<?php
header("Access-Control-Allow-Origin: *");
header("Content-Type: application/json; charset=UTF-8");
header("Access-Control-Allow-Methods: POST");

include_once '../config/database.php';

if ($_SERVER['REQUEST_METHOD'] == 'POST') {
    $email = $_POST['email'];
    $password = $_POST['password'];

    $stmt = $conn->prepare("SELECT * FROM users WHERE email = ?");
    $stmt->execute([$email]);
    $user = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($user && password_verify($password, $user['password'])) {
        if ($user['is_blocked']) {
            echo json_encode(["success" => false, "message" => "تم حظر حسابك! يرجى التواصل مع الإدارة."]);
        } else {
            unset($user['password']);
            echo json_encode(["success" => true, "user" => $user]);
        }
    } else {
        echo json_encode(["success" => false, "message" => "بيانات الدخول غير صحيحة"]);
    }
}
?>
