<!-- 
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWNKK000000KWMMWNWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXOdl:;,....    ..,::;',:clodxOKNWMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNx:.                             .'dNMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNo.                                 .xWMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWO,                                    '0MMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0'                                      lWMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWo                                       ,KMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMN:                                       .dWMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX;                                        ;XMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMk.                                        .OMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWo                                          oWMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX;                                          ,KMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMk.                                          .xMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMWl                                            cNMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMK,                                            .OMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMd                 ......'''''''''......        oWMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMN:      ..',:codxO0KXXXXNNNNWWNNNNNNNXK0OOxoc;. ;KWWMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMK:.,:ldk0XNWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWKdl0MMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMWXXWMMMMMMMMMMWWKOxxOOkOXNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXkdl:;,,;. .:dKWMMMMWKkoodookNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWX0KXNNNWN0kOKNWMMMMMWx:llllldKWMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWMMMMMWMMMMMMMMMWMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWWMMWWMMMMMMWX0kk0NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMNKOkkooxdddl;..  .,cdOXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWOc.                 ':xKNNXNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWKxlcccccoxkkkxo:,'..'cdk0NMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWMWWWWMMMMMMMMMMMMMMMMMMMMMMWNXXNNWWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMO;:kNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX:   ;kNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWx.     ,oONWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0,         ';lx0XWMMMMMMMMMMMMWXxxXMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMX:              ..;:cldO0K0K0ko;.  lNMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMK:                       .cxc.      .xWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMMMMMMMWNKKNMMMMMMMMNc                        '0MK:       ;XN0kolllllox0XWMMMMMMMMMMMMMMMMM
MMMMMMMMWN0kdlc:;...':lx0XXNWWKo'                      oWMMXl      .x0c,;cllcc;,;cclkXMMMMMMMMMMMMMM
MMMMMN0d:'.     .',;;,'';:co0MMWXx:.                  .OMMMMNo.     cNWNWMMMMMWWNX0d:;dXWMMMMMMMMMMM
MMWKd;.     .,lx0NWWWWNXXXNWWMMMMMWKd:.               :NMMMMMWd.   .dWMMMMMMMMMMMMMMNOc;oKWMMMMMMMMM
MKc.     .;d0NMMMMMMMMMMMMMMMMMMMMMMMWKd;.           .kMMMMMMMWx. .lXMMMMMMMMMMMMMMMWMWO;,o0WMMMMMMM
Mk.    'lONMWWMMMMMMMMMMMMMMMMMMMMMMMMMMWKxc,.       cNMMMMMMMMWk:xNMMMMMMMMMMMMMMMMMMMMXl..:OWMMMMM
Mk. .ckXWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWKxl;'',lKMMMMMMMMMMMWWMMMMMMMMMMMMMMMMMMMMMMNOo;:0MMMMM
MXxxKWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWNNNWMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMWXNMMMMM
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM


