<?php
/**
 * Reset Password - Set new password with token
 * PHP User Registration - https://rskworld.in
 * Developer: Molla Samser | RSK World
 * Contact: help@rskworld.in | +91 93305 39277
 * Year: 2026
 */

require_once __DIR__ . '/includes/init.php';
require_once __DIR__ . '/includes/functions.php';

if (isLoggedIn()) {
    header('Location: dashboard.php');
    exit;
}

$token = trim($_GET['token'] ?? '');
$errors = [];
$invalidToken = false;

if ($token === '') {
    $invalidToken = true;
} else {
    $pdo = getDbConnection();
    $stmt = $pdo->prepare('SELECT id FROM users WHERE password_reset_token = ? AND password_reset_expires_at > NOW()');
    $stmt->execute([$token]);
    $user = $stmt->fetch();
    if (!$user) {
        $invalidToken = true;
    }
}

if (!$invalidToken && $_SERVER['REQUEST_METHOD'] === 'POST') {
    $password = $_POST['password'] ?? '';
    $password_confirm = $_POST['password_confirm'] ?? '';
    if (strlen($password) < 8) {
        $errors[] = 'Password must be at least 8 characters.';
    }
    if ($password !== $password_confirm) {
        $errors[] = 'Passwords do not match.';
    }
    if (empty($errors)) {
        $stmt = $pdo->prepare('UPDATE users SET password = ?, password_reset_token = NULL, password_reset_expires_at = NULL WHERE id = ?');
        $stmt->execute([password_hash($password, PASSWORD_DEFAULT), $user['id']]);
        setFlash('success', 'Password updated. You can now log in.');
        header('Location: login.php');
        exit;
    }
}

$pageTitle = 'Reset Password';
require_once __DIR__ . '/includes/header.php';
?>

<div class="auth-card">
    <h1><i class="fas fa-lock"></i> Reset Password</h1>
    <p class="subtitle">PHP User Registration — <a href="https://rskworld.in" target="_blank">rskworld.in</a></p>

    <?php if ($invalidToken): ?>
        <div class="alert alert-error">Invalid or expired reset link. Please <a href="forgot-password.php">request a new one</a>.</div>
    <?php else: ?>
        <?php if (!empty($errors)): ?>
            <div class="alert alert-error">
                <?php foreach ($errors as $e): ?>
                    <div><?= htmlspecialchars($e) ?></div>
                <?php endforeach; ?>
            </div>
        <?php endif; ?>
        <form method="post" action="" class="auth-form">
            <div class="form-group">
                <label for="password">New Password</label>
                <input type="password" id="password" name="password" required minlength="8" placeholder="Min 8 characters">
            </div>
            <div class="form-group">
                <label for="password_confirm">Confirm Password</label>
                <input type="password" id="password_confirm" name="password_confirm" required minlength="8" placeholder="Repeat password">
            </div>
            <button type="submit" class="btn btn-primary">Update Password</button>
        </form>
    <?php endif; ?>
    <p class="auth-footer"><a href="login.php">Back to Log In</a></p>
</div>

<?php require_once __DIR__ . '/includes/footer.php'; ?>
