<?php
session_start();
header('X-Content-Type-Options: nosniff');
header('X-Frame-Options: DENY');
header('X-XSS-Protection: 1; mode=block');
header("Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'");

// Security token handling
if (empty($_SESSION['auth_token']) || (isset($_POST['token']) && $_POST['token'] !== $_SESSION['auth_token'])) {
    $_SESSION['auth_token'] = bin2hex(random_bytes(32));
}

$error = '';
$loginSuccess = false;
$login = false;
$server = $_SERVER['SERVER_NAME'];

if ($server === "93.95.229.174") {
    $server = "VOID";
}

if ($login) {
    $webtitle = "Secure Login";
    $subtittle = "Login to Members only area";
} else {
    $webtitle = $server;
    $subtitle = "Welcome";
}

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    // Honeypot detection (field name: "user_identifier")
        if (!empty($_POST['user_identifier'])) {
        // Log honeypot trigger (IP, timestamp, user agent)
        $log = sprintf(
            "[%s] HONEYPOT TRIGGERED | IP: %s | UA: %s\n",
            date('Y-m-d H:i:s'),
            $_SERVER['REMOTE_ADDR'],
            substr($_SERVER['HTTP_USER_AGENT'] ?? '', 0, 150)
        );
        error_log($log, 3, 'honeypot.log');

        $error = 'Invalid credentials. Please try again.';
    }
    // Valid token but empty honeypot (real user)
    elseif ($_POST['token'] === $_SESSION['auth_token']) {
        // Always fail login (honeypot purpose)
        $error = 'Invalid credentials. Please try again.';
    }

    // Regenerate token after each submission
    $_SESSION['auth_token'] = bin2hex(random_bytes(32));
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?=$webtitle?></title>
    <link rel="stylesheet" href="style.css">
</head>
<body>
    <!-- Theme Toggle - FIXED SECTION -->
    <input type="checkbox" id="theme-toggle" class="theme-toggle">
    <label for="theme-toggle" class="toggle-label">

    </label>

    <!-- Background Elements -->
    <div class="grid-background"></div>
    <div class="gradient-bg"></div>

    <!-- Login Container -->
    <div class="container">

        <header class="header">
            <h1 class="logo"><?=$webtitle?></h1>
            <p class="tagline"<?=$subtitle?></p>
        </header>
        <?php if ($error): ?>
            <div class="error-message" role="alert">
                <?= htmlspecialchars($error) ?>
            </div>
        <?php endif; ?>

        <?php if ($loginSuccess): ?>
            <div class="success-message" role="status">
                Authentication successful! Redirecting...
            </div>
        <?php endif; ?>
        <?php if ($login): ?>
        <form class="login-form" id="loginForm" novalidate>
            <input type="hidden" name="token" value="<?=htmlspecialchars($_SESSION['auth_token']) ?>">
            <div class="input-group">
                <input type="text" id="email" required autocomplete="off">
                <label for="email">Email Address</label>
                <div class="error-msg" id="email-error"></div>
            </div>

            <div class="input-group">
                <input type="password" id="password" required>
                <label for="password">Secure Password</label>
                <div class="error-msg" id="password-error"></div>
            </div>
            <div class="usercode">
                <label for="user_identifier" class="sr-only">User Identifier</label>
                <input type="text" id="user_identifier" name="user_identifier" autocomplete="off" tabindex="-1">
            </div>

            <button type="submit" class="btn">Authenticate</button>
        </form>
        <?php endif; ?>
    </div>

    <!-- Footer -->
    <div class="footer">
        <div class="footer-links">
            <span class="footer-link" data-modal="privacy">Privacy Policy</span>
            <span class="footer-link" data-modal="terms">Terms of Use</span>
        </div>
        <p class="footer-text">© 2026 <?=$webtitle?>. All rights reserved. Compliant with Canadian privacy legislation.</p>
    </div>

    <!-- Privacy Policy Modal -->
    <div class="modal-overlay" id="privacy-modal">
        <div class="modal-content">
            <div class="modal-header">
                <h2 class="modal-title">Privacy Policy</h2>
                <button class="modal-close" data-close="privacy">&times;</button>
            </div>
            <div class="modal-body">
                <h2>1. Introduction</h2>
                <p>This Privacy Policy outlines how <?=$webtitle?> ("we", "us", or "our") collects, uses, discloses, and protects your personal information in accordance with the <strong>Personal Information Protection and Electronic Documents Act (PIPEDA)</strong> and other applicable Canadian privacy legislation. By using our services, you consent to the practices described in this policy.</p>

