<?php
require_once __DIR__ . '/includes/auth.php';
chat247_start_session();
$msg = '';
$err = '';
$token = $_GET['token'] ?? '';

if ($token && $_SERVER['REQUEST_METHOD'] === 'POST') {
    // Reset password path
    $password = $_POST['password'] ?? '';
    $confirm = $_POST['confirm'] ?? '';
    if ($password !== $confirm) {
        $err = 'Passwords do not match.';
    } elseif (strlen($password) < 8) {
        $err = 'Password too short.';
    } else {
        $relay = chat247_relay_url();
        $ch = curl_init("$relay/api/reset");
        curl_setopt_array($ch, [
            CURLOPT_POST => true,
            CURLOPT_RETURNTRANSFER => true,
            CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
            CURLOPT_POSTFIELDS => json_encode(['token'=>$token,'password'=>$password]),
            CURLOPT_TIMEOUT => 10,
        ]);
        $resp = curl_exec($ch);
        $code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
        curl_close($ch);
        $data = $resp ? json_decode($resp, true) : null;
        if ($code === 200) { header('Location: /login.php'); exit; }
        $err = $data['error'] ?? 'Reset failed';
    }
} elseif (!$token && $_SERVER['REQUEST_METHOD'] === 'POST') {
    // Request reset link
    $email = trim($_POST['email'] ?? '');
    $relay = chat247_relay_url();
    $ch = curl_init("$relay/api/forgot");
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
        CURLOPT_POSTFIELDS => json_encode(['email'=>$email]),
        CURLOPT_TIMEOUT => 10,
    ]);
    curl_exec($ch);
    curl_close($ch);
    $msg = 'If that email exists, you will get a link in a minute.';
}
?><!doctype html>
<html lang="en"><head>
<base href="https://<?= htmlspecialchars($_SERVER['HTTP_HOST'] ?? '', ENT_QUOTES) ?>/"><meta charset="utf-8"><title>Forgot password — 247ch.at</title>
<link rel="icon" href="/favicon.ico?v=<?= @filemtime(__DIR__ . '/favicon.ico') ?: time() ?>">
<style>
 body { font-family:-apple-system,sans-serif; background:#0b0f1a; color:#f3f4f6; display:flex; flex-direction:column; align-items:center; justify-content:center; min-height:100vh; margin:0; padding:24px 0; }
 .card { background:#111827; padding:32px; border-radius:12px; width:360px; }
 .legal-mini { margin-top:24px; font-size:12px; color:#6b7280; text-align:center; }
 .legal-mini a { color:#6b7280; text-decoration:none; margin:0 6px; }
 .legal-mini a:hover { color:#9ca3af; }
 .card h1 { margin:0 0 24px; font-size:22px; text-align:center; }
 label { display:block; font-size:13px; color:#9ca3af; margin-top:12px; }
 input { width:100%; padding:10px; background:#0b0f1a; border:1px solid #2a3142; color:#f3f4f6; border-radius:6px; }
 button { width:100%; margin-top:16px; padding:12px; background:#3b82f6; color:#fff; border:none; border-radius:8px; font-weight:600; }
 .err { color:#f87171; font-size:13px; margin-top:12px; text-align:center; }
 .ok  { color:#34d399; font-size:13px; margin-top:12px; text-align:center; }
 .links { text-align:center; margin-top:16px; font-size:13px; }
 .links a { color:#9ca3af; text-decoration:none; }
</style></head><body>
<div class="card">
<?php if ($token): ?>
  <h1>Set a new password</h1>
  <form method="post">
    <label>New password</label>
    <input type="password" name="password" required autofocus>
    <label>Confirm</label>
    <input type="password" name="confirm" required>
    <button type="submit">Save password</button>
    <?php if ($err): ?><div class="err"><?=htmlspecialchars($err)?></div><?php endif; ?>
  </form>
<?php else: ?>
  <h1>Forgot your password?</h1>
  <form method="post">
    <label>Email</label>
    <input type="email" name="email" required autofocus>
    <button type="submit">Send reset link</button>
    <?php if ($msg): ?><div class="ok"><?=htmlspecialchars($msg)?></div><?php endif; ?>
  </form>
  <div class="links"><a href="/login">Back to sign in</a></div>
<?php endif; ?>
</div>
<div class="legal-mini">
  <a href="/pricing">Pricing</a> &middot;
  <a href="/privacy">Privacy</a> &middot;
  <a href="/terms">Terms</a> &middot;
  <a href="mailto:support@247ch.at">support@247ch.at</a>
</div>
</body></html>
