<?php
require __DIR__.'/bootstrap.php'; method('POST');
$in=input_json(8192); $user=trim((string)($in['username']??'')); $pass=(string)($in['password']??'');
if(!hash_equals((string)$config['username'],$user)||!password_verify($pass,(string)$config['password_hash'])){usleep(350000);respond(['error'=>'Credenciales inválidas.'],401);}
session_regenerate_id(true); $_SESSION['authenticated']=true; $_SESSION['username']=$user; $_SESSION['csrf']=bin2hex(random_bytes(24));
respond(['authenticated'=>true,'username'=>$user,'csrf'=>$_SESSION['csrf']]);
