<?php
require_once __DIR__ . '/config.php';

ini_set('session.cookie_httponly', '1');
ini_set('session.cookie_samesite', 'Lax');
session_start();
header('Content-Type: application/json');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $data = json_decode(file_get_contents('php://input'), true);
    if (isset($data['user'], $data['pass'])
        && $data['user'] === AUTH_USER
        && $data['pass'] === AUTH_PASS) {
        $_SESSION['qw_auth'] = true;
        echo json_encode(['status' => 'success']);
    } else {
        http_response_code(401);
        echo json_encode(['status' => 'error', 'message' => 'Usuario o contraseña incorrectos']);
    }
    exit;
}

if (($_GET['action'] ?? '') === 'logout') {
    session_destroy();
    echo json_encode(['status' => 'success']);
    exit;
}

http_response_code(405);
echo json_encode(['status' => 'error', 'message' => 'Método no permitido']);