✏ EDIT: Auth.php

<?php
require_once __DIR__ . '/Database.php';
require_once __DIR__ . '/Session.php';
class Auth
{
    public static function attempt(string $email, string $password): bool
    {
        $pdo = Database::connection();
        $stmt = $pdo->prepare('SELECT au.*, r.name AS role_name, r.slug AS role_slug FROM admin_users au LEFT JOIN roles r ON r.id = au.role_id WHERE au.email = ? AND au.status = "active" LIMIT 1');
        $stmt->execute([$email]);
        $user = $stmt->fetch();
        if (!$user || !password_verify($password, $user['password_hash'])) {
            return false;
        }
        Session::regenerate();
        unset($user['password_hash']);
        Session::set('admin_user', $user);
        $pdo->prepare('UPDATE admin_users SET last_login = NOW() WHERE id = ?')->execute([$user['id']]);
        return true;
    }

public static function check(): bool
    {
        return is_array(Session::get('admin_user'));
    }

public static function user(): ?array
    {
        $user = Session::get('admin_user');
        return is_array($user) ? $user : null;
    }

public static function requireLogin(): void
    {
        if (!self::check()) {
            header('Location: index.php');
            exit;
        }
    }

public static function logout(): void
    {
        Session::destroy();
    }
}

[✗] CANCEL