<?php
// POST { email, password } -> signs the user in.
require __DIR__ . '/../lib/bootstrap.php';
require_method('POST');

$body     = json_body();
$email    = strtolower(trim($body['email'] ?? ''));
$password = (string)($body['password'] ?? '');

$stmt = db()->prepare('SELECT id, password_hash FROM users WHERE email = ?');
$stmt->execute([$email]);
$user = $stmt->fetch();

// Same message whether the email is unknown or the password is wrong -
// don't let a login form confirm which emails have accounts.
if (!$user || !password_verify($password, $user['password_hash'])) {
    json_error('Incorrect email or password.', 401);
}

issue_session((int)$user['id']);
json_out(['ok' => true, 'email' => $email]);