<?php
session_start();
require_once '../config/db.php';

$message = '';
$success = false;

// Check if token is in the URL
$token = $_GET['token'] ?? null;

if (!$token) {
    $message = 'Invalid or missing token.';
} else {
    // Fetch token record from password_resets table
    $stmt = $pdo->prepare("SELECT * FROM password_resets WHERE token = ? LIMIT 1");
    $stmt->execute([$token]);
    $reset = $stmt->fetch(PDO::FETCH_ASSOC);

    if (!$reset) {
        $message = 'This password reset link is invalid.';
    } elseif (strtotime($reset['expires_at']) < time()) {
        $message = 'This password reset link has expired.';
    } else {
        // Fetch user
        $stmt = $pdo->prepare("SELECT * FROM users WHERE id = ?");
        $stmt->execute([$reset['user_id']]);
        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        if (!$user) {
            $message = 'User not found.';
        } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
            // Handle password reset
            $password = trim($_POST['password']);
            $confirm_password = trim($_POST['confirm_password']);

            if (strlen($password) < 8) {
                $message = 'Password must be at least 8 characters.';
            } elseif ($password !== $confirm_password) {
                $message = 'Passwords do not match.';
            } else {
                // Hash the new password
                $password_hash = password_hash($password, PASSWORD_DEFAULT);

                // Update the user's password
                $stmt = $pdo->prepare("UPDATE users SET password_hash = ? WHERE id = ?");
                $stmt->execute([$password_hash, $user['id']]);

                // Delete the used token
                $stmt = $pdo->prepare("DELETE FROM password_resets WHERE id = ?");
                $stmt->execute([$reset['id']]);

                $success = true;
                $message = 'Your password has been reset successfully. <a href="login.php">Click here to log in</a>.';
            }
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<title>Reset Password</title>
<link rel="icon" href="../public/assets/img/custora_logo.png" type="image/png">
<style>
body { font-family: Arial, sans-serif; background: #f4f7fa; margin: 0; display: flex; align-items: center; justify-content: center; height: 100vh; }
.container { background: #fff; padding: 35px; width: 350px; border-radius: 10px; box-shadow: 0 6px 18px rgba(0,0,0,0.1); text-align: center; }
.container h2 { margin-bottom: 20px; color: #005f8d; }
form { text-align: left; }
label { display: block; margin-bottom: 6px; font-weight: bold; color: #444; }
input[type="password"] { width: 93.3%; padding: 10px; margin-bottom: 18px; border: 1px solid #ccc; border-radius: 6px; outline: none; font-size: 14px; }
input[type="password"]:focus { border-color: #005f8d; box-shadow: 0 0 5px rgba(0,95,141,0.3); }
button { width: 100%; padding: 12px; background: #005f8d; color: #fff; font-size: 16px; border: none; border-radius: 6px; cursor: pointer; transition: background 0.3s; }
button:hover { background: #004466; }
.message { padding: 10px; border-radius: 6px; margin-bottom: 15px; font-size: 14px; }
.success { background: #d1e7dd; color: #0f5132; }
.error { background: #f8d7da; color: #842029; }
a { display: block; margin-top: 15px; color: #005f8d; text-decoration: none; }
img { width: 180px; }
</style>
</head>
<body>
<div class="container">
<h1><img src="../public/assets/img/custora_logo.png"></h1>
<h2>Reset Password</h2>

<?php if ($message): ?>
<p class="message <?= $success ? 'success' : 'error' ?>">
    <?= $message ?>
</p>
<?php endif; ?>

<?php if ($token && !$success && isset($user) && $user): ?>
<form method="POST">
    <label>New Password:</label>
    <input type="password" name="password" placeholder="Enter new password" required>

    <label>Confirm Password:</label>
    <input type="password" name="confirm_password" placeholder="Confirm new password" required>

    <button type="submit">Reset Password</button>
</form>
<?php endif; ?>

</div>
</body>
</html>