View Code - 20260722

employee_portal1.php | 20260722_120325.php Initial Domain Snapshot

<?php
/* =========================================================
   File: /erp/public/employee_portal.php
   Purpose: Employee Portal Login (email or mobile) -> same session as login.php
   Scope : Page-local only. No global/base edits.
   ========================================================= */
error_reporting(E_ALL); ini_set('display_errors', 1);

/* ---- Auth bootstrap ---- */
require_once __DIR__ . '/../modules/auth/auth.php'; // uses shared session helpers
require_once __DIR__ . '/../core/db.php';           // $pdo

session_start();

/* ---- Helpers ---- */
function h($s){ return htmlspecialchars((string)$s, ENT_QUOTES, 'UTF-8'); }
function norm_mobile($s){
  $d = preg_replace('/\D+/','', (string)$s);
  if ($d === '') return '';
  // keep last 10 (Indian). If starts with 91 and >=12, keep last 10.
  return substr($d, -10);
}
function table_has_col(PDO $pdo, string $table, string $col): bool {
  try { $pdo->query("SELECT `$col` FROM `$table` WHERE 1=0"); return true; }
  catch(Throwable $e){ return false; }
}

/* ---- Sticky form ---- */
$identifier = $_POST['identifier'] ?? '';
$pwd        = $_POST['password']   ?? '';
$err        = null;

/* ---- Login handler ---- */
if ($_SERVER['REQUEST_METHOD']==='POST') {
  try {
    $id = trim($identifier);
    if ($id === '' || $pwd === '') { throw new RuntimeException('Please enter mobile/email and password.'); }

$company_id = 0;
    // If your multi-company is derived at login time, load by domain or ask user.
    // For now, infer from any existing owner/admin session if present.
    if (!empty($_SESSION['user']['company_id'])) {
      $company_id = (int)$_SESSION['user']['company_id'];
    }

// Try USERS table first (same as login.php)
    $hasMobile = table_has_col($pdo, 'users', 'mobile');
    $nm        = norm_mobile($id);
    $userRow   = null;

if ($hasMobile) {
      $sql = "SELECT id, company_id, name, email, mobile, role, password_hash
              FROM users
              WHERE (email = :id OR mobile = :mob) " . ($company_id ? "AND company_id = :cid " : "") . "LIMIT 1";
      $st  = $pdo->prepare($sql);
      $st->bindValue(':id',  $id);
      $st->bindValue(':mob', $nm);
      if ($company_id) $st->bindValue(':cid', $company_id, PDO::PARAM_INT);
      $st->execute();
      $userRow = $st->fetch(PDO::FETCH_ASSOC) ?: null;
    } else {
      $sql = "SELECT id, company_id, name, email, role, password_hash
              FROM users
              WHERE email = :id " . ($company_id ? "AND company_id = :cid " : "") . "LIMIT 1";
      $st  = $pdo->prepare($sql);
      $st->bindValue(':id',  $id);
      if ($company_id) $st->bindValue(':cid', $company_id, PDO::PARAM_INT);
      $st->execute();
      $userRow = $st->fetch(PDO::FETCH_ASSOC) ?: null;
    }

// If not found in users, fall back to employee_login_data joined with employees.mobile
    if (!$userRow) {
      $empHas = table_has_col($pdo, 'employees', 'mobile');
      $sql = "SELECT l.id as login_id, l.company_id, 
                     COALESCE(e.name, l.email) as name,
                     COALESCE(l.email, '') as email,
                     l.password_hash
              FROM employee_login_data l
              LEFT JOIN employees e
                     ON e.id = l.employee_id AND e.company_id = l.company_id
              WHERE l.status='Active'
                AND (l.email = :id OR l.username = :id ".($empHas ? " OR e.mobile = :mob " : "").") "
                . ($company_id ? "AND l.company_id = :cid " : "") .
              "LIMIT 1";
      $st = $pdo->prepare($sql);
      $st->bindValue(':id', $id);
      if ($empHas)     $st->bindValue(':mob', $nm);
      if ($company_id) $st->bindValue(':cid', $company_id, PDO::PARAM_INT);
      $st->execute();
      $lrow = $st->fetch(PDO::FETCH_ASSOC) ?: null;

if ($lrow && password_verify($pwd, $lrow['password_hash'])) {
        // Build standard session user array (role=Employee)
        session_regenerate_id(true);
        $_SESSION['user'] = [
          'id'         => (int)$lrow['login_id'],   // login id
          'company_id' => (int)$lrow['company_id'],
          'name'       => (string)$lrow['name'],
          'email'      => (string)$lrow['email'],
          'role'       => 'Employee',
        ];
        header('Location: /erp/public/index.php'); exit;
      }
    }