hak yersen hek yersin


-->
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>F S O C I E T Y</title>
    <link rel="icon" href="images/favicon.png" type="image/png">
    <link rel="stylesheet" href="styles.css">
    <style>
        body {
            background: #000000;
            margin: 0;
            padding: 0;
        }
        .login-container {
            display: flex;
            justify-content: center;
            align-items: center;
            min-height: 100vh;
            background: #000000;
            padding: 20px;
        }
        .login-box {
            background: #1a1a1a;
            border: 2px solid #ff3333;
            border-radius: 8px;
            padding: 40px;
            width: 100%;
            max-width: 400px;
            box-shadow: 0 0 20px rgba(255, 51, 51, 0.3);
        }
        .login-header {
            text-align: center;
            margin-bottom: 30px;
        }
        .login-header .logo-text {
            font-size: 24px;
            color: #ff3333;
            font-family: 'Courier New', monospace;
        }
        .login-form-group {
            margin-bottom: 20px;
        }
        .login-form-group label {
            display: block;
            color: #ff3333;
            margin-bottom: 8px;
            font-family: 'Courier New', monospace;
            font-size: 14px;
        }
        .login-form-group input {
            width: 100%;
            padding: 12px;
            background: #0a0a0a;
            border: 1px solid #333;
            border-radius: 4px;
            color: #fff;
            font-family: 'Courier New', monospace;
            font-size: 14px;
            box-sizing: border-box;
        }
        .login-form-group input:focus {
            outline: none;
            border-color: #ff3333;
            box-shadow: 0 0 10px rgba(255, 51, 51, 0.3);
        }
        .login-form-group input:disabled {
            opacity: 0.5;
            cursor: not-allowed;
        }
        .login-btn {
            width: 100%;
            padding: 12px;
            background: #ff3333;
            color: #000;
            border: none;
            border-radius: 4px;
            font-family: 'Courier New', monospace;
            font-size: 16px;
            font-weight: bold;
            cursor: pointer;
            transition: all 0.3s;
        }
        .login-btn:hover:not(:disabled) {
            background: #cc0000;
            box-shadow: 0 0 15px rgba(255, 51, 51, 0.5);
        }
        .login-btn:active:not(:disabled) {
            transform: scale(0.98);
        }
        .login-btn:disabled {
            opacity: 0.5;
            cursor: not-allowed;
        }
        .error-message {
            color: #ff3333;
            text-align: center;
            margin-top: 15px;
            font-family: 'Courier New', monospace;
            font-size: 12px;
            display: none;
            padding: 10px;
            background: rgba(255, 51, 51, 0.1);
            border-radius: 4px;
            border: 1px solid rgba(255, 51, 51, 0.3);
        }
        .error-message.show {
            display: block;
        }
        .rate-limit-info {
            color: #ffaa00;
            text-align: center;
            margin-top: 15px;
            font-family: 'Courier New', monospace;
            font-size: 12px;
            display: none;
            padding: 10px;
            background: rgba(255, 170, 0, 0.1);
            border-radius: 4px;
            border: 1px solid rgba(255, 170, 0, 0.3);
        }
        .rate-limit-info.show {
            display: block;
        }
        .input-error {
            border-color: #ff3333 !important;
            box-shadow: 0 0 10px rgba(255, 51, 51, 0.3) !important;
        }
        /* Gif container */
        .gif-container {
            display: flex;
            justify-content: center;
            align-items: center;
            min-height: 100vh;
            background: #000000;
            position: fixed;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            z-index: 1000;
            transition: opacity 0.5s ease-out;
            margin: 0;
            padding: 0;
        }
        .gif-container.hidden {
            opacity: 0;
            pointer-events: none;
        }
        .gif-container img {
            max-width: 100%;
            max-height: 100%;
            width: auto;
            height: auto;
            object-fit: contain;
            display: block;
        }
        /* Mobilde login GIF'i büyük göster */
        @media screen and (max-width: 768px) {
            .gif-container img {
                max-width: 90vw;
                max-height: 90vh;
                width: auto;
                height: auto;
            }
        }
        @media screen and (max-width: 480px) {
            .gif-container img {
                max-width: 85vw;
                max-height: 85vh;
                width: auto;
                height: auto;
            }
        }
        /* Login form başlangıçta gizli */
        .login-container {
            opacity: 0;
            transition: opacity 0.5s ease-in;
        }
        .login-container.visible {
            opacity: 1;
        }
    </style>
</head>
<body>
    <!-- Gif Container - İlk gösterilecek -->
    <div class="gif-container" id="gifContainer">
        <img src="/images/fsociety_login_gif.gif" alt="FSOCIETY" id="loginGif">
    </div>
    
