<?php require dirname(__DIR__).'/app/core.php';if(user())go('index.php');$error='';if($_SERVER['REQUEST_METHOD']==='POST'){$name=trim($_POST['username']??'');$s=$pdo->prepare('SELECT * FROM users WHERE username=? COLLATE NOCASE AND active=1');$s->execute([$name]);$x=$s->fetch();if($x&&(!$x['locked_until']||$x['locked_until']<gmdate('Y-m-d\TH:i:s\Z'))&&password_verify($_POST['password']??'',$x['password_hash'])){session_regenerate_id(true);$_SESSION['auth']=['id'=>$x['id'],'username'=>$x['username'],'display_name'=>$x['display_name'],'role'=>$x['role']];$pdo->prepare("UPDATE users SET failed_login_count=0,locked_until=NULL,last_login_at=strftime('%Y-%m-%dT%H:%M:%fZ','now') WHERE id=?")->execute([$x['id']]);audit('authentication','LOGIN_SUCCESS');go('index.php');}$error='Invalid credentials or locked account.';if($x){$n=$x['failed_login_count']+1;$lock=$n>=5?gmdate('Y-m-d\TH:i:s\Z',time()+900):null;$pdo->prepare('UPDATE users SET failed_login_count=?,locked_until=? WHERE id=?')->execute([$n,$lock,$x['id']]);}audit('authentication','LOGIN_FAILURE','failure',null,null,$name);} ?><!doctype html><html><body style="font:16px Arial;max-width:420px;margin:60px auto"><h1>AFGTracv5 Login</h1><p style="color:#b42318"><?=e($error)?></p><form method="post"><p><input name="username" placeholder="Username" required></p><p><input type="password" name="password" placeholder="Password" required></p><button>Sign in</button></form></body></html>