---

app.post('/login', async (req, res) => {
  try {
    const username = String(req.body.username || '').trim();
    const password = String(req.body.password || '');

    if (username !== process.env.APP_USERNAME) {
      return res.status(401).send('Неверный логин или пароль');
    }

    const passOk = await verifyPassword(password);

    if (!passOk) {
      return res.status(401).send('Неверный логин или пароль');
    }

    req.session.user = { username };
    return res.redirect('/');
  } catch (error) {
    return res.status(500).send(error.message);
  }
});