<!DOCTYPE html>
<html lang="zh-CN">

<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />
  <title>LawRisk 登录</title>
  <style>
    :root {
      color-scheme: light dark;
      font-family: "Microsoft YaHei", "SimHei", system-ui, sans-serif;
      /* 政务风格配色 - 严肃简洁 */
      --primary-color: #1e3a5f;
      --primary-dark: #2c5282;
      --primary-light: #4a5568;
      --bg-dark: #f7fafc;
      --bg-panel: #ffffff;
      --border-color: #cbd5e0;
      --text-primary: #2d3748;
      --text-secondary: #4a5568;
      --success-color: #2f855a;
      --error-color: #c53030;
      --shadow-color: rgba(30, 58, 95, 0.15);
    }

    body {
      margin: 0;
      min-height: 100vh;
      display: flex;
      align-items: center;
      justify-content: center;
      background: linear-gradient(135deg, #edf2f7 0%, #e2e8f0 100%);
      color: var(--text-primary);
    }

    .panel {
      width: min(360px, 92vw);
      background: var(--bg-panel);
      border: 1px solid var(--border-color);
      border-radius: 8px;
      padding: 32px;
      box-shadow: 0 4px 6px rgba(0, 0, 0, 0.07);
      border-top: 3px solid var(--primary-color);
    }

    h1 {
      margin-top: 0;
      font-size: 1.4rem;
      letter-spacing: 0.02em;
      color: var(--text-primary);
      text-align: center;
      font-weight: 600;
    }

    label {
      display: block;
      font-size: 0.85rem;
      margin-bottom: 6px;
      color: var(--text-secondary);
      font-weight: 500;
    }

    input {
      width: 100%;
      padding: 10px 12px;
      border-radius: 4px;
      border: 1px solid var(--border-color);
      background: #ffffff;
      color: var(--text-primary);
      font-size: 0.95rem;
      transition: all 0.2s ease;
    }

    input:focus {
      outline: none;
      border-color: var(--primary-color);
      box-shadow: 0 0 0 3px rgba(30, 58, 95, 0.1);
    }

    input::placeholder {
      color: #a0aec0;
    }

    button {
      width: 100%;
      margin-top: 20px;
      border: none;
      border-radius: 4px;
      padding: 12px;
      font-size: 1rem;
      background: var(--primary-color);
      color: white;
      font-weight: 600;
      cursor: pointer;
      transition: all 0.2s ease;
    }

    button:hover {
      background: var(--primary-dark);
    }

    button:active {
      background: var(--primary-color);
    }

    .message {
      margin-top: 12px;
      min-height: 18px;
      font-size: 0.85rem;
      padding: 8px 12px;
      border-radius: 4px;
      background: #edf2f7;
    }

    .error {
      color: var(--error-color);
      background: #fed7d7;
    }

    .success {
      color: var(--success-color);
      background: #c6f6d5;
    }
  </style>
</head>

<body>
  <main class="panel">
    <h1>登录 LawRisk</h1>
    <form id="login-form" method="post" action="{{ url_for('auth.login_action') }}">
      <input type="hidden" name="next" id="next" />
      <label for="username">账号</label>
      <input type="text" id="username" name="username" autocomplete="username" required />

      <label for="password">密码</label>
      <input type="password" id="password" name="password" autocomplete="current-password" required />

      <button type="submit">登录</button>
      <p id="message" class="message"></p>
    </form>
  </main>

  <script>
    const form = document.getElementById("login-form");
    const message = document.getElementById("message");
    const nextField = document.getElementById("next");
    const params = new URLSearchParams(window.location.search);
    let nextPath = params.get("next") || "/";

    // Security: Ensure next parameter is a safe path, not a full URL with query params
    // This prevents password leakage in URLs
    try {
      if (nextPath.startsWith('http://') || nextPath.startsWith('https://')) {
        const url = new URL(nextPath);
        nextPath = url.pathname; // Only use path, strip query string
      }
      // Remove any query parameters from the next path for security
      if (nextPath.includes('?')) {
        nextPath = nextPath.split('?')[0];
      }
    } catch (e) {
      // If URL parsing fails, default to root
      nextPath = "/";
    }

    nextField.value = nextPath;

    // Show security warning if URL contained suspicious parameters
    const urlParams = new URLSearchParams(window.location.search);
    const hasSensitiveParams = urlParams.has('password') || urlParams.has('token') || urlParams.has('key');
    if (hasSensitiveParams) {
      message.textContent = "⚠️ 安全提示：请勿在URL中传递密码等敏感信息！";
      message.className = "message error";
      console.warn("Security warning: Sensitive parameters detected in URL. Passwords should never be passed via URL parameters.");
    }

    form.addEventListener("submit", async (event) => {
      event.preventDefault();
      message.textContent = "正在验证...";
      message.className = "message";

      const formData = new FormData(form);
      const payload = Object.fromEntries(formData.entries());
      payload.next = nextPath;

      try {
        const response = await fetch(form.action, {
          method: "POST",
          headers: { "Content-Type": "application/json" },
          body: JSON.stringify(payload),
        });
        const data = await response.json();
        if (!response.ok) {
          throw new Error(data.error || "登录失败");
        }
        message.textContent = "登录成功，正在跳转...";
        message.className = "message success";
        setTimeout(() => {
          window.location.href = data.redirect || nextPath || "/";
        }, 600);
      } catch (error) {
        message.textContent = error.message;
        message.className = "message error";
      }
    });
  </script>
</body>

</html>