<?php
class Auth {
    public static function login(PDO $pdo, string $email, string $password): bool {
        $stmt = $pdo->prepare('SELECT * FROM users WHERE email = ? AND status = "active"');
        $stmt->execute([$email]);
        $u = $stmt->fetch();
        if ($u && password_verify($password, $u['password_hash'])) {
            unset($u['password_hash']);
            $_SESSION['user'] = $u;
            return true;
        }
        return false;
    }

    public static function logout(): void { $_SESSION = []; session_destroy(); }
}