<?php
include __DIR__ . '/auth.php';

function new_captcha(){
    $a = random_int(2, 9);
    $b = random_int(1, 9);
    $_SESSION['admin_captcha_answer'] = (string)($a + $b);
    $_SESSION['admin_captcha_label'] = $a . ' + ' . $b . ' = ?';
}
if(empty($_SESSION['admin_captcha_answer'])) new_captcha();

$error = '';
$notice = '';
if(isset($_GET['registered']) && $_GET['registered'] === '1'){
    $notice = '注册成功，请使用刚设置的账号和密码登录后台。';
}elseif(isset($_GET['registered']) && $_GET['registered'] === 'local'){
    $notice = '本地注册已完成，请使用刚设置的账号和密码登录后台；授权中心接口配置后可再次同步。';
}

if($_SERVER['REQUEST_METHOD'] === 'POST'){
    if(admin_is_locked()){
        $error = '登录失败次数过多，请稍后再试';
        new_captcha();
    } else {
        $captcha = trim($_POST['captcha'] ?? '');
        $validCaptcha = isset($_SESSION['admin_captcha_answer']) && hash_equals($_SESSION['admin_captcha_answer'], $captcha);
        if(!$validCaptcha){
            $error = '验证码错误';
            admin_record_fail();
            new_captcha();
        } elseif(hash_equals(admin_login_user(), trim($_POST['username'] ?? '')) && (admin_password_ok($_POST['password'] ?? '') || admin_center_password_login($_POST['username'] ?? '', $_POST['password'] ?? ''))){
            $_SESSION['admin_login'] = 1;
            admin_clear_fail();
            admin_oplog('login', '登录后台');
            unset($_SESSION['admin_captcha_answer'], $_SESSION['admin_captcha_label']);
            header('Location: ' . cms_admin_url('index.php'));
            exit;
        } else {
            $error = '账号或密码错误';
            admin_record_fail();
            new_captcha();
        }
    }
}
?>
<!doctype html>
<html lang="zh-CN">
<head>
<meta charset="utf-8">
<title>炎枢站群后台登录</title>
<meta name="viewport" content="width=device-width, initial-scale=1">
<link rel="stylesheet" href="<?php echo admin_h(cms_admin_url('assets/admin.css')); ?>">
</head>
<body class="entry-page">
<div class="entry-shell">
    <aside class="entry-brand">
        <div>
            <div class="entry-mark">炎</div>
            <h1>炎枢站群</h1>
            <p>企业站群内容维护、域名管理、搜索推送、蜘蛛统计与授权同步的统一后台。</p>
            <div class="entry-meta">
                <div><strong>后台入口</strong><span>登录后可进入站群管理、内容中心、推送管理与系统维护。</span></div>
                <div><strong>安全验证</strong><span>支持验证码、失败锁定、本地账号与授权中心密码同步。</span></div>
                <div><strong>授权状态</strong><span>后台功能会结合本地授权与在线授权状态进行限制。</span></div>
            </div>
        </div>
        <p>YanShu Site Cluster CMS</p>
    </aside>
    <main class="entry-content">
        <section class="entry-card">
            <h2>后台登录</h2>
            <p>请输入管理员账号、密码和验证码。首次注册后请使用注册账号登录。</p>
            <?php if($notice): ?><div class="notice"><?php echo admin_h($notice); ?></div><?php endif; ?>
            <?php if($error): ?><div class="error"><?php echo admin_h($error); ?></div><?php endif; ?>
            <form method="post">
                <label>账号
                    <input name="username" autocomplete="username" value="<?php echo admin_h(admin_login_user()); ?>" placeholder="请输入账号">
                </label>
                <label>密码
                    <input name="password" type="password" autocomplete="current-password" placeholder="请输入密码">
                </label>
                <label>验证码
                    <div class="captcha-row">
                        <input name="captcha" placeholder="请输入计算结果">
                        <div class="captcha-box"><?php echo admin_h($_SESSION['admin_captcha_label'] ?? ''); ?></div>
                    </div>
                </label>
                <button>登录后台</button>
                <a class="btn ghost" href="<?php echo admin_h(cms_admin_url('register.php')); ?>">客户注册 / 同步授权中心</a>
            </form>
            <p class="entry-link">未注册前默认账号通常为 <strong>admin</strong>；正式上线前请完成客户注册并修改密码。</p>
        </section>
    </main>
</div>
</body>
</html>