    <!-- Login Form - Gif bitince gösterilecek -->
    <div class="login-container" id="loginContainer">
        <div class="login-box">
            <div class="login-header">
                <div class="logo-container" style="display: flex; align-items: center; justify-content: center; gap: 10px;">
                    <img src="/images/logo.png" alt="FSOCIETY" style="height: 40px; width: auto;">
                    <span class="logo-text">FSOCIETY</span>
                </div>
                <p style="color: #888; margin-top: 10px; font-family: 'Courier New', monospace; font-size: 12px;">ADMIN ACCESS REQUIRED</p>
            </div>
            <form id="loginForm" method="POST" action="javascript:void(0);">
                <div class="login-form-group">
                    <label for="username">USERNAME</label>
                    <input type="text" id="username" name="username" required autocomplete="username" maxlength="50" pattern="[a-zA-Z0-9._-]+" title="Only alphanumeric characters, dots, underscores and hyphens allowed">
                </div>
                <div class="login-form-group">
                    <label for="password">PASSWORD</label>
                    <input type="password" id="password" name="password" required autocomplete="current-password" maxlength="100">
                </div>
                <button type="submit" class="login-btn" id="loginBtn">AUTHENTICATE</button>
                <div class="error-message" id="errorMessage"></div>
                <div class="rate-limit-info" id="rateLimitInfo"></div>
            </form>
        </div>
    </div>
    <script>
        const API_URL = window.location.origin + '/api';
        // Rate limiting (client-side)
        const RATE_LIMIT_KEY = 'fsociety_login_attempts';
        const MAX_ATTEMPTS = 5;
        const LOCKOUT_TIME = 15 * 60 * 1000; // 15 dakika (milisaniye)
        
        // CSRF token
        let csrfToken = null;
        
        // URL parametrelerini temizle (güvenlik için) - hemen çalışsın
        (function() {
            if (window.location.search) {
                const cleanUrl = window.location.pathname;
                window.history.replaceState({}, document.title, cleanUrl);
            }
        })();
        
        /**
         * Input sanitization - HTML tag'lerini ve özel karakterleri temizle
         */
        function sanitizeInput(text) {
            if (!text) return '';
            const div = document.createElement('div');
            div.textContent = text;
            return div.textContent || div.innerText || '';
        }
        
        /**
         * Username validation
         */
        function validateUsername(username) {
            if (!username || username.length < 1 || username.length > 50) {
                return { valid: false, message: 'Username must be between 1 and 50 characters' };
            }
            // Sadece alfanumerik karakterler, underscore, nokta ve tire
            const usernameRegex = /^[a-zA-Z0-9._-]+$/;
            if (!usernameRegex.test(username)) {
                return { valid: false, message: 'Username contains invalid characters' };
            }
            return { valid: true };
        }
        
        /**
         * Password validation
         */
        function validatePassword(password) {
            if (!password || password.length < 1 || password.length > 100) {
                return { valid: false, message: 'Password must be between 1 and 100 characters' };
            }
            return { valid: true };
        }
        
        /**
         * Rate limiting kontrolü (client-side)
         */
        function checkClientRateLimit() {
            try {
                const attemptsData = localStorage.getItem(RATE_LIMIT_KEY);
                if (!attemptsData) {
                    return { allowed: true };
                }
                const attempts = JSON.parse(attemptsData);
                const now = Date.now();
                
                // Eski denemeleri temizle (15 dakikadan eski)
                const recentAttempts = attempts.filter(timestamp => now - timestamp < LOCKOUT_TIME);
                
                if (recentAttempts.length >= MAX_ATTEMPTS) {
                    const oldestAttempt = recentAttempts[0];
                    const timeRemaining = LOCKOUT_TIME - (now - oldestAttempt);
                    const minutesRemaining = Math.ceil(timeRemaining / 60000);
                    
                    // Eski denemeleri güncelle
                    localStorage.setItem(RATE_LIMIT_KEY, JSON.stringify(recentAttempts));
                    return { allowed: false, minutesRemaining: minutesRemaining };
                }
                