                <h2>2. Information We Collect</h2>
                <p><strong>Personal Information:</strong> We collect only the personal information necessary to provide our services, including:</p>
                <ul>
                    <li>Email address provided during account creation</li>
                    <li>Encrypted password (stored using industry-standard bcrypt hashing)</li>
                    <li>IP address and device information for security purposes</li>
                    <li>Basic usage data to improve our services</li>
                </ul>

                <h2>3. Purpose of Collection</h2>
                <p>We collect personal information for the following purposes, in compliance with PIPEDA's principle of specifying purposes:</p>
                <ol>
                    <li>To create and maintain your user account</li>
                    <li>To authenticate and secure your access to our services</li>
                    <li>To communicate with you regarding your account or service updates</li>
                    <li>To detect, prevent, and address technical issues or security vulnerabilities</li>
                    <li>To comply with legal obligations under Canadian law</li>
                </ol>

                <h2>4. Consent</h2>
                <p>In accordance with PIPEDA, we obtain your informed consent for the collection, use, and disclosure of your personal information. By creating an account and using our services, you provide express consent to this Privacy Policy. You may withdraw consent at any time by deleting your account, though this may limit your ability to use our services.</p>

                <h2>5. Use and Disclosure</h2>
                <p>Your personal information is used only for the purposes identified above. We do not sell, trade, or rent your personal information to third parties. We may disclose your information:</p>
                <ul>
                    <li>With your express consent</li>
                    <li>When required by law or to comply with a court order in Canada</li>
                    <li>To protect our rights, privacy, safety, or property as permitted by law</li>
                    <li>To law enforcement authorities if we believe in good faith that disclosure is necessary to prevent physical harm or financial loss</li>
                </ul>

                <h2>6. Data Security</h2>
                <p>We implement security measures consistent with Treasury Board of Canada Secretariat standards to protect your personal information against unauthorized access, disclosure, or misuse. These include:</p>
                <ul>
                    <li>Encryption of data in transit (TLS 1.2 or higher)</li>
                    <li>Strong password hashing using bcrypt</li>
                    <li>Regular security assessments</li>
                    <li>Access controls limiting data access to authorized personnel only</li>
                </ul>
                <p>Despite these measures, no method of transmission over the Internet is 100% secure.</p>

                <h2>7. Data Retention</h2>
                <p>In compliance with Canadian records retention requirements, we retain your personal information only as long as necessary:</p>
                <ul>
                    <li>Active accounts: Until you delete your account</li>
                    <li>Inactive accounts: 24 months before automatic deletion</li>
                    <li>Log data: 12 months for security and audit purposes</li>
                </ul>
                <p>Upon account deletion, we permanently erase your personal information within 30 days, except where retention is required by Canadian law.</p>

                <h2>8. Your Canadian Privacy Rights</h2>
                <p>As required by PIPEDA, you have the right to:</p>
                <ul>
                    <li>Access your personal information held by us</li>
                    <li>Request correction of inaccurate information</li>
                    <li>Request information about our policies and practices</li>
                    <li>Withdraw consent (with certain limitations)</li>
                    <li>File a complaint with the Office of the Privacy Commissioner of Canada</li>
                </ul>
                <p>To exercise these rights, please contact our Privacy Officer using the information in Section 10.</p>

                <h2>9. Cross-Border Data Transfers</h2>
                <p>While we strive to store all data within Canada, certain service providers may process data outside Canada. In such cases, we implement appropriate contractual safeguards to protect your information as required by PIPEDA.</p>
<!--
                <h2>10. Contact Information</h2>
                <p>For any privacy-related questions or concerns, please contact our Privacy Officer:</p>
                <p><?=$webtitle?> Privacy Officer<br>
                123 Digital Security Avenue<br>
                Toronto, ON M5G 1Z8<br>
                Canada<br>
                Email: privacy@securearea.ca<br>
                Phone: +1 (416) 555-0199</p>-->

                <h2>11. Policy Updates</h2>
                <p>This Privacy Policy may be updated periodically to reflect changes in our practices or legal requirements. We will notify users of material changes through our website. Continued use of our services after changes constitute acceptance of the updated policy.</p>
            </div>
            <div class="modal-footer">
                <button class="modal-accept" data-close="privacy">I Understand</button>
            </div>
        </div>
    </div>

