links to dashboard/api/oauth-start.php, present only when a
* provider is configured + enabled; nothing prints when none are.
*
* Design mirrors the rest of the marketing site:
* - Dark base (#07060B) with a soft purple aurora behind the card
* - Plattr wordmark + bell mark in the top-left corner
* - Centred glass card with the form
* - Apple-graphite / Google-white / Email-purple-gradient SSO row
* identical to the wizard's auth-providers grid (so the brand
* reads as one continuous system between signup and signin)
*
* Looks great at every viewport: card stretches edge-to-edge on
* narrow phones, caps at 460px on tablet+, and sits in a generous
* vertical centre on desktop.
*/
declare(strict_types=1);
$envPath = __DIR__ . '/../config.env.php';
if (!file_exists($envPath)) {
http_response_code(500);
die('Login portal: master config not available.');
}
require_once $envPath;
require_once __DIR__ . '/../config.php'; // defines getDB() — the DB-backed session store reads through it
require_once __DIR__ . '/../includes/plattr-session.php';
require_once __DIR__ . '/../includes/oauth-buttons.php'; // oalRenderButtons() — no-ops when no provider active
// If a real session is already open, jump straight to the dashboard
// rather than make the user re-type credentials.
plattrStartSession();
if (!empty($_SESSION['customer_user_id']) && !empty($_SESSION['login_at'])) {
header('Location: /dashboard');
exit;
}
$loggedOut = !empty($_GET['logged_out']);
$returnTo = '';
if (!empty($_GET['return']) && is_string($_GET['return']) && str_starts_with($_GET['return'], '/')) {
$returnTo = $_GET['return'];
}
// ?oauth=cancelled|error|new|ready|verify_sent — friendly, generic copy
// (never a provider error code). new/ready mostly land on /#start (see the
// OAuth engine's outcome matrix), but cancelled/error can bounce back here
// when the OAuth button's return target was this page. ('link_required'
// retired — see oauth-verify-spec.md: every email-match outcome is now
// either an auto-link or the claim path, neither of which rejects the
// login.)
$oauthNotice = '';
$oauthError = '';
switch ((string)($_GET['oauth'] ?? '')) {
case 'ready': $oauthNotice = "You're signed in — pick a plan to finish setting up your account."; break;
case 'new': $oauthNotice = "We couldn't find a Plattr account for that sign-in — get started below to create one."; break;
case 'cancelled': $oauthNotice = 'Sign-in was cancelled — try again, or use your email and password.'; break;
case 'error': $oauthError = "That sign-in didn't go through — try again, or use your email and password."; break;
case 'verify_sent': $oauthNotice = "We've sent a new verification link — check your inbox."; break;
}
// ?verified=1 / ?verify=invalid — result of clicking the emailed
// verification link (landing/api/verify-email.php). Kept separate from the
// oauth= switch above since it can also fire for a classic (non-OAuth)
// signup's best-effort verify email.
$verifyNotice = '';
$verifyError = '';
if (!empty($_GET['verified'])) {
$verifyNotice = 'Your email is verified — sign in to continue.';
} elseif ((string)($_GET['verify'] ?? '') === 'invalid') {
$verifyError = "That verification link has expired or was already used — sign in, then request a new one from your dashboard.";
}
// OAuth buttons render only for ACTIVE providers (oalRenderButtons no-ops
// otherwise) — buffer so the "or use your email" divider only prints when
// there's actually something above it to divide.
ob_start();
oalRenderButtons('login', $returnTo !== '' ? $returnTo : '/dashboard');
$__oauthButtonsHtml = ob_get_clean();
?>
Sign in · Plattr