<?php
session_start();
include "../include/config.php";

if (isset($_POST['login'])) {
    
    $email = $_POST['email'];
    $pass = $_POST['pass'];

    // Prepare statement to prevent SQL injection
    $stmt = $conn->prepare("SELECT * FROM `staff` WHERE email = ?");
    $stmt->bind_param("s", $email);
    $stmt->execute();
    $result = $stmt->get_result();
    $row = $result->fetch_assoc();

    if ($row && password_verify($pass, $row['pass'])) {
        $_SESSION['id'] = $row['id'];
        $_SESSION['email'] = $row['email'];
        $_SESSION['staffname'] = $row['staffname'];
        $_SESSION['phone'] = $row['phone'];
        $_SESSION['qualification'] = $row['qualification'];
        $_SESSION['department'] = $row['department'];
        $_SESSION['gender'] = $row['gender'];
        $_SESSION['role'] = $row['role'];

        header("Location: dashboard.php");
        exit();
    } else {
        header("Location: ../index.php?error=Invalid login details or Account not Approved");
        exit();
    }
}

// Redirect if already logged in
if (isset($_SESSION['email'])) {
    header("Location: dashboard.php");
    exit();
}
?>
