => 'Account is disabled. Please contact support.']);
        exit;
    }

    $stored = $user['password'] ?? '';
    $stored_trimmed = rtrim($stored, "\0 ");
    $safe_prefix = substr($stored_trimmed, 0, 6);
    error_log("Signin debug: user_id={$user['user_id']} stored_len=" . strlen($stored) .
        " trimmed_len=" . strlen($stored_trimmed) . " prefix={$safe_prefix}");

    if ($stored_trimmed !== '' && password_verify($password, $stored_trimmed)) {
        if (password_needs_rehash($stored_trimmed, PASSWORD_DEFAULT)) {
            $newHash = password_hash($password, PASSWORD_DEFAULT);
            $upd = $conn->prepare("UPDATE users SET password = ? WHERE user_id = ?");
            $upd->execute([$newHash, $user['user_id']]);
            error_log("Signin notice: rehashed password for user_id={$user['user_id']}");
        }
    } elseif ($stored_trimmed === $password || $stored === $password) {
        $newHash = password_hash($password, PASSWORD_DEFAULT);
        $upd = $conn->prepare("UPDATE users SET password = ? WHERE user_id = ?");
        $upd->execute([$newHash, $user['user_id']]);
        error_log("Signin notice: migrated plain-text password to hash for user_id={$user['user_id']}");
    } else {
        if (strlen($stored_trimmed) > 0 && strlen($stored_trimmed) < 60) {
            error_log("Signin error: stored password length suspicious (possible truncation). user_id={$user['user_id']} stored_len=" . strlen($stored_trimmed));
            http_response_code(500);
            echo json_encode(['success' => false, 'message' => 'Server configuration error: password storage invalid. Contact administrator.']);
            exit;
        }

        http_response_code(401);
        echo json_encode(['success' => false, 'message' => 'Invalid username or password']);
        exit;
    }
    unset($user['password']);
    session_start();
    $_SESSION['user'] = $user;

    http_response_code(200);
    echo json_encode([
        'success' => true,
        'message' => 'Sign in successful',
        'user' => $user
    ]);

} catch (PDOException $e) {
    error_log("Signin exception: " . $e->getMessage());
    http_response_code(500);
    echo json_encode(['success' => false, 'message' => 'An error occurred. Please try again later.']);
}