<?php
session_start();
require 'config/db.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $email = $_POST['email'];
    $password = $_POST['password'];

    // Fetch user from the database based on the email, including school_id
    $stmt = $pdo->prepare("SELECT user_id, school_id, role, password FROM users WHERE email = ?");
    $stmt->execute([$email]);
    $user = $stmt->fetch();

    // Verify the password and set session variables if successful
    if ($user && password_verify($password, $user['password'])) {
        $_SESSION['user_id'] = $user['user_id'];
        $_SESSION['role'] = $user['role'];
        $_SESSION['school_id'] = $user['school_id']; // Set school_id in the session

        // Fetch the district_id based on the school_id
        $district_stmt = $pdo->prepare("SELECT district_id FROM schools WHERE school_id = ?");
        $district_stmt->execute([$user['school_id']]);
        $district = $district_stmt->fetch();

        if ($district) {
            $_SESSION['district_id'] = $district['district_id']; // Set district_id in the session
        } else {
            die("Error: No district found for the specified school.");
        }

        // Redirect to dashboard after successful login
        header('Location: dashboard.php');
        exit();
    } else {
        $error = "Invalid email or password.";
    }
}
?>

<!-- HTML for the login form starts here -->
<?php include 'views/header.php'; ?>
<h2>Login</h2>
<form method="POST" action="login.php">
    <label>Email:</label>
    <input type="email" name="email" required>
    <label>Password:</label>
    <input type="password" name="password" required>
    <button type="submit">Login</button>
</form>
<?php if (isset($error)) echo "<p style='color: red;'>$error</p>"; ?>
<?php include 'views/footer.php'; ?>