<?php
declare(strict_types=1);
/**
 * super_login.php — IP bypass emergency login
 *
 * This page lets an admin log in even if their IP is not in allowed_ip.
 * It requires a super_key (stored in DB settings table) in ADDITION to
 * normal username + password.
 *
 * After successful login, it redirects to super_panel.php where you can
 * update allowed_ip for any admin account.
 *
 * URL: https://ludoking.gamingserver.win/super_login.php
 * Keep this URL secret. The super_key adds a second layer of security.
 */
require_once __DIR__ . '/db.php';
require_once __DIR__ . '/auth.php';

// If already logged in normally, go to panel
if (lk_is_admin()) {
    header('Location: /super_panel.php');
    exit;
}

$err = '';
$ok  = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $superKey = trim((string)($_POST['super_key'] ?? ''));
    $user     = trim((string)($_POST['username'] ?? ''));
    $pass     = (string)($_POST['password'] ?? '');

    if ($superKey === '' || $user === '' || $pass === '') {
        $err = 'All fields are required.';
    } else {
        try {
            $pdo = lk_pdo();

            // Fetch super_key from settings
            $kSt = $pdo->query("SELECT value FROM settings WHERE `key`='super_access_key' LIMIT 1");
            $kRow = $kSt ? $kSt->fetch(PDO::FETCH_ASSOC) : null;
            $storedKey = $kRow ? trim((string)$kRow['value']) : '';

            if ($storedKey === '' || !hash_equals($storedKey, $superKey)) {
                $err = 'Invalid super key.';
            } else {
                // Verify username + password (ignore IP)
                $aSt = $pdo->prepare("SELECT id, password_hash, is_active FROM admins WHERE username=? LIMIT 1");
                $aSt->execute([$user]);
                $row = $aSt->fetch(PDO::FETCH_ASSOC);

                if (!$row || (int)$row['is_active'] !== 1) {
                    $err = 'Invalid credentials.';
                } elseif (!password_verify($pass, (string)$row['password_hash'])) {
                    $err = 'Invalid credentials.';
                } else {
                    // Log in without IP check
                    session_regenerate_id(true);
                    $_SESSION['lk_admin_id'] = (int)$row['id'];
                    $_SESSION['lk_admin_ua'] = lk_ua_hash();
                    // Mark as super session so super_panel trusts it
                    $_SESSION['lk_super_session'] = 1;

                    header('Location: /super_panel.php');
                    exit;
                }
            }
        } catch (Throwable $e) {
            $err = 'Server error. Try again.';
        }
    }
}
?><!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>LudoKing — Super Login</title>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700;900&display=swap" rel="stylesheet">
<style>
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
:root{
  --bg:#0b1120;--card:#111c35;--bd:rgba(255,255,255,.08);
  --txt:#e2e8f0;--muted:rgba(226,232,240,.55);
  --a1:#f59e0b;--a2:#d97706;--bad:#ef4444;
}
body{min-height:100dvh;display:flex;align-items:center;justify-content:center;background:var(--bg);font-family:'Inter',sans-serif;color:var(--txt);padding:20px;}
body::before{
  content:'';position:fixed;inset:0;pointer-events:none;z-index:0;
  background:
    radial-gradient(ellipse 60% 50% at 20% 20%,rgba(245,158,11,.12),transparent),
    radial-gradient(ellipse 50% 60% at 80% 80%,rgba(239,68,68,.08),transparent);
}
.card{
  position:relative;z-index:1;
  background:var(--card);border:1px solid var(--bd);
  border-radius:24px;padding:36px 32px 32px;
  width:100%;max-width:420px;
  box-shadow:0 32px 80px rgba(0,0,0,.55);
}
.logo{text-align:center;margin-bottom:28px;}
.logo .icon{
  display:inline-flex;align-items:center;justify-content:center;
  width:64px;height:64px;border-radius:20px;
  background:linear-gradient(135deg,var(--a1),var(--a2));
  font-size:28px;margin-bottom:12px;
  box-shadow:0 8px 28px rgba(245,158,11,.4);
}
.logo h1{font-size:22px;font-weight:900;}
.logo p{font-size:13px;color:var(--muted);margin-top:4px;}
label{display:block;font-size:13px;font-weight:700;color:var(--muted);margin-bottom:6px;}
.inp{
  width:100%;padding:12px 16px;background:rgba(255,255,255,.05);
  border:1px solid var(--bd);border-radius:12px;color:var(--txt);
  font-size:15px;font-family:inherit;outline:none;transition:border-color .2s;
}
.inp:focus{border-color:var(--a1);}
.field{margin-bottom:18px;}
.btn{
  width:100%;padding:14px;border:none;border-radius:14px;cursor:pointer;
  font-size:16px;font-weight:900;font-family:inherit;
  background:linear-gradient(135deg,var(--a1),var(--a2));
  color:#fff;box-shadow:0 8px 24px rgba(245,158,11,.4);
  transition:box-shadow .18s,transform .18s;
}
.btn:hover{box-shadow:0 12px 34px rgba(245,158,11,.55);transform:translateY(-1px);}
.err{background:rgba(239,68,68,.12);border:1px solid rgba(239,68,68,.28);color:#fca5a5;border-radius:12px;padding:12px 16px;font-size:13px;font-weight:700;margin-bottom:18px;}
.warn{background:rgba(245,158,11,.10);border:1px solid rgba(245,158,11,.25);color:#fde68a;border-radius:12px;padding:12px 16px;font-size:12px;margin-bottom:20px;line-height:1.6;}
.divider{display:flex;align-items:center;gap:12px;margin-bottom:20px;}
.divider span{flex:1;height:1px;background:var(--bd);}
.divider em{font-size:11px;color:var(--muted);font-style:normal;}
</style>
</head>
<body>
<div class="card">
  <div class="logo">
    <div class="icon">🔑</div>
    <h1>Super Access</h1>
    <p>Emergency IP Bypass Login</p>
  </div>
  <div class="warn">
    ⚠️ This page bypasses the IP restriction. Use it to update your allowed IP address, then log in normally next time.
  </div>
  <?php if ($err !== ''): ?>
    <div class="err"><?= lk_e($err) ?></div>
  <?php endif; ?>
  <form method="post">
    <div class="field">
      <label for="super_key">Super Key</label>
      <input class="inp" type="password" id="super_key" name="super_key" placeholder="Secret access key" required autocomplete="off">
    </div>
    <div class="divider"><span></span><em>+ Normal Credentials</em><span></span></div>
    <div class="field">
      <label for="username">Username</label>
      <input class="inp" type="text" id="username" name="username" required autocomplete="username">
    </div>
    <div class="field">
      <label for="password">Password</label>
      <input class="inp" type="password" id="password" name="password" required autocomplete="current-password">
    </div>
    <button class="btn" type="submit">Enter Super Panel →</button>
  </form>
</div>
</body>
</html>
