<?php
header('Content-Type: application/json');
require_once 'config.php';

// Handle CORS
header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, GET, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit();
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $rawData = file_get_contents('php://input');
    $data = json_decode($rawData, true);

    if (!$data) {
        $data = $_POST;
    }

    if (empty($data['email']) || empty($data['password'])) {
        http_response_code(400);
        die(json_encode([
            'error' => 'Email and password are required',
            'debug' => ['raw' => $rawData, 'post' => $_POST]
        ]));
    }

    $result = loginUser($data['email'], $data['password']);
    
    if ($result['success']) {
        http_response_code(200);
    } else {
        http_response_code(401);
    }

    die(json_encode($result));
}

http_response_code(405);
die(json_encode(['error' => 'Method not allowed']));