<?php
/**
 * Change password (mobile) — required on first login for data collectors.
 */
require_once __DIR__ . '/init.php';
require_once __DIR__ . '/../includes/auth.php';
require_once __DIR__ . '/../includes/user-defaults.php';

if (empty($_SESSION['user_id'])) {
    header('Location: ' . BASE_PATH . '/mobile/login');
    exit;
}

if (($_SESSION['role'] ?? '') !== 'data_collector') {
    header('Location: ' . BASE_PATH . '/change-password');
    exit;
}

if (empty($_SESSION['must_change_password'])) {
    header('Location: ' . BASE_PATH . '/mobile/establish');
    exit;
}

$error = null;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $current = $_POST['current_password'] ?? '';
    $new = $_POST['new_password'] ?? '';
    $confirm = $_POST['confirm_password'] ?? '';

    if (empty($current)) {
        $error = 'Current password is required.';
    } elseif (empty($new)) {
        $error = 'New password is required.';
    } elseif (strlen($new) < 6) {
        $error = 'New password must be at least 6 characters.';
    } elseif ($new !== $confirm) {
        $error = 'New passwords do not match.';
    } else {
        $stmt = $pdo->prepare('SELECT password FROM users WHERE id = ?');
        $stmt->execute([$_SESSION['user_id']]);
        $user = $stmt->fetch();
        if (!$user || !password_verify($current, $user['password'])) {
            $error = 'Current password is incorrect. If you just reset your password, use the default password you were given.';
        } else {
            $hash = password_hash($new, PASSWORD_DEFAULT);
            $pdo->prepare('UPDATE users SET password = ?, must_change_password = 0 WHERE id = ?')
                ->execute([$hash, $_SESSION['user_id']]);
            $_SESSION['must_change_password'] = false;
            header('Location: ' . BASE_PATH . '/mobile/establish');
            exit;
        }
    }
}

$mobileAppIcon = BASE_PATH . '/mobile/assets/img/192.png';
$mobileAppIconV = @filemtime(__DIR__ . '/assets/img/192.png');
if ($mobileAppIconV) {
    $mobileAppIcon .= '?v=' . (int) $mobileAppIconV;
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
    <title>Change password — <?= htmlspecialchars(SITE_NAME) ?></title>
    <link rel="icon" href="<?= htmlspecialchars($mobileAppIcon, ENT_QUOTES, 'UTF-8') ?>" type="image/png" sizes="192x192">
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600&display=swap" rel="stylesheet">
    <link rel="stylesheet" href="<?= nazareth_asset('css/style.css') ?>?v=<?= @filemtime(__DIR__ . '/../public/css/style.css') ?>">
    <link rel="stylesheet" href="<?= nazareth_mobile_asset('mobile.css') ?>?v=<?= @filemtime(__DIR__ . '/mobile.css') ?>">
</head>
<body class="mobile-collect-body mobile-collect-login-body">
    <div class="mobile-collect-login">
        <div class="mobile-collect-login-content">
            <div class="mobile-collect-brand">
                <img src="<?= nazareth_asset('img/logo.png') ?>" alt="" class="mobile-collect-logo">
                <h1 class="mobile-collect-title">Choose a password</h1>
                <p class="mobile-collect-subtitle">First-time sign-in</p>
            </div>

            <?php if ($error): ?>
                <div class="mobile-collect-alert"><?= htmlspecialchars($error) ?></div>
            <?php endif; ?>

            <p class="mobile-collect-hint">Use the temporary password your administrator gave you (often two words together, like redpepper), then pick a new password you will remember.</p>

            <form method="post" action="" class="mobile-collect-form">
                <div class="mobile-collect-field">
                    <label for="current_password">Current password</label>
                    <div class="mobile-collect-input-wrap">
                        <input type="password" id="current_password" name="current_password" class="mobile-collect-input" required autocomplete="current-password">
                    </div>
                </div>
                <div class="mobile-collect-field">
                    <label for="new_password">New password</label>
                    <div class="mobile-collect-input-wrap">
                        <input type="password" id="new_password" name="new_password" class="mobile-collect-input" required minlength="6" autocomplete="new-password">
                    </div>
                </div>
                <div class="mobile-collect-field">
                    <label for="confirm_password">Confirm new password</label>
                    <div class="mobile-collect-input-wrap">
                        <input type="password" id="confirm_password" name="confirm_password" class="mobile-collect-input" required minlength="6" autocomplete="new-password">
                    </div>
                </div>
                <button type="submit" class="mobile-collect-btn">Save password</button>
            </form>
        </div>
    </div>
</body>
</html>