    <!-- Terms of Use Modal -->
    <div class="modal-overlay" id="terms-modal">
        <div class="modal-content">
            <div class="modal-header">
                <h2 class="modal-title">Terms of Use</h2>
                <button class="modal-close" data-close="terms">&times;</button>
            </div>
            <div class="modal-body">
                <h2>1. Acceptance of Terms</h2>
                <p>These Terms of Use ("Terms") govern your access to and use of <?=$webtitle?> services ("Services"). By creating an account or using our Services, you agree to be bound by these Terms and our Privacy Policy. If you do not agree, please do not use our Services.</p>

                <h2>2. Eligibility</h2>
                <p>To use our Services, you must:</p>
                <ul>
                    <li>Be at least 18 years of age</li>
                    <li>Be legally capable of entering into binding contracts</li>
                    <li>Be a resident of Canada or have legal capacity under Canadian law</li>
                </ul>
                <p>By using our Services, you represent and warrant that you meet these eligibility requirements.</p>

                <h2>3. Account Registration</h2>
                <p>To access certain features, you must create an account by providing accurate and complete information. You are responsible for:</p>
                <ul>
                    <li>Maintaining the confidentiality of your account credentials</li>
                    <li>All activities that occur under your account</li>
                    <li>Immediately notifying us of any unauthorized use</li>
                </ul>
                <p>We reserve the right to suspend or terminate accounts that violate these Terms.</p>

                <h2>4. User Responsibilities</h2>
                <p>When using our Services, you agree not to:</p>
                <ol>
                    <li>Violate any Canadian federal, provincial, or territorial law</li>
                    <li>Transmit any unlawful, threatening, or harassing content</li>
                    <li>Attempt to gain unauthorized access to our systems</li>
                    <li>Interfere with the proper functioning of our Services</li>
                    <li>Use automated means to access our Services without permission</li>
                </ol>

                <h2>5. Intellectual Property</h2>
                <p>All content and functionality of our Services, including text, graphics, logos, and software, are owned by or licensed to <?=$webtitle?> and protected by Canadian and international copyright and trademark laws. You may not reproduce, distribute, or create derivative works without our express written permission.</p>

                <h2>6. Limitation of Liability</h2>
                <p>To the fullest extent permitted by Canadian law, <?=$webtitle?> and its affiliates shall not be liable for any indirect, incidental, special, consequential, or exemplary damages, including but not limited to damages for loss of profits, goodwill, use, data, or other intangible losses.</p>
                <p>Our total liability for all claims arising from or related to these Terms shall not exceed the amount you paid to us in the six months preceding the claim, or CAD $50 if you have not paid us anything.</p>

                <h2>7. Indemnification</h2>
                <p>You agree to defend, indemnify, and hold harmless <?=$webtitle?>, its affiliates, and their respective officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses arising from your use of the Services or violation of these Terms.</p>

                <h2>8. Governing Law and Jurisdiction</h2>
                <p>These Terms shall be governed by and construed in accordance with the laws of the Province of Ontario and the federal laws of Canada applicable therein, without regard to its conflict of law principles. Any legal action or proceeding arising under these Terms shall be brought exclusively in the courts located in Toronto, Ontario.</p>

                <h2>9. Dispute Resolution</h2>
                <p>In accordance with Canadian legal practices, the parties agree to attempt to resolve any dispute informally for at least 30 days before initiating any legal proceedings. If informal resolution is not possible, the dispute shall be resolved through the courts of Ontario as specified in Section 8.</p>

                <h2>10. Termination</h2>
                <p>We may terminate or suspend your account immediately, without prior notice, for any reason, including if you breach these Terms. Upon termination, your right to use the Services will immediately cease. Provisions regarding intellectual property, warranty disclaimers, and limitations of liability shall survive termination.</p>

                <h2>11. Changes to Terms</h2>
                <p>We may modify these Terms at any time. We will provide notice of material changes by posting the updated Terms on our website. Continued use of our Services after such changes constitutes acceptance of the revised Terms.</p>
<!--
                <h2>12. Contact Information</h2>
                <p>For questions about these Terms, please contact:</p>
                <p><?=$webtitle?> Legal Department<br>
                123 Digital Security Avenue<br>
                Toronto, ON M5G 1Z8<br>
                Canada<br>
                Email: legal@securearea.ca<br>
                Phone: +1 (416) 555-0100</p>-->
            </div>
            <div class="modal-footer">
                <button class="modal-accept" data-close="terms">I Understand</button>
            </div>
        </div>
    </div>
    <script type="text/javascript" src="script.js"></script>
</body>
</html>
