✏ EDIT: admin_login.php

<?php
// Authenticates an administrator using email and password. Passwords
// should be securely hashed using password_hash(). Only users with
// role ADMIN are allowed through this endpoint.

require_once __DIR__ . '/bootstrap.php';

$input = json_decode(file_get_contents('php://input'), true);
if (!$input) {
    $input = $_POST;
}

$email = isset($input['email']) ? trim($input['email']) : '';
$password = isset($input['password']) ? $input['password'] : '';

if ($email === '' || $password === '') {
    respond(null, 'Email and password are required');
}

try {
    $stmt = $pdo->prepare('SELECT id, role, name, email, password_hash FROM users WHERE email = ?');
    $stmt->execute([$email]);
    $user = $stmt->fetch();
    if (!$user || $user['role'] !== 'ADMIN') {
        respond(null, 'Invalid credentials');
    }
    if ($user['password_hash'] === null) {
        respond(null, 'Password not set for this admin');
    }
    // Some bcrypt hashes generated outside of PHP may use the $2b$ prefix which
    // isn't recognised by older PHP versions. Convert $2b$ to $2y$ before
    // verifying to improve compatibility.
    $storedHash = $user['password_hash'];
    if (strpos($storedHash, '$2b$') === 0) {
        $storedHash = '$2y$' . substr($storedHash, 4);
    }
    if (!password_verify($password, $storedHash)) {
        respond(null, 'Invalid credentials');
    }
    // Save session without exposing password hash
    $_SESSION['user'] = [
        'id' => $user['id'],
        'role' => $user['role'],
        'name' => $user['name'],
        'email' => $user['email'],
    ];
    respond($_SESSION['user']);
} catch (PDOException $e) {
    respond(null, 'Database error');
}

[✗] CANCEL