<?php
/**
 * Change password - required for clerks on first login
 */

require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/auth.php';

// Must be logged in
if (empty($_SESSION['user_id'])) {
    header('Location: ' . BASE_PATH . '/login');
    exit;
}

// If no longer must change, redirect to appropriate page
if (empty($_SESSION['must_change_password'])) {
    nazareth_redirect(nazareth_post_login_route());
}

$error = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $current = $_POST['current_password'] ?? '';
    $new = $_POST['new_password'] ?? '';
    $confirm = $_POST['confirm_password'] ?? '';

    if (empty($current)) $error = 'Current password is required.';
    elseif (empty($new)) $error = 'New password is required.';
    elseif (strlen($new) < 6) $error = 'New password must be at least 6 characters.';
    elseif ($new !== $confirm) $error = 'New passwords do not match.';
    else {
        $stmt = $pdo->prepare('SELECT password FROM users WHERE id = ?');
        $stmt->execute([$_SESSION['user_id']]);
        $user = $stmt->fetch();
        if (!$user || !password_verify($current, $user['password'])) {
            $error = 'Current password is incorrect.';
        } else {
            $hash = password_hash($new, PASSWORD_DEFAULT);
            $pdo->prepare('UPDATE users SET password = ?, must_change_password = 0 WHERE id = ?')
                ->execute([$hash, $_SESSION['user_id']]);
            $_SESSION['must_change_password'] = false;
            nazareth_redirect(nazareth_post_login_route());
        }
    }
}

$pageTitle = 'Change Password';
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?= htmlspecialchars($pageTitle) ?> - <?= htmlspecialchars(SITE_NAME) ?></title>
    <link rel="icon" href="<?= nazareth_asset('img/logo.png') ?>" type="image/png">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="<?= nazareth_asset('css/style.css') ?>">
</head>
<body class="login-page">
    <div class="login-card">
        <div class="login-brand">
            <img src="<?= nazareth_asset('img/logo.png') ?>" alt="" class="login-logo">
            <h1 class="login-title"><?= htmlspecialchars(SITE_NAME) ?></h1>
            <p class="login-motto">Change your password</p>
        </div>

        <?php if ($error): ?>
            <div class="alert alert-error"><?= htmlspecialchars($error) ?></div>
        <?php endif; ?>

        <form method="post" action="" class="login-form">
            <div class="form-group">
                <label for="current_password">Current password</label>
                <input type="password" id="current_password" name="current_password" required autofocus>
            </div>
            <div class="form-group">
                <label for="new_password">New password</label>
                <input type="password" id="new_password" name="new_password" required minlength="6">
            </div>
            <div class="form-group">
                <label for="confirm_password">Confirm new password</label>
                <input type="password" id="confirm_password" name="confirm_password" required minlength="6">
            </div>
            <button type="submit" class="btn btn-block btn-primary">Change password</button>
        </form>
    </div>
</body>
</html>
