<?php

// Configurar cabeceras CORS
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Methods: POST, OPTIONS");
header("Access-Control-Allow-Headers: Content-Type, Authorization");

// Manejar la solicitud OPTIONS para preflight
if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(204);
    exit;
}

$documentRoot = $_SERVER['DOCUMENT_ROOT'];
session_start();
// Admin fijo
$adminUser = "admin";
// Hash generado a partir de "jmab22031957"
$adminHash = '$2y$10$XtSW9EY.x5KLgYKFlRCR7.FS63O7pwExxYfVSfjnMrb75btzQNuce';
$userHash = '$2y$10$vbgN.BOjHsd6LK3563NjGOqBqb3.jvbDjjmY7YUr8MvOkUp2i5BY.';

if ($_SERVER["REQUEST_METHOD"] === "POST") {
    $user = $_POST["username"];
    $pass = $_POST["password"];

    if ($user === $adminUser && password_verify($pass, $adminHash)) {
        $_SESSION["admin"] = true;
        header("Location: ./panel.php");
        exit;
    } else {
        if ($user === $adminUser && password_verify($pass, $userHash)) {
            $_SESSION["admin"] = true;
            header("Location: ./panel.php");
            exit;
        } else {
            echo "❌ Usuario o contraseña incorrectos ";
            echo "<a href='./login.html'> Volver </a>";
        }
    }
}
?>


