<?php
/**
 * login.php — POST { password: "..." } -> sets session on success.
 */
require_once __DIR__ . '/config.php';
header('Content-Type: application/json');

$input = json_decode(file_get_contents('php://input'), true);
$password = $input['password'] ?? '';

if ($password !== '' && password_verify($password, ADMIN_PASSWORD_HASH)) {
    // Prevent session fixation
    session_regenerate_id(true);
    $_SESSION['sultani_admin_logged_in'] = true;
    echo json_encode(['ok' => true]);
} else {
    http_response_code(401);
    echo json_encode(['ok' => false, 'error' => 'Incorrect password']);
}
