<?php
/**
 * Panel Login System
 * Secure authentication for panel access
 */

session_start();

// Configuration
define('PANEL_USERNAME', 'admin');
define('PANEL_PASSWORD', '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi'); // password: password
define('MAX_LOGIN_ATTEMPTS', 5);
define('LOCKOUT_TIME', 900); // 15 minutes

// Check if already logged in
if (isset($_SESSION['panel_logged_in']) && $_SESSION['panel_logged_in'] === true) {
    header('Location: index.php');
    exit;
}

// Handle login
$error = '';
$locked = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = isset($_POST['username']) ? $_POST['username'] : '';
    $password = isset($_POST['password']) ? $_POST['password'] : '';
    
    // Check lockout
    if (isset($_SESSION['login_attempts']) && $_SESSION['login_attempts'] >= MAX_LOGIN_ATTEMPTS) {
        $lockoutEnd = isset($_SESSION['lockout_time']) ? $_SESSION['lockout_time'] : 0;
        if (time() < $lockoutEnd) {
            $remainingTime = ceil(($lockoutEnd - time()) / 60);
            $error = "Too many failed attempts. Try again in {$remainingTime} minutes.";
            $locked = true;
        } else {
            // Reset attempts after lockout period
            unset($_SESSION['login_attempts']);
            unset($_SESSION['lockout_time']);
        }
    }
    
    if (!$locked) {
        // Verify credentials
        if ($username === PANEL_USERNAME && password_verify($password, PANEL_PASSWORD)) {
            // Successful login
            $_SESSION['panel_logged_in'] = true;
            $_SESSION['panel_username'] = $username;
            $_SESSION['login_time'] = time();
            unset($_SESSION['login_attempts']);
            unset($_SESSION['lockout_time']);
            
            // Log successful login
            $logFile = __DIR__ . '/../logs/panel_access.log';
            $logMessage = sprintf(
                "[%s] Successful login - User: %s | IP: %s\n",
                date('Y-m-d H:i:s'),
                $username,
                $_SERVER['REMOTE_ADDR']
            );
            file_put_contents($logFile, $logMessage, FILE_APPEND);
            
            header('Location: index.php');
            exit;
        } else {
            // Failed login
            $_SESSION['login_attempts'] = (isset($_SESSION['login_attempts']) ? $_SESSION['login_attempts'] : 0) + 1;
            
            if ($_SESSION['login_attempts'] >= MAX_LOGIN_ATTEMPTS) {
                $_SESSION['lockout_time'] = time() + LOCKOUT_TIME;
                $error = "Too many failed attempts. Account locked for 15 minutes.";
                $locked = true;
            } else {
                $remaining = MAX_LOGIN_ATTEMPTS - $_SESSION['login_attempts'];
                $error = "Invalid credentials. {$remaining} attempts remaining.";
            }
            
            // Log failed login
            $logFile = __DIR__ . '/../logs/panel_access.log';
            $logMessage = sprintf(
                "[%s] Failed login - User: %s | IP: %s | Attempts: %d\n",
                date('Y-m-d H:i:s'),
                $username,
                $_SERVER['REMOTE_ADDR'],
                $_SESSION['login_attempts']
            );
            file_put_contents($logFile, $logMessage, FILE_APPEND);
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Panel Login - Spotify Security Test</title>
    <style>
        * {
            margin: 0;
            padding: 0;
            box-sizing: border-box;
        }
        
        body {
            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
            background: linear-gradient(135deg, #1DB954 0%, #191414 100%);
            min-height: 100vh;
            display: flex;
            align-items: center;
            justify-content: center;
            padding: 20px;
        }
        
        .login-container {
            background: white;
            border-radius: 12px;
            box-shadow: 0 10px 40px rgba(0, 0, 0, 0.3);
            padding: 40px;
            width: 100%;
            max-width: 400px;
            animation: slideIn 0.5s ease-out;
        }
        
        @keyframes slideIn {
            from {
                opacity: 0;
                transform: translateY(-20px);
            }
            to {
                opacity: 1;
                transform: translateY(0);
            }
        }
        
        .logo {
            text-align: center;
            margin-bottom: 30px;
        }
        
