<?php
session_start();
header('Content-Type: application/json');

if (!isset($_SESSION["user_id"])) {
    echo json_encode(["success"=>false,"error"=>"Not logged in"]); exit;
}

require_once '../config/database.php';
$userId = (int)$_SESSION["user_id"];
$input  = json_decode(file_get_contents("php://input"), true);

$newPassword = trim($input["new_password"] ?? "");

if (strlen($newPassword) < 4) {
    echo json_encode(["success"=>false,"error"=>"Password must be at least 4 characters"]); exit;
}

/* Reset the logged-in user's own password (no current password required) */
$pdo->prepare("UPDATE users SET password=? WHERE id=?")
    ->execute([password_hash($newPassword, PASSWORD_DEFAULT), $userId]);

echo json_encode(["success"=>true]);