<?php
require_once __DIR__ . '/../includes/functions.php';
if (isAdminLoggedIn()) {
redirect('index.php');
}
$error = null;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!csrfVerify($_POST['csrf_token'] ?? null)) {
$error = 'Your session expired — please try again.';
} elseif (!rateLimitCheck('admin_login', 8, 60)) {
$error = 'Too many attempts — please wait a minute and try again.';
} else {
$email = trim($_POST['email'] ?? '');
$password = $_POST['password'] ?? '';
$stmt = db()->prepare('SELECT * FROM admin_users WHERE email = ? LIMIT 1');
$stmt->execute([$email]);
$user = $stmt->fetch();
if ($user && password_verify($password, $user['password_hash'])) {
session_regenerate_id(true);
$_SESSION['admin_id'] = $user['id'];
$_SESSION['admin_name'] = $user['name'];
redirect('index.php');
}
$error = 'Incorrect email or password.';
}
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>Admin Login · PIMS Nepal</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=Poppins:wght@500;600;700;800&display=swap" rel="stylesheet">
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap-icons@1.11.3/font/bootstrap-icons.css">
<script src="https://cdn.tailwindcss.com"></script>
<script>
tailwind.config = { theme: { extend: {
colors: { primary: '#0D6EFD', secondary: '#1E3A8A', accent: '#F59E0B' },
fontFamily: { heading: ['Poppins','sans-serif'], sans: ['Inter','sans-serif'] }
} } }
</script>
<style>body{font-family:'Inter',sans-serif;} .font-heading{font-family:'Poppins',sans-serif;}</style>
</head>
<body class="bg-gradient-to-br from-secondary to-primary min-h-screen flex items-center justify-center px-4">
<div class="bg-white rounded-2xl shadow-xl w-full max-w-sm p-8">
<div class="flex flex-col items-center mb-6">
<img src="../assets/images/pims-logo.png" alt="PIMS Nepal" class="h-16 w-16 object-contain mb-3" />
<h1 class="font-heading font-bold text-xl">Admin Login</h1>
<p class="text-sm text-gray-500">Sign in to manage your website content</p>
</div>
<?php if ($error): ?>
<div class="mb-4 bg-red-50 border border-red-200 text-red-700 text-sm px-4 py-3 rounded-lg"><i class="bi bi-exclamation-circle-fill"></i> <?= e($error) ?></div>
<?php endif; ?>
<form method="post" class="space-y-4">
<input type="hidden" name="csrf_token" value="<?= e(csrfToken()) ?>" />
<label class="block">
<span class="block text-sm font-medium text-gray-700 mb-1.5">Email</span>
<input type="email" name="email" required class="w-full px-4 py-2.5 rounded-lg border border-gray-200 focus:outline-none focus:ring-2 focus:ring-primary text-sm" />
</label>
<label class="block">
<span class="block text-sm font-medium text-gray-700 mb-1.5">Password</span>
<input type="password" name="password" required class="w-full px-4 py-2.5 rounded-lg border border-gray-200 focus:outline-none focus:ring-2 focus:ring-primary text-sm" />
</label>
<button class="btn-primary-brand w-full py-3 rounded-lg font-semibold text-white bg-primary hover:opacity-90">Log In</button>
</form>
<p class="text-xs text-gray-400 mt-6 text-center">No account yet, or password not working? Visit <code>admin/setup.php</code> once to create or reset your admin login — then delete that file.</p>
</div>
</body>
</html>