<?php

declare(strict_types=1);

/**
 * Password reset landing page (1.5.0). The link in the reset email
 * points here with a single-use token that dies after 20 minutes. The
 * token IS the credential: no session, no CSRF, one form, plain HTML in
 * the installer's styling. Only exists in practice on boards where the
 * SysOp configured outgoing mail; without a live token this page tells
 * you nothing about any account.
 */

require __DIR__ . '/lib/bootstrap.php';

if (atdt_config() === null) {
    header('Location: install.php');
    exit;
}
$db = atdt_db();
$settings = atdt_settings();
$board = (string)($settings->get('board_name', 'ATDT') ?? 'ATDT');

$token = (string)($_GET['t'] ?? $_POST['t'] ?? '');
$user = $token === '' ? null : \Atdt\Users::byResetToken($db, $token);
$state = 'bad'; // bad | form | short | mismatch | done
$err = '';

if ($user !== null) {
    $state = 'form';
    if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
        $p1 = (string)($_POST['pass'] ?? '');
        $p2 = (string)($_POST['pass2'] ?? '');
        if (strlen($p1) < 8) {
            $state = 'form';
            $err = 'The new password must be at least 8 characters.';
        } elseif ($p1 !== $p2) {
            $state = 'form';
            $err = 'The two passwords do not match.';
        } else {
            \Atdt\Users::completeReset($db, $user, $p1);
            atdt_log_event('security', 'reset', 'password reset completed for ' . (string)$user['handle']);
            $state = 'done';
        }
    }
} elseif ($token !== '') {
    atdt_log_event('security', 'reset', 'reset page hit with a dead or unknown token');
}

$h = fn(string $s): string => htmlspecialchars($s, ENT_QUOTES);
?><!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title><?= $h($board) ?> - password reset</title>
<style>
  body { background: #0a0a12; color: #ccc; font: 16px/1.5 system-ui, sans-serif;
         display: flex; justify-content: center; padding: 2rem 1rem; }
  main { max-width: 30rem; width: 100%; }
  h1 { color: #7fd4ff; font-size: 1.3rem; }
  .card { background: #14141f; border: 1px solid #2a2a3a; border-radius: 8px; padding: 1.2rem 1.4rem; }
  label { display: block; margin: .8rem 0 .2rem; color: #9ab; }
  input[type=password] { width: 100%; padding: .5rem; background: #0a0a12; color: #eee;
         border: 1px solid #2a2a3a; border-radius: 4px; }
  button { margin-top: 1rem; padding: .55rem 1.4rem; background: #1c6ea4; color: #fff;
         border: 0; border-radius: 4px; cursor: pointer; font-size: 1rem; }
  .err { color: #ff8f8f; margin-top: .8rem; }
  .muted { color: #778; font-size: .9rem; }
</style>
</head>
<body>
<main>
  <h1><?= $h($board) ?></h1>
  <div class="card">
  <?php if ($state === 'done'): ?>
    <p><strong>Done.</strong> Your password has been changed.</p>
    <p>Come call: <a style="color:#7fd4ff" href="index.php">back to the board</a>.</p>
  <?php elseif ($state === 'form'): ?>
    <p>Setting a new password for <strong><?= $h((string)$user['handle']) ?></strong>.</p>
    <form method="post" action="reset.php">
      <input type="hidden" name="t" value="<?= $h($token) ?>">
      <label>New password <span class="muted">(at least 8 characters)</span></label>
      <input type="password" name="pass" autofocus autocomplete="new-password">
      <label>Once more</label>
      <input type="password" name="pass2" autocomplete="new-password">
      <?php if ($err !== ''): ?><p class="err"><?= $h($err) ?></p><?php endif; ?>
      <button type="submit">Set password</button>
    </form>
    <p class="muted">This link works once and expires 20 minutes after it was sent.</p>
  <?php else: ?>
    <p><strong>That link is spent, expired, or was never real.</strong></p>
    <p class="muted">Reset links live for 20 minutes and die when used. Call the board
    and ask for a fresh one from the login screen.</p>
  <?php endif; ?>
  </div>
</main>
</body>
</html>
