<?php

declare(strict_types=1);

namespace App\Controllers\Admin;

use App\Controllers\BaseController;
use CodeIgniter\HTTP\ResponseInterface;

/**
 * Admin authentication: single operator password (bcrypt) from .env.
 */
final class Auth extends BaseController
{
    public function loginForm(): string
    {
        return $this->render('admin/login', ['error' => session()->getFlashdata('login_error')]);
    }

    public function attempt(): ResponseInterface
    {
        $password = (string) $this->request->getPost('password');
        $hash     = (string) env('site.adminPassword', '');

        if ($password === '' || ! password_verify($password, $hash)) {
            sleep(1); // brute-force damping
            session()->setFlashdata('login_error', 'Incorrect password.');
            service('analytics')->track('error', ['meta' => ['scope' => 'admin_login_failed']]);

            return redirect()->to('/admin/login')->withInput();
        }

        // rehash if algorithm cost changed
        if (password_needs_rehash($hash, PASSWORD_DEFAULT)) {
        }

        session()->set(['tv_admin_ok' => true, 'tv_admin_at' => time()]);

        return redirect()->to('/admin');
    }

    public function logout(): ResponseInterface
    {
        session()->remove('tv_admin_ok');

        return redirect()->to('/admin/login');
    }
}