<?php
// admin/reset_password.php — set a new password from an emailed reset token
require_once __DIR__ . '/../config.php';
startSecureSession();

$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
$msg = $error = '';
$admin = null;

if ($token) {
    $stmt = db()->prepare("SELECT id, name, email FROM admins
                           WHERE reset_token=? AND reset_expires IS NOT NULL AND reset_expires > NOW() LIMIT 1");
    $stmt->execute([$token]);
    $admin = $stmt->fetch();
}

if (!$token || !$admin) {
    $error = 'This reset link is invalid or has expired. Please request a new one.';
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $p1 = $_POST['password'] ?? '';
    $p2 = $_POST['password_confirm'] ?? '';
    if (!csrfValid()) {
        $error = 'Security token expired. Please try again.';
    } elseif (strlen($p1) < 8) {
        $error = 'Password must be at least 8 characters.';
    } elseif ($p1 !== $p2) {
        $error = 'Passwords do not match.';
    } else {
        $hash = password_hash($p1, PASSWORD_BCRYPT);
        db()->prepare('UPDATE admins SET password=?, reset_token=NULL, reset_expires=NULL WHERE id=?')
            ->execute([$hash, $admin['id']]);
        $msg = 'Your password has been reset. You can now sign in.';
        $admin = null; // consume token
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Reset Password — RSVP System</title>
<link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link rel="stylesheet" media="print" onload="this.media='all'" href="https://fonts.googleapis.com/css2?family=Syne:wght@400;600;700;800&family=DM+Sans:wght@300;400;500&display=swap">
<link rel="stylesheet" href="<?= BASE_URL ?>/assets/css/main.css">
</head>
<body>
<div class="login-wrap">
  <div class="login-card">
    <div class="login-logo">
      <div class="name">RSVP</div>
      <div class="sub">Reset Password</div>
    </div>

    <?php if ($msg): ?><div class="alert alert-success"><?= htmlspecialchars($msg) ?></div><?php endif; ?>
    <?php if ($error): ?><div class="alert alert-danger"><?= htmlspecialchars($error) ?></div><?php endif; ?>

    <?php if ($admin && !$msg): ?>
    <form method="POST">
      <?= csrfField() ?>
      <input type="hidden" name="token" value="<?= htmlspecialchars($token) ?>">
      <div class="form-group">
        <label class="form-label">New Password</label>
        <input class="form-control" type="password" name="password"
               autocomplete="new-password" placeholder="Min 8 characters" required>
      </div>
      <div class="form-group">
        <label class="form-label">Confirm Password</label>
        <input class="form-control" type="password" name="password_confirm"
               autocomplete="new-password" required>
      </div>
      <button class="btn btn-gold w-100 mt-3" type="submit">Set New Password</button>
    </form>
    <?php else: ?>
    <p style="text-align:center;margin-top:18px">
      <a href="<?= BASE_URL ?>/admin/login.php" class="btn btn-gold w-100">Go to Login</a>
    </p>
    <?php endif; ?>
  </div>
</div>
</body>
</html>