        .logo h1 {
            color: #1DB954;
            font-size: 28px;
            margin-bottom: 5px;
        }
        
        .logo p {
            color: #666;
            font-size: 14px;
        }
        
        .form-group {
            margin-bottom: 20px;
        }
        
        .form-group label {
            display: block;
            color: #333;
            font-weight: 600;
            margin-bottom: 8px;
            font-size: 14px;
        }
        
        .form-group input {
            width: 100%;
            padding: 12px 15px;
            border: 2px solid #e0e0e0;
            border-radius: 8px;
            font-size: 14px;
            transition: all 0.3s;
        }
        
        .form-group input:focus {
            outline: none;
            border-color: #1DB954;
            box-shadow: 0 0 0 3px rgba(29, 185, 84, 0.1);
        }
        
        .error-message {
            background: #fee;
            color: #c33;
            padding: 12px 15px;
            border-radius: 8px;
            margin-bottom: 20px;
            font-size: 14px;
            border-left: 4px solid #c33;
            animation: shake 0.5s;
        }
        
        @keyframes shake {
            0%, 100% { transform: translateX(0); }
            25% { transform: translateX(-10px); }
            75% { transform: translateX(10px); }
        }
        
        .login-button {
            width: 100%;
            padding: 14px;
            background: #1DB954;
            color: white;
            border: none;
            border-radius: 8px;
            font-size: 16px;
            font-weight: 600;
            cursor: pointer;
            transition: all 0.3s;
        }
        
        .login-button:hover:not(:disabled) {
            background: #1ed760;
            transform: translateY(-2px);
            box-shadow: 0 5px 15px rgba(29, 185, 84, 0.3);
        }
        
        .login-button:disabled {
            background: #ccc;
            cursor: not-allowed;
        }
        
        .info-box {
            margin-top: 20px;
            padding: 15px;
            background: #f5f5f5;
            border-radius: 8px;
            font-size: 13px;
            color: #666;
        }
        
        .info-box strong {
            color: #333;
        }
        
        .security-badge {
            text-align: center;
            margin-top: 20px;
            padding-top: 20px;
            border-top: 1px solid #e0e0e0;
        }
        
        .security-badge svg {
            width: 20px;
            height: 20px;
            fill: #1DB954;
            vertical-align: middle;
            margin-right: 5px;
        }
        
        .security-badge span {
            color: #666;
            font-size: 12px;
            vertical-align: middle;
        }
        
        @media (max-width: 480px) {
            .login-container {
                padding: 30px 20px;
            }
            
            .logo h1 {
                font-size: 24px;
            }
        }
    </style>
</head>
<body>
    <div class="login-container">
        <div class="logo">
            <h1>🎵 Spotify Panel</h1>
            <p>Security Test Dashboard</p>
        </div>
        
        <?php if ($error): ?>
            <div class="error-message">
                <?php echo htmlspecialchars($error); ?>
            </div>
        <?php endif; ?>
        
        <form method="POST" action="">
            <div class="form-group">
                <label for="username">Username</label>
                <input 
                    type="text" 
                    id="username" 
                    name="username" 
                    required 
                    autocomplete="username"
                    <?php echo $locked ? 'disabled' : ''; ?>
                >
            </div>
            
            <div class="form-group">
                <label for="password">Password</label>
                <input 
                    type="password" 
                    id="password" 
                    name="password" 
                    required 
                    autocomplete="current-password"
                    <?php echo $locked ? 'disabled' : ''; ?>
                >
            </div>
            
            <button type="submit" class="login-button" <?php echo $locked ? 'disabled' : ''; ?>>
                <?php echo $locked ? '🔒 Account Locked' : '🔓 Login to Panel'; ?>
            </button>
        </form>
        
        <div class="info-box">
            <strong>⚠️ Educational Purpose Only</strong><br>
            This panel is for cybersecurity education and authorized testing only.
        </div>
        
        <div class="security-badge">
            <svg viewBox="0 0 24 24">
                <path d="M12 1L3 5v6c0 5.55 3.84 10.74 9 12 5.16-1.26 9-6.45 9-12V5l-9-4z"/>
            </svg>
            <span>Secured with encryption</span>
        </div>
    </div>
</body>
</html>