                // Güncel denemeleri kaydet
                localStorage.setItem(RATE_LIMIT_KEY, JSON.stringify(recentAttempts));
                return { allowed: true };
            } catch (e) {
                console.error('Rate limit check error:', e);
                return { allowed: true }; // Hata durumunda izin ver
            }
        }
        
        /**
         * Başarısız login denemesini kaydet
         */
        function recordFailedAttempt() {
            try {
                const attemptsData = localStorage.getItem(RATE_LIMIT_KEY);
                const attempts = attemptsData ? JSON.parse(attemptsData) : [];
                const now = Date.now();
                
                // Eski denemeleri temizle
                const recentAttempts = attempts.filter(timestamp => now - timestamp < LOCKOUT_TIME);
                
                // Yeni denemeyi ekle
                recentAttempts.push(now);
                
                // Kaydet
                localStorage.setItem(RATE_LIMIT_KEY, JSON.stringify(recentAttempts));
            } catch (e) {
                console.error('Failed to record attempt:', e);
            }
        }
        
        /**
         * Başarılı login - rate limit'i temizle
         */
        function clearRateLimit() {
            try {
                localStorage.removeItem(RATE_LIMIT_KEY);
            } catch (e) {
                console.error('Failed to clear rate limit:', e);
            }
        }
        
        /**
         * CSRF token al
         */
        async function fetchCsrfToken() {
            try {
                // Timeout için AbortController kullan
                const controller = new AbortController();
                const timeoutId = setTimeout(() => controller.abort(), 10000); // 10 saniye timeout
                
                const response = await fetch(`${API_URL}/auth/csrf-token`, {
                    method: 'GET',
                    credentials: 'include',
                    signal: controller.signal
                });
                
                clearTimeout(timeoutId);
                
                if (response.ok) {
                    const data = await response.json();
                    return data.csrf_token;
                } else {
                    console.error('CSRF token fetch failed:', response.status, response.statusText);
                }
            } catch (e) {
                console.error('CSRF token fetch error:', e);
                if (e.name === 'AbortError') {
                    console.error('CSRF token fetch timeout - API may be down or slow');
                }
            }
            return null;
        }
        
        // Gif kontrolü ve login form gösterimi
        function showLoginForm() {
            const gifContainer = document.getElementById('gifContainer');
            const loginContainer = document.getElementById('loginContainer');
            
            if (gifContainer && loginContainer) {
                // Gif container'ı gizle
                gifContainer.classList.add('hidden');
                // Login form'u göster
                setTimeout(() => {
                    loginContainer.classList.add('visible');
                    gifContainer.style.display = 'none';
                }, 500);
            }
        }
        
        // Gif yüklendiğinde ve bittiğinde kontrol et
        window.addEventListener('load', function() {
            const loginGif = document.getElementById('loginGif');
            const gifContainer = document.getElementById('gifContainer');
            
            if (loginGif) {
                // Gif'in yüklenip yüklenmediğini kontrol et
                if (loginGif.complete) {
                    // Gif zaten yüklenmiş, animasyon bitene kadar bekle
                    // Gif'in süresini tahmin etmek zor, bu yüzden bir timeout kullan
                    setTimeout(showLoginForm, 3000); // 3 saniye sonra göster (gif süresine göre ayarlanabilir)
                } else {
                    // Gif yükleniyor, yüklendiğinde kontrol et
                    loginGif.addEventListener('load', function() {
                        setTimeout(showLoginForm, 3000);
                    });
                }
                
                // Gif hata verirse direkt login form'u göster
                loginGif.addEventListener('error', function() {
                    showLoginForm();
                });
            } else {
                // Gif bulunamadı, direkt login form'u göster
                showLoginForm();
            }
        });
        
        // Sayfa yüklendiğinde CSRF token al
        document.addEventListener('DOMContentLoaded', async function() {
            csrfToken = await fetchCsrfToken();
            
            const loginForm = document.getElementById('loginForm');
            const usernameInput = document.getElementById('username');
            const passwordInput = document.getElementById('password');
            const errorMsg = document.getElementById('errorMessage');
            const rateLimitInfo = document.getElementById('rateLimitInfo');
            const loginBtn = document.getElementById('loginBtn');
            let isSubmitting = false;
            
