<?php
session_start();
require_once 'db_connection.php'; // مسیر صحیح به فایل db_connection.php

if ($_SERVER["REQUEST_METHOD"] == "POST") {
    $username = $_POST['username'];
    $password = $_POST['password'];

    // بررسی کاربر و نقش وی
    $sql = "SELECT user_id, username, password, role FROM users WHERE username = ?";
    $stmt = $conn->prepare($sql);
    $stmt->bind_param('s', $username);
    $stmt->execute();
    $stmt->store_result();
    $stmt->bind_result($user_id, $username, $db_password, $role);
    $stmt->fetch();

    if ($stmt->num_rows > 0 && $password === $db_password) { // مقایسه مستقیم رمز عبور
        if ($role == 'admin') {
            // ایجاد نشست (session)
            $_SESSION['user_id'] = $user_id;
            $_SESSION['username'] = $username;
            $_SESSION['role'] = $role;
            header("Location: admin_cms.php");
        } else {
            echo "Access denied: You do not have admin privileges.";
        }
    } else {
        echo "Invalid username or password.";
    }

    $stmt->close();
    $conn->close();
}
?>
