Upload 5 files

server.py

@@ -30,8 +30,14 @@ def init_db():
     c.execute('''CREATE TABLE IF NOT EXISTS users (
         id text PRIMARY KEY, email text, name text, role text, 
         roll_number text, department text, institution text, 
-        is_active boolean, face_data text, last_login datetime
+        is_active boolean, face_data text, last_login datetime,
+        password text
     )''')
+    # Use try-except to add password column if it doesn't exist (for existing databases)
+    try:
+        c.execute("ALTER TABLE users ADD COLUMN password text")
+    except:
+        pass
     c.execute('''CREATE TABLE IF NOT EXISTS sessions (
         id text PRIMARY KEY, teacher_id text, subject text, 
         qr_code text, qr_expires_at datetime, geofence_lat real, 
@@ -206,6 +212,34 @@ async def handle_item(table_name: str, item_id: str, request: Request):
             raise HTTPException(status_code=404, detail="Item not found")
         return {"success": True}
 
+@app.post("/login")
+async def login(request: Request):
+    data = await request.json()
+    email = data.get("email", "").lower()
+    password = data.get("password", "")
+    
+    conn = get_db()
+    conn.row_factory = dict_factory
+    c = conn.cursor()
+    
+    # Query user by email
+    c.execute("SELECT * FROM users WHERE LOWER(email) = ?", (email,))
+    user = c.fetchone()
+    
+    if not user:
+        raise HTTPException(status_code=404, detail="User not found")
+        
+    if user.get("password") != password:
+        raise HTTPException(status_code=401, detail="Invalid password")
+        
+    if not user.get("is_active"):
+        raise HTTPException(status_code=403, detail="Account deactivated")
+        
+    # Exclude password from response
+    user_data = dict(user)
+    user_data.pop("password", None)
+    return user_data
+
 # Mount static files correctly
 # This should happen LAST so API routes take precedence
 app.mount("/", StaticFiles(directory=".", html=True), name="static")

student-login.html

@@ -77,6 +77,25 @@
           <div id="googleBtnContainer"></div>
         </div>
 
+        <div class="auth-divider">
+          <span>OR</span>
+        </div>
+
+        <!-- Direct Email/Password Login -->
+        <div id="emailLoginForm">
+          <div class="form-group">
+            <label class="form-label">Institution Email</label>
+            <input type="email" id="emailInput" class="form-control" placeholder="your@cbit.org.in">
+          </div>
+          <div class="form-group">
+            <label class="form-label">Password</label>
+            <input type="password" id="passwordInput" class="form-control" placeholder="••••••••">
+          </div>
+          <button class="btn btn-primary btn-full" onclick="loginWithEmail()">
+            Login with Email
+          </button>
+        </div>
+
         <!-- Loading State -->
         <div id="loadingState" class="auth-loading hidden">
           <div class="spinner spinner-dark"></div>
@@ -262,6 +281,56 @@
     }
   }
 
+  async function loginWithEmail() {
+    const email = document.getElementById('emailInput').value.trim();
+    const password = document.getElementById('passwordInput').value;
+
+    if (!email || !password) {
+      showAlert('Please enter both email and password.');
+      return;
+    }
+
+    try {
+      showLoading('Verifying credentials...');
+      
+      const response = await fetch('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, password })
+      });
+
+      if (!response.ok) {
+        const err = await response.json();
+        throw new Error(err.detail || 'Login failed');
+      }
+
+      const user = await response.json();
+      
+      // Ensure it's a student
+      if (user.role !== 'student') {
+        showAlert(`Unauthorized: Registered as "${user.role}"`);
+        hideLoading();
+        return;
+      }
+
+      const sessionUser = {
+        ...user,
+        picture: user.picture || `https://ui-avatars.com/api/?name=${encodeURIComponent(user.name)}&background=4F46E5&color=fff`
+      };
+
+      AuthState.save(sessionUser);
+      await Logger.log('LOGIN_SUCCESS_EMAIL', 'auth', { email, role: 'student' }, 'success');
+
+      showWelcome(sessionUser);
+      setTimeout(() => { window.location.href = 'student-dashboard.html'; }, 1800);
+
+    } catch (err) {
+      console.error('Login error:', err);
+      hideLoading();
+      showAlert(err.message === 'User not found' ? 'Email not registered.' : 'Invalid password or account error.');
+    }
+  }
+
   // Google OAuth callback
   function handleGoogleCredential(response) {
     try {

teacher-login.html

@@ -69,6 +69,25 @@
           <div id="googleBtnContainer"></div>
         </div>
 
+        <div class="auth-divider">
+          <span>OR</span>
+        </div>
+
+        <!-- Direct Email/Password Login -->
+        <div id="emailLoginForm">
+          <div class="form-group">
+            <label class="form-label">Institution Email</label>
+            <input type="email" id="emailInput" class="form-control" placeholder="teacher@cbit.org.in">
+          </div>
+          <div class="form-group">
+            <label class="form-label">Password</label>
+            <input type="password" id="passwordInput" class="form-control" placeholder="••••••••">
+          </div>
+          <button class="btn btn-primary btn-full" onclick="loginWithEmail()">
+            Login with Email
+          </button>
+        </div>
+
         <div id="loadingState" class="auth-loading hidden">
           <div class="spinner spinner-dark"></div>
           <span id="loadingText">Verifying faculty credentials...</span>
@@ -214,6 +233,62 @@
     }
   }
 
+  async function loginWithEmail() {
+    const email = document.getElementById('emailInput').value.trim();
+    const password = document.getElementById('passwordInput').value;
+
+    if (!email || !password) {
+      showAlert('Please enter both email and password.');
+      return;
+    }
+
+    try {
+      showLoading('Verifying credentials...');
+      
+      const response = await fetch('/login', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ email, password })
+      });
+
+      if (!response.ok) {
+        const err = await response.json();
+        throw new Error(err.detail || 'Login failed');
+      }
+
+      const user = await response.json();
+      
+      // Ensure it's faculty/admin
+      if (user.role !== 'teacher' && user.role !== 'admin') {
+        showAlert(`Unauthorized: Registered as "${user.role}"`);
+        hideLoading();
+        return;
+      }
+
+      const sessionUser = {
+        ...user,
+        picture: user.picture || `https://ui-avatars.com/api/?name=${encodeURIComponent(user.name)}&background=10B981&color=fff`
+      };
+
+      AuthState.save(sessionUser);
+      await Logger.log('LOGIN_SUCCESS_EMAIL', 'auth', { email, role: user.role }, 'success');
+
+      document.getElementById('loginCard').classList.add('hidden');
+      document.getElementById('welcomeCard').classList.remove('hidden');
+      document.getElementById('welcomeAvatar').src = sessionUser.picture;
+      document.getElementById('welcomeName').textContent = sessionUser.email;
+
+      setTimeout(() => {
+        window.location.href = user.role === 'admin' ? 'admin-panel.html' : 'teacher-dashboard.html';
+      }, 1800);
+
+    } catch (err) {
+      console.error('Login error:', err);
+      hideLoading();
+      showAlert(err.message === 'User not found' ? 'Email not registered.' : 'Invalid password or account error.');
+    }
+  }
+
   function handleGoogleCredential(response) {
     try {
       const parts = response.credential.split('.');