<?php
header('Content-Type: application/json');
require("../inc/connect.php");
require("../inc/crypt.php");

$username = $_GET['username'];
$password = $_GET['password'];

if($username == "")
{
	echo '{"error":"No username"}';
	exit;
}

if($password == "")
{
	echo '{"error":"No password"}';
	exit;
}

//Check if user exists
$sql = "SELECT `id`, `password`, `verified` FROM `user` WHERE `username`='" . $username . "'";
$query = ExecQuery($mysqli, $sql);

if($query->num_rows < 1){
	echo '{"error": "Username or password incorrect"}';
	exit;
}
else
{
	//Check if password is correct
	$result = $query->fetch_assoc();
	$verified = $result['verified'];
	$password_hash = $result['password'];

	if(!password_verify($password, $password_hash)){
		echo '{"error": "Username or password incorrect"}';
		exit;
	}
	else if($verified == 0)
	{
		echo '{"error": "Your email address has not yet been verified"}';
		exit;
	}
	else
	{
		//Get user ID, IP
		$id = $result['id'];
		$ip = $_SERVER['REMOTE_ADDR'];

		//Set default device
		$sql = "SELECT `id` FROM `device` WHERE `user`=$id LIMIT 0,1";
		$query = ExecQuery($mysqli, $sql);

		if($query->num_rows < 1)
		{
			$deviceid = 0;
		}
		else
		{
			$result = $query->fetch_assoc();
			$deviceid = $result['id'];
		}

		$sessionid = RandomString(60);

		//Update Session ID, Last Login, IP in database
		$sql = "INSERT INTO session (`user`, `session`, `time`, `remember`, `ip`, `dev_id`, `dev_type`) VALUES ($id, '$sessionid', NOW(), 1, '$ip', $deviceid, 'Android')";
		ExecQuery($mysqli, $sql);

		//Show session id
		echo '{"success": true, "session": "' . $sessionid . '"}';
	}
}

?>