我的登录codeigniter我做错了什么？

Question

I want to do a secure login, but first I need my login to work at all. When I try to log in to my system, it returns 0, meaning that an error occurred. I'm a new user, and I do not know how to set up my login properly.

Controller

    <?php
defined('BASEPATH') OR exit('No direct script access allowed');

class Login extends CI_Controller {
    public function __construct(){
        parent::__construct();
        $this->load->model('User_model');
    }

    public function index(){
        $data['module'] = "Login";
        $this->load->view('login',$data);
    }

    public function getAccess(){
        $username = $this->security->xss_clean($this->input->post('username'));
        $password = $this->input->post('password');
        $array = $this->User_model->login('admin','admin');
        if($array[0] == 0){
            echo 0;
        }else{
            $data_session = array(
                'id' => $array[0]['iduser'],
                'username' => $array[0]['username'],
                'password' => $array[0]['password'],
                'name' => $array[0]['name'],
                'type' => $array[0]['idType'],
                'logged_in' => TRUE
            );
            $this->session->set_userdata('logged_in',$data_session);
        }
    } 

    public function logout(){
        $this->session->sess_destroy();
        redirect('login');
    }
}

Model

<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');

class User_model extends CI_Model {

    public function __construct(){
        parent::__construct();

    }

    public function login($username,$password){
        $this->db->select('iduser, name, last_name, username, password, idType');
        $this->db->from('user');
        $this->db->join('typeuser', 'typeuser.idtypeuser = user.idType','inner');
        $this->db->where('username',$username);
        $this->db->where('password',hash('sha256', $password));
        $result = $this->db->get();
        if($result->num_rows() > 0){
            return $result->result_array();
        }else{
           return FALSE;
        }
    }

}

Ajax

 BASE_URL =  "<?= base_url() ?>";
        $("#login-form").submit(function(){
            var username = $('#username').val();
            var password = $('#password').val();
            URL_GET_ACCESS = BASE_URL+"login/getAccess";
            $.ajax({
                url: URL_GET_ACCESS,
                type: 'POST',
                data: 'username='+username+'&password='+password
            }).done(function(resp){
                console.log(resp);
                if(resp === '0'){
                    $('#error').show().delay(2000).fadeOut();
                }else if(resp === '1'){
                    window.location.href=BASE_URL+'welcome/home';
                }else{
                    window.location.href=BASE_URL+'welcome/home';
                }
            });
            return false;
        });