22 lines
715 B
PHP
22 lines
715 B
PHP
<?php
|
|
// POST { email, password } -> signs the user in.
|
|
require __DIR__ . '/../lib/bootstrap.php';
|
|
require_method('POST');
|
|
|
|
$body = json_body();
|
|
$email = strtolower(trim($body['email'] ?? ''));
|
|
$password = (string)($body['password'] ?? '');
|
|
|
|
$stmt = db()->prepare('SELECT id, password_hash FROM users WHERE email = ?');
|
|
$stmt->execute([$email]);
|
|
$user = $stmt->fetch();
|
|
|
|
// Same message whether the email is unknown or the password is wrong -
|
|
// don't let a login form confirm which emails have accounts.
|
|
if (!$user || !password_verify($password, $user['password_hash'])) {
|
|
json_error('Incorrect email or password.', 401);
|
|
}
|
|
|
|
issue_session((int)$user['id']);
|
|
json_out(['ok' => true, 'email' => $email]);
|