PackIt/admin/login.php

<?php
require_once __DIR__ . '/auth.php';

if (ADMIN_LOGGED_IN) {
    header('Location: index.php');
    exit;
}

// Brute-force throttling.
//
// A hard lock is applied per client IP only. Locking the *username* instead
// would let anyone shut the admin out of their own panel by guessing at it,
// so repeated failures against a username buy a growing delay rather than a
// closed door -- enough to make distributed guessing impractical.
const LOGIN_MAX_PER_IP  = 10;   // failures per IP within the window
const LOGIN_WINDOW_MIN  = 15;   // rolling window, minutes
const LOGIN_MAX_DELAY   = 5;    // seconds, cap on the per-username slowdown

function login_failures(PDO $pdo, string $column, string $value): int {
    $col = $column === 'ip' ? 'ip' : 'username';   // never interpolate raw input
    $stmt = $pdo->prepare(
        "SELECT COUNT(*) FROM login_attempts
          WHERE $col = ? AND attempted_at > (NOW() - INTERVAL " . LOGIN_WINDOW_MIN . " MINUTE)");
    $stmt->execute([$value]);
    return (int)$stmt->fetchColumn();
}

function record_login_failure(PDO $pdo, string $ip, string $user): void {
    $pdo->prepare("INSERT INTO login_attempts (ip, username) VALUES (?,?)")
        ->execute([$ip, substr($user, 0, 50)]);
    // Opportunistic cleanup so the table cannot grow without bound.
    $pdo->query("DELETE FROM login_attempts WHERE attempted_at < (NOW() - INTERVAL 1 DAY)");
}

$error = '';
$ip    = substr($_SERVER['REMOTE_ADDR'] ?? 'unknown', 0, 45);

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    require_csrf();
    $user = trim($_POST['username'] ?? '');
    $pass = $_POST['password'] ?? '';
    $pdo  = get_pdo();

    if (login_failures($pdo, 'ip', $ip) >= LOGIN_MAX_PER_IP) {
        $error = 'Too many failed attempts. Try again in ' . LOGIN_WINDOW_MIN . ' minutes.';
    } elseif ($user === '' || $pass === '') {
        $error = 'Please enter username and password.';
    } else {
        $stmt = $pdo->prepare("SELECT password_hash FROM admin_users WHERE username = ?");
        $stmt->execute([$user]);
        $row = $stmt->fetch();

        if ($row && password_verify($pass, $row['password_hash'])) {
            session_regenerate_id(true);
            $_SESSION['admin_logged_in'] = true;
            $_SESSION['admin_user']      = $user;
            // A fresh token for the new session id.
            unset($_SESSION['csrf_token']);
            // Clear this client's failure history.
            $pdo->prepare("DELETE FROM login_attempts WHERE ip = ?")->execute([$ip]);
            header('Location: index.php');
            exit;
        }

        record_login_failure($pdo, $ip, $user);
        $error = 'Invalid username or password.';
        // Slow the next guess down in proportion to how many came before it.
        sleep(min(LOGIN_MAX_DELAY, 1 + login_failures($pdo, 'username', $user)));
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>PackIt Admin – Login</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Bebas+Neue&family=DM+Sans:wght@300;400;500;600&display=swap" rel="stylesheet">
<style>
:root{--bg:#0f1117;--surface:#181c27;--border:#2a2f3f;--accent:#e8c547;--accent2:#4fd1c5;--text:#e8eaf0;--muted:#7a8099;--danger:#e05555;--radius:10px;}
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0;}
body{background:var(--bg);color:var(--text);font-family:'DM Sans',sans-serif;min-height:100vh;display:flex;align-items:center;justify-content:center;}
body::before{content:'';position:fixed;inset:0;background:radial-gradient(ellipse 60% 60% at 50% 40%, rgba(232,197,71,.05) 0%, transparent 70%);pointer-events:none;}
.login-box{background:var(--surface);border:1px solid var(--border);border-radius:var(--radius);padding:2.5rem 2rem;width:100%;max-width:360px;position:relative;}
.login-logo{font-family:'Bebas Neue',sans-serif;font-size:2.8rem;color:var(--accent);letter-spacing:.05em;margin-bottom:.25rem;}
.login-sub{font-size:.78rem;color:var(--muted);text-transform:uppercase;letter-spacing:.1em;margin-bottom:2rem;}
label{display:block;font-size:.75rem;font-weight:600;color:var(--muted);text-transform:uppercase;letter-spacing:.08em;margin-bottom:.3rem;}
input{display:block;width:100%;background:var(--bg);border:1.5px solid var(--border);color:var(--text);padding:.6rem .85rem;border-radius:var(--radius);font-family:'DM Sans',sans-serif;font-size:.9rem;outline:none;margin-bottom:1rem;transition:border-color .15s;}
input:focus{border-color:var(--accent2);}
.btn-login{width:100%;background:var(--accent);color:#0f1117;border:none;padding:.75rem;border-radius:var(--radius);font-family:'DM Sans',sans-serif;font-size:.95rem;font-weight:600;cursor:pointer;margin-top:.5rem;transition:background .15s;}
.btn-login:hover{background:#f0d260;}
.error-msg{background:rgba(224,85,85,.1);border:1px solid rgba(224,85,85,.3);color:var(--danger);padding:.65rem .9rem;border-radius:var(--radius);font-size:.85rem;margin-bottom:1rem;}
</style>
</head>
<body>
<div class="login-box">
  <div class="login-logo">PackIt</div>
  <div class="login-sub">Admin Access</div>
  <?php if ($error): ?>
  <div class="error-msg"><?= htmlspecialchars($error) ?></div>
  <?php endif; ?>
  <form method="POST">
    <?= csrf_field() ?>
    <label for="username">Username</label>
    <input type="text" id="username" name="username"
           value="<?= htmlspecialchars($_POST['username'] ?? '') ?>"
           autocomplete="username" required>
    <label for="password">Password</label>
    <input type="password" id="password" name="password"
           autocomplete="current-password" required>
    <button class="btn-login" type="submit">Sign in</button>
  </form>
</div>
</body>
</html>