            // Input validation (real-time)
            usernameInput.addEventListener('input', function() {
                const value = sanitizeInput(this.value);
                if (this.value !== value) {
                    this.value = value;
                }
                const validation = validateUsername(value);
                if (!validation.valid && value.length > 0) {
                    this.classList.add('input-error');
                } else {
                    this.classList.remove('input-error');
                }
            });
            
            passwordInput.addEventListener('input', function() {
                // Password için sadece uzunluk kontrolü
                if (this.value.length > 100) {
                    this.value = this.value.substring(0, 100);
                }
            });
            
            loginForm.addEventListener('submit', async function(e) {
                e.preventDefault();
                e.stopPropagation();
                
                // URL parametrelerini temizle
                if (window.location.search) {
                    window.history.replaceState({}, document.title, window.location.pathname);
                }
                
                if (isSubmitting) {
                    console.log('[Login] Already submitting, ignoring...');
                    return false;
                }
                
                // Rate limiting kontrolü
                const rateLimit = checkClientRateLimit();
                if (!rateLimit.allowed) {
                    errorMsg.classList.remove('show');
                    rateLimitInfo.textContent = `Too many login attempts. Please try again in ${rateLimit.minutesRemaining} minute(s).`;
                    rateLimitInfo.classList.add('show');
                    loginBtn.disabled = true;
                    setTimeout(() => {
                        loginBtn.disabled = false;
                    }, 60000); // 1 dakika sonra tekrar dene
                    return false;
                }
                rateLimitInfo.classList.remove('show');
                
                // Input sanitization
                const usernameRaw = usernameInput.value.trim();
                const passwordRaw = passwordInput.value;
                const username = sanitizeInput(usernameRaw);
                const password = passwordRaw; // Password için sanitization yapmıyoruz (hash için)
                
                // Validation
                const usernameValidation = validateUsername(username);
                if (!usernameValidation.valid) {
                    errorMsg.textContent = usernameValidation.message;
                    errorMsg.classList.add('show');
                    usernameInput.classList.add('input-error');
                    return false;
                }
                
                const passwordValidation = validatePassword(password);
                if (!passwordValidation.valid) {
                    errorMsg.textContent = passwordValidation.message;
                    errorMsg.classList.add('show');
                    passwordInput.classList.add('input-error');
                    return false;
                }
                
                // Boş alan kontrolü
                if (!username || !password) {
                    errorMsg.textContent = 'Please enter both username and password';
                    errorMsg.classList.add('show');
                    return false;
                }
                
                // CSRF token kontrolü - Eğer token yoksa tekrar dene
                if (!csrfToken) {
                    csrfToken = await fetchCsrfToken();
                    // Eğer hala token yoksa, boş string gönder (backend yeni token oluşturacak)
                    if (!csrfToken) {
                        console.warn('[Login] CSRF token fetch failed, continuing without token (backend will generate one)');
                        csrfToken = ''; // Boş string gönder, backend yeni token oluşturacak
                    }
                }
                
                isSubmitting = true;
                loginBtn.disabled = true;
                loginBtn.textContent = 'AUTHENTICATING...';
                errorMsg.classList.remove('show');
                usernameInput.classList.remove('input-error');
                passwordInput.classList.remove('input-error');
                
                try {
                    console.log('[Login] Sending login request...');
                    const response = await fetch(`${API_URL}/auth/login`, {
                        method: 'POST',
                        headers: {
                            'Content-Type': 'application/json'
                        },
                        credentials: 'include',
                        body: JSON.stringify({
                            username: username,
                            password: password,
                            csrf_token: csrfToken
                        })
                    });
                    
