<?php

require __DIR__ . '/../bootstrap.php';

use KeyLair\Auth;
use KeyLair\Csrf;
use KeyLair\Helpers;
use KeyLair\I18n;
use KeyLair\PasswordReset;
use KeyLair\RateLimiter;

if (Auth::check()) {
    Helpers::redirect('index.php');
}

$token = $_GET['token'] ?? ($_POST['token'] ?? '');
$reset = $token !== '' ? PasswordReset::validate($token) : null;
$error = null;
$done = false;

if ($reset && $_SERVER['REQUEST_METHOD'] === 'POST') {
    Csrf::requireValid();

    if (RateLimiter::tooManyRequests('password_reset_submit', 10, 300)) {
        $error = I18n::t('reset_password.error.rate_limited');
    } else {
        $password = $_POST['password'] ?? '';
        $passwordConfirm = $_POST['password_confirm'] ?? '';

        if (strlen($password) < 10) {
            $error = I18n::t('reset_password.error.password_too_short');
        } elseif ($password !== $passwordConfirm) {
            $error = I18n::t('reset_password.error.passwords_dont_match');
        } elseif (PasswordReset::consume($token, $password)) {
            $done = true;
        } else {
            $error = I18n::t('reset_password.error.link_invalid');
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= Helpers::e(\KeyLair\Settings::siteName()) ?> — <?= Helpers::e(I18n::t('reset_password.title')) ?></title>
<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@600;700&family=Inter:wght@400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/assets/css/tokens.css?admin=1">
<?= \KeyLair\Settings::faviconTag() ?>
<style>
  body{background:var(--bg-void); color:var(--text-primary); font-family:var(--font-body); min-height:100vh; display:flex; align-items:center; justify-content:center; padding:24px;}
  .box{width:100%; max-width:380px; background:var(--bg-panel); border:1px solid var(--line); border-radius:var(--radius-lg); padding:28px 26px;}
  .brand{display:flex; align-items:center; gap:8px; margin-bottom:22px; font-family:var(--font-display); font-weight:600; font-size:15px;}
  .brand-icon{width:20px; height:20px; border-radius:5px; object-fit:contain;}
  h1{font-family:var(--font-display); font-size:18px; font-weight:600; margin:0 0 6px;}
  .sub{color:var(--text-muted); font-size:12.5px; margin:0 0 20px; line-height:1.5;}
  label{display:block; font-size:12px; font-weight:600; color:var(--text-muted); margin-bottom:6px;}
  input{width:100%; background:var(--bg-void); border:1px solid var(--line); color:var(--text-primary); font-family:var(--font-body); font-size:13.5px; padding:10px 12px; border-radius:8px; outline:none; margin-bottom:14px;}
  input:focus{border-color:var(--signal-dim);}
  button{width:100%; background:var(--signal); color:var(--bg-void); border:none; font-family:var(--font-body); font-size:13.5px; font-weight:600; padding:11px; border-radius:8px; cursor:pointer;}
  button:hover{background:#5ff0cf;}
  .error{background:rgba(232,115,95,0.12); border:1px solid var(--danger); color:var(--danger); font-size:12.5px; padding:10px 12px; border-radius:8px; margin-bottom:16px;}
  .back{display:block; text-align:center; margin-top:16px; color:var(--text-muted); font-size:12.5px; text-decoration:none;}
  .back:hover{color:var(--signal);}
</style>
</head>
<body>
<div class="box">
  <div class="brand"><?= \KeyLair\Settings::brandIcon() ?><?= Helpers::e(\KeyLair\Settings::siteName()) ?></div>

  <?php if ($error): ?><div class="error"><?= Helpers::e($error) ?></div><?php endif; ?>

  <?php if ($done): ?>
    <h1><?= Helpers::e(I18n::t('reset_password.done_heading')) ?></h1>
    <p class="sub"><?= Helpers::e(I18n::t('reset_password.done_hint')) ?></p>
    <a class="back" href="login.php">&larr; <?= Helpers::e(I18n::t('reset_password.back_to_signin')) ?></a>
  <?php elseif (!$reset): ?>
    <h1><?= Helpers::e(I18n::t('reset_password.invalid_heading')) ?></h1>
    <p class="sub"><?= Helpers::e(I18n::t('reset_password.invalid_hint')) ?></p>
    <a class="back" href="forgot_password.php"><?= Helpers::e(I18n::t('reset_password.request_new_link')) ?></a>
  <?php else: ?>
    <h1><?= Helpers::e(I18n::t('reset_password.heading')) ?></h1>
    <p class="sub"><?= sprintf(Helpers::e(I18n::t('reset_password.hint')), '<strong>' . Helpers::e($reset['username']) . '</strong>') ?></p>
    <form method="post">
      <?= Csrf::field() ?>
      <input type="hidden" name="token" value="<?= Helpers::e($token) ?>">
      <label><?= Helpers::e(I18n::t('reset_password.new_password_label')) ?></label>
      <input type="password" name="password" required minlength="10" autofocus>
      <label><?= Helpers::e(I18n::t('reset_password.confirm_new_password_label')) ?></label>
      <input type="password" name="password_confirm" required minlength="10">
      <button type="submit"><?= Helpers::e(I18n::t('reset_password.submit_button')) ?></button>
    </form>
  <?php endif; ?>
</div>
</body>
</html>
