<?php
/**
 * 登录接口  POST /api/auth/login.php
 * 入参：username / password / slider_token（滑块验证通过后的token）
 * 出参（成功）：{ code:0, msg:'登录成功', data:{ real_name, role_name, permissions } }
 */
require_once __DIR__ . '/../common/db.php';
require_once __DIR__ . '/../common/response.php';
require_once __DIR__ . '/../common/logger.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    Response::error('请求方式错误', 400);
}

$username    = trim($_POST['username'] ?? '');
$password    = (string)($_POST['password'] ?? '');
$sliderToken = trim($_POST['slider_token'] ?? '');

// 滑块验证：前端 slider.js 拖动通过后生成的 token，服务端校验非空且格式合法
if ($sliderToken === '' || strlen($sliderToken) < 10) {
    Response::error('请先完成滑块验证');
}
if ($username === '' || $password === '') {
    Response::error('请输入账号和密码');
}

$pdo = DB::getInstance()->getPdo();
$stmt = $pdo->prepare(
    "SELECT u.*, r.role_name, r.permissions
     FROM system_users u
     LEFT JOIN system_roles r ON r.id = u.role_id
     WHERE u.username = ? LIMIT 1"
);
$stmt->execute([$username]);
$user = $stmt->fetch();

if (!$user || !hash_equals($user['password'], sha1($password))) {
    Response::error('账号或密码错误');
}
if ((int)$user['is_active'] !== 1) {
    Response::error('账号已被禁用，请联系管理员');
}

// 更新最后登录时间/IP
$ip = $_SERVER['REMOTE_ADDR'] ?? '0.0.0.0';
$upd = $pdo->prepare("UPDATE system_users SET last_login_time = NOW(), last_login_ip = ? WHERE id = ?");
$upd->execute([$ip, $user['id']]);

// 写入 Session
if (session_status() === PHP_SESSION_NONE) {
    session_start();
}
$_SESSION['user_id']     = (int)$user['id'];
$_SESSION['username']    = $user['username'];
$_SESSION['real_name']   = $user['real_name'] ?? $user['username'];
$_SESSION['role_id']     = (int)$user['role_id'];
$_SESSION['role_name']   = $user['role_name'] ?? '';
$_SESSION['permissions'] = json_decode($user['permissions'] ?? '[]', true) ?: [];

// 操作日志
logAction((int)$user['id'], $user['username'], 'login', 'auth', 'system_users', (int)$user['id'], ['ip' => $ip]);

Response::success([
    'real_name'   => $_SESSION['real_name'],
    'role_name'   => $_SESSION['role_name'],
    'permissions' => $_SESSION['permissions'],
], '登录成功');