<?php

require __DIR__ . '/../bootstrap.php';

use KeyLair\Auth;
use KeyLair\Csrf;
use KeyLair\Helpers;
use KeyLair\I18n;
use KeyLair\PasswordReset;
use KeyLair\RateLimiter;
use KeyLair\Settings;

if (Auth::check()) {
    Helpers::redirect('index.php');
}

if (!Settings::passwordResetEnabled()) {
    http_response_code(404);
    require __DIR__ . '/../not_found.php';
    exit;
}

$sent = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    Csrf::requireValid();

    if (RateLimiter::tooManyRequests('password_reset_request', 5, 300)) {
        $error = I18n::t('forgot_password.error.rate_limited');
    } else {
        $identifier = trim($_POST['identifier'] ?? '');
        if ($identifier !== '') {
            PasswordReset::request($identifier);
        }
        // Always show the same result, whether or not it matched an account.
        $sent = true;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title><?= Helpers::e(\KeyLair\Settings::siteName()) ?> — <?= Helpers::e(I18n::t('forgot_password.title')) ?></title>
<link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@600;700&family=Inter:wght@400;500;600&display=swap" rel="stylesheet">
<link rel="stylesheet" href="/assets/css/tokens.css?admin=1">
<?= \KeyLair\Settings::faviconTag() ?>
<style>
  body{background:var(--bg-void); color:var(--text-primary); font-family:var(--font-body); min-height:100vh; display:flex; align-items:center; justify-content:center; padding:24px;}
  .box{width:100%; max-width:380px; background:var(--bg-panel); border:1px solid var(--line); border-radius:var(--radius-lg); padding:28px 26px;}
  .brand{display:flex; align-items:center; gap:8px; margin-bottom:22px; font-family:var(--font-display); font-weight:600; font-size:15px;}
  .brand-icon{width:20px; height:20px; border-radius:5px; object-fit:contain;}
  h1{font-family:var(--font-display); font-size:18px; font-weight:600; margin:0 0 6px;}
  .sub{color:var(--text-muted); font-size:12.5px; margin:0 0 20px; line-height:1.5;}
  label{display:block; font-size:12px; font-weight:600; color:var(--text-muted); margin-bottom:6px;}
  input{width:100%; background:var(--bg-void); border:1px solid var(--line); color:var(--text-primary); font-family:var(--font-body); font-size:13.5px; padding:10px 12px; border-radius:8px; outline:none; margin-bottom:14px;}
  input:focus{border-color:var(--signal-dim);}
  button{width:100%; background:var(--signal); color:var(--bg-void); border:none; font-family:var(--font-body); font-size:13.5px; font-weight:600; padding:11px; border-radius:8px; cursor:pointer;}
  button:hover{background:#5ff0cf;}
  .error{background:rgba(232,115,95,0.12); border:1px solid var(--danger); color:var(--danger); font-size:12.5px; padding:10px 12px; border-radius:8px; margin-bottom:16px;}
  .back{display:block; text-align:center; margin-top:16px; color:var(--text-muted); font-size:12.5px; text-decoration:none;}
  .back:hover{color:var(--signal);}
</style>
</head>
<body>
<div class="box">
  <div class="brand"><?= \KeyLair\Settings::brandIcon() ?><?= Helpers::e(\KeyLair\Settings::siteName()) ?></div>

  <?php if (isset($error)): ?><div class="error"><?= Helpers::e($error) ?></div><?php endif; ?>

  <?php if ($sent): ?>
    <h1><?= Helpers::e(I18n::t('forgot_password.sent_heading')) ?></h1>
    <p class="sub"><?= Helpers::e(I18n::t('forgot_password.sent_hint')) ?></p>
  <?php else: ?>
    <h1><?= Helpers::e(I18n::t('forgot_password.heading')) ?></h1>
    <p class="sub"><?= Helpers::e(I18n::t('forgot_password.hint')) ?></p>
    <form method="post">
      <?= Csrf::field() ?>
      <label><?= Helpers::e(I18n::t('forgot_password.username_or_email_label')) ?></label>
      <input type="text" name="identifier" required autofocus>
      <button type="submit"><?= Helpers::e(I18n::t('forgot_password.send_button')) ?></button>
    </form>
  <?php endif; ?>
  <a class="back" href="login.php">&larr; <?= Helpers::e(I18n::t('forgot_password.back_to_signin')) ?></a>
</div>
</body>
</html>