// Verify users row credentials
    if ($userRow && password_verify($pwd, $userRow['password_hash'])) {
      session_regenerate_id(true);
      $_SESSION['user'] = [
        'id'         => (int)$userRow['id'],
        'company_id' => (int)$userRow['company_id'],
        'name'       => (string)$userRow['name'],
        'email'      => (string)$userRow['email'],
        'role'       => (string)($userRow['role'] ?? 'Employee'),
      ];
      header('Location: /erp/public/index.php'); exit;
    }

// Fail
    $err = 'Invalid mobile/email or password';

} catch (Throwable $e) {
    $err = $e->getMessage();
  }
}
?>
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Employee Portal — Login</title>
<style>
  :root{
    --brand-600:#2C8F47; --brand-700:#1E5A2C; --green-50:#F5FFF7;
    --gray-900:#111827; --gray-700:#374151; --gray-500:#6B7280;
    --gray-300:#E5E7EB; --gray-100:#F3F4F6; --white:#fff; --danger:#EF4444;
  }
  body{margin:0;background:var(--green-50);font-family:system-ui,-apple-system,Segoe UI,Roboto,Arial,sans-serif;color:var(--gray-900)}
  .wrap{max-width:380px;margin:48px auto;padding:0 12px}
  .card{background:var(--white);border:1px solid var(--gray-300);border-radius:16px;box-shadow:0 10px 30px rgba(0,0,0,.06);padding:18px}
  h1{margin:4px 0 2px;text-align:center;color:var(--brand-700);font-weight:800}
  .sub{margin:0 0 16px;text-align:center;color:var(--gray-500);font-size:12px}
  label{display:block;margin:10px 0 6px;color:var(--gray-900);font-weight:700}
  input{width:100%;padding:10px 12px;border:1px solid var(--gray-300);border-radius:10px;background:#eef5ff;font-size:16px}
  .row{position:relative}
  .show{position:absolute;right:8px;top:37px;border:1px solid var(--gray-300);background:#fff;border-radius:8px;padding:6px 10px;cursor:pointer}
  .err{background:#ffecec;border:1px solid #ffc9c9;color:var(--danger);padding:8px 10px;border-radius:10px;margin:10px 0}
  .btn{width:100%;padding:12px 14px;background:var(--brand-600);color:#fff;border:1px solid var(--brand-700);border-radius:10px;font-size:16px;font-weight:700;cursor:pointer;margin-top:6px}
  .muted{font-size:12px;color:var(--gray-500);text-align:center;margin-top:10px}
</style>
<script>
function togglePwd(btn){
  const i = document.getElementById('password');
  i.type = (i.type==='password'?'text':'password');
  btn.textContent = (i.type==='password'?'Show':'Hide');
}
</script>
</head>
<body>
<div class="wrap">
  <div class="card">
    <h1>Employee Portal</h1>
    <p class="sub">Login to continue</p>

<?php if ($err): ?><div class="err"><?php echo h($err); ?></div><?php endif; ?>

<form method="post" autocomplete="off">
      <div class="row">
        <label>Mobile / Email</label>
        <input type="text" name="identifier" id="identifier" inputmode="tel"
               value="<?php echo h($identifier); ?>" autocomplete="off" placeholder="9XXXXXXXXX / name@company.com">
      </div>

<div class="row">
        <label>Password</label>
        <input type="password" name="password" id="password" autocomplete="new-password" placeholder="••••••••">
        <button type="button" class="show" onclick="togglePwd(this)">Show</button>
      </div>

<button class="btn" type="submit">Login</button>
      <p class="muted"><a href="/erp/public/login.php">Admin/Staff login</a> • <a href="/erp/public/password_reset.php">Password reset</a></p>
    </form>
  </div>
</div>
</body>
</html>