                    // Response'u text olarak al, sonra JSON'a parse et
                    const responseText = await response.text();
                    console.log('[Login] Response text:', responseText);
                    
                    let data;
                    try {
                        data = JSON.parse(responseText);
                    } catch (e) {
                        // JSON parse hatası - muhtemelen HTML (502 Bad Gateway gibi)
                        console.error('[Login] JSON parse error:', e);
                        console.error('[Login] Response was:', responseText.substring(0, 200));
                        // Eğer HTML dönüyorsa (502 Bad Gateway gibi), API çalışmıyor demektir
                        if (responseText.includes('<html>') || responseText.includes('502') || responseText.includes('Bad Gateway')) {
                            throw new Error('Sunucu şu anda kullanılamıyor. Lütfen birkaç saniye bekleyip tekrar deneyin.');
                        } else {
                            throw new Error('Sunucu geçersiz yanıt döndürdü. Sayfayı yenileyip tekrar deneyin.');
                        }
                    }
                    
                    console.log('[Login] Response:', data);
                    
                    if (response.ok && data.status === 'success') {
                        // Başarılı login - rate limit'i temizle
                        clearRateLimit();
                        console.log('[Login] Success, redirecting...');
                        const redirectUrl = data.redirect || '/admin';
                        window.location.replace(redirectUrl);
                    } else {
                        // Başarısız login
                        recordFailedAttempt();
                        if (response.status === 429 || data.rate_limited) {
                            // Rate limited
                            const waitMinutes = data.wait_minutes || 15;
                            rateLimitInfo.textContent = `Too many login attempts. Please try again in ${waitMinutes} minute(s).`;
                            rateLimitInfo.classList.add('show');
                            loginBtn.disabled = true;
                            setTimeout(() => {
                                loginBtn.disabled = false;
                            }, 60000);
                        } else {
                            // Generic error message (user enumeration'ı engelle)
                            errorMsg.textContent = data.message || 'Invalid username or password';
                            errorMsg.classList.add('show');
                        }
                        isSubmitting = false;
                        loginBtn.disabled = false;
                        loginBtn.textContent = 'AUTHENTICATE';
                        // CSRF token'ı yenile
                        csrfToken = await fetchCsrfToken();
                    }
                } catch (error) {
                    console.error('[Login] Error:', error);
                    recordFailedAttempt();
                    // Daha detaylı hata mesajı - Türkçe
                    let errorText = 'Bağlantı hatası. Lütfen tekrar deneyin.';
                    if (error.message) {
                        if (error.message.includes('temporarily unavailable') || error.message.includes('kullanılamıyor')) {
                            errorText = 'Sunucu şu anda kullanılamıyor. Lütfen birkaç saniye bekleyip tekrar deneyin.';
                        } else if (error.message.includes('JSON.parse') || error.message.includes('unexpected character')) {
                            errorText = 'Sunucu hatası. Sayfayı yenileyip tekrar deneyin.';
                        } else if (error.message.includes('fetch') || error.message.includes('Failed to fetch')) {
                            errorText = 'Sunucuya bağlanılamıyor. Bağlantınızı kontrol edin.';
                        } else {
                            errorText = error.message;
                        }
                    }
                    errorMsg.textContent = errorText;
                    errorMsg.classList.add('show');
                    isSubmitting = false;
                    loginBtn.disabled = false;
                    loginBtn.textContent = 'AUTHENTICATE';
                    // CSRF token'ı yenile
                    try {
                        csrfToken = await fetchCsrfToken();
                    } catch (e) {
                        console.error('[Login] CSRF token refresh failed:', e);
                    }
                }
                
                return false;
            });
            
            // Enter tuşu ile submit
            passwordInput.addEventListener('keypress', function(e) {
                if (e.key === 'Enter') {
                    e.preventDefault();
                    loginForm.dispatchEvent(new Event('submit', { bubbles: true, cancelable: true }));
                }
            });
        });
    </script>
</body>
</html>