<?php
session_start();
header('Cache-Control: no-store');
require_once '../config/database.php';
require_once '../config/password_reset.php';

$error = "";
$done  = false;
$prefill = htmlspecialchars($_POST['identifier'] ?? ($_GET['u'] ?? ''));

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $identifier = trim($_POST['identifier'] ?? '');
    $code       = trim($_POST['code'] ?? '');
    $pw1        = $_POST['password'] ?? '';
    $pw2        = $_POST['password2'] ?? '';

    if ($identifier === '' || $code === '' || $pw1 === '' || $pw2 === '') {
        $error = "Please fill in every field.";
    } elseif (strlen($pw1) < 6) {
        $error = "New password must be at least 6 characters.";
    } elseif ($pw1 !== $pw2) {
        $error = "The two passwords do not match.";
    } else {
        $user = reset_find_user($pdo, $identifier);
        if (!$user) {
            $error = "No active account found with that information.";
        } elseif (!reset_verify_code($pdo, $user['user_id'], $code)) {
            $error = "That code is wrong or has expired. Request a new one.";
        } else {
            $hash = password_hash($pw1, PASSWORD_DEFAULT);
            $pdo->prepare("UPDATE users SET password = ? WHERE id = ?")->execute([$hash, $user['user_id']]);
            $done = true;
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Reset password — Seven Digital</title>
<link rel="manifest" href="/seven-credit-system/manifest.json">
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
<meta name="apple-mobile-web-app-capable" content="yes">
<meta name="apple-mobile-web-app-status-bar-style" content="default">
<style>
  *{box-sizing:border-box;margin:0;padding:0;font-family:"Noto Sans Lao",Arial,sans-serif}
  body{background:#b91c1c;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:18px}
  .card{background:#fff;width:100%;max-width:420px;border-radius:18px;padding:24px 22px;box-shadow:0 16px 40px rgba(0,0,0,.25)}
  h1{font-size:20px;color:#111827;margin-bottom:6px}
  p.sub{color:#6b7280;font-size:14px;margin-bottom:18px}
  label{display:block;font-size:12px;font-weight:700;color:#374151;text-transform:uppercase;letter-spacing:.4px;margin:14px 0 6px}
  input{width:100%;padding:13px 14px;border:1.5px solid #e5e7eb;border-radius:12px;font-size:15px;outline:none}
  input:focus{border-color:#b91c1c}
  .btn{width:100%;margin-top:18px;padding:14px;background:#b91c1c;color:#fff;border:none;border-radius:12px;font-size:16px;font-weight:800;cursor:pointer}
  .btn:active{opacity:.9}
  .msg{padding:12px 14px;border-radius:10px;font-size:14px;margin-bottom:14px}
  .err{background:#fef2f2;border:1px solid #fecaca;color:#991b1b}
  .ok{background:#ecfdf5;border:1px solid #a7f3d0;color:#065f46}
  a.link{display:block;text-align:center;margin-top:16px;color:#b91c1c;font-weight:700;text-decoration:none;font-size:14px}
</style>
</head>
<body>
<div class="card">
  <h1>Set a new password</h1>

  <?php if ($done): ?>
    <div class="msg ok">Your password has been changed. You can now log in with your new password.</div>
    <a class="btn" style="display:block;text-align:center;text-decoration:none;line-height:1.2" href="login.php">Go to login</a>
  <?php else: ?>
    <p class="sub">Enter the code we sent you and choose a new password.</p>
    <?php if ($error): ?><div class="msg err"><?= htmlspecialchars($error) ?></div><?php endif; ?>
    <form method="POST" autocomplete="off">
      <label>Username / Email / Phone / Pay ID</label>
      <input type="text" name="identifier" value="<?= $prefill ?>" placeholder="your account" required>

      <label>Reset code</label>
      <input type="text" name="code" inputmode="numeric" placeholder="6-digit code" required>

      <label>New password</label>
      <input type="password" name="password" placeholder="at least 6 characters" required>

      <label>Confirm new password</label>
      <input type="password" name="password2" placeholder="repeat new password" required>

      <button class="btn" type="submit">Change password</button>
    </form>
    <a class="link" href="forgot_password.php">Didn't get a code? Send again</a>
  <?php endif; ?>
</div>
</body>
</html>