<?php
/**
 * Forgot password — request only (admin completes reset; no automatic password change).
 */
require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/password-reset.php';

if (!empty($_SESSION['user_id'])) {
    nazareth_redirect(nazareth_post_login_route());
}

$error = null;
$submitted = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = trim($_POST['username'] ?? '');
    $result = nazareth_request_password_reset($pdo, $username, 'main');

    if ($result['ok']) {
        $submitted = true;
    } else {
        switch ($result['code']) {
            case 'rate_limit':
                $error = 'Too many requests from this connection. Please wait an hour or contact your church administrator.';
                break;
            default:
                $error = 'Enter your username.';
        }
    }
}

$helpMessage = nazareth_password_reset_help_message();
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Forgot password — <?= htmlspecialchars(SITE_NAME) ?></title>
    <link rel="icon" href="<?= nazareth_asset('img/logo.png') ?>" type="image/png">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@300;400;600&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="<?= nazareth_asset('css/style.css') ?>">
</head>
<body class="login-page">
    <div class="login-card">
        <div class="login-brand">
            <img src="<?= nazareth_asset('img/logo.png') ?>" alt="" class="login-logo">
            <h1 class="login-title">Forgot password</h1>
            <p class="login-motto">Request a reset</p>
        </div>

        <?php if ($submitted): ?>
            <div class="login-alert login-alert--success">
                If an account exists for that username, your request has been recorded. <?= htmlspecialchars($helpMessage) ?>
            </div>
        <?php elseif ($error): ?>
            <div class="login-alert login-alert--error"><?= htmlspecialchars($error) ?></div>
        <?php else: ?>
            <p class="login-hint">Enter your username. An administrator will verify your identity and set a new temporary password for you. Passwords are <strong>not</strong> changed automatically on this page.</p>
        <?php endif; ?>

        <?php if (!$submitted): ?>
        <form method="post" action="<?= nazareth_url('forgot-password') ?>" class="login-form">
            <div class="form-group">
                <label for="username">Username</label>
                <input type="text" id="username" name="username" required autofocus autocomplete="username"
                    value="<?= htmlspecialchars($_POST['username'] ?? '') ?>">
            </div>
            <button type="submit" class="btn btn-block btn-primary">Submit request</button>
        </form>
        <?php endif; ?>

        <p class="login-extra-link">
            <a href="<?= nazareth_url('login') ?>">← Back to sign in</a>
        </p>
    </div>
    <footer class="login-footer">© <?= date('Y') ?> <?= htmlspecialchars(SITE_NAME) ?>. All rights reserved.</footer>
</body>
</html>
