<?php
session_start();
require_once __DIR__ . '/config/config.php';

// Must have email from step 1
if (!isset($_SESSION['reset_email'])) {
    header('Location: forgot-password.php');
    exit;
}

$email = $_SESSION['reset_email'];
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $code = trim($_POST['code'] ?? '');
    
    if (strlen($code) !== 6) {
        $error = 'Please enter 6-digit code';
    } else {
        $pdo = getDBConnection();
        
        // Check code
        $stmt = $pdo->prepare("SELECT * FROM password_resets WHERE email = ? AND code = ? AND used = 0 AND expires_at > NOW() LIMIT 1");
        $stmt->execute([$email, $code]);
        $reset = $stmt->fetch();
        
        if ($reset) {
            // Code is valid - save to session and go to reset page
            $_SESSION['reset_user_id'] = $reset['user_id'];
            $_SESSION['reset_code_id'] = $reset['id'];
            header('Location: reset-password.php');
            exit;
        } else {
            $error = 'Invalid or expired code';
        }
    }
}

// Mask email
$parts = explode('@', $email);
$masked = substr($parts[0], 0, 2) . '***@' . $parts[1];
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Enter Code</title>
    <style>
        *{margin:0;padding:0;box-sizing:border-box}
        body{font-family:Arial,sans-serif;background:#0A1628;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px}
        .card{background:#0F2744;padding:30px;border-radius:12px;width:100%;max-width:400px;text-align:center}
        h1{color:#F5A623;margin-bottom:10px}
        .subtitle{color:#9CA3AF;margin-bottom:20px}
        .email-box{background:#1E3A5F;padding:10px;border-radius:8px;color:#F5A623;margin-bottom:20px}
        .form-group{margin-bottom:20px}
        input{width:100%;padding:15px;background:#1E3A5F;border:2px solid #2D4A6F;border-radius:8px;color:#F5A623;font-size:24px;text-align:center;letter-spacing:10px}
        input:focus{outline:none;border-color:#F5A623}
        button{width:100%;padding:14px;background:#F5A623;color:#000;border:none;border-radius:8px;font-size:16px;font-weight:bold;cursor:pointer}
        button:hover{background:#FFD93D}
        .error{background:#EF4444;color:#fff;padding:10px;border-radius:8px;margin-bottom:20px}
        .links{margin-top:20px}
        .links a{color:#9CA3AF;text-decoration:none;display:block;margin:10px 0}
        .links a:hover{color:#F5A623}
    </style>
</head>
<body>
    <div class="card">
        <h1>Enter Code</h1>
        <p class="subtitle">We sent a 6-digit code to</p>
        <div class="email-box"><?php echo $masked; ?></div>
        
        <?php if($error): ?><div class="error"><?php echo $error; ?></div><?php endif; ?>
        
        <form method="POST">
            <div class="form-group">
                <input type="text" name="code" maxlength="6" required placeholder="000000" pattern="[0-9]{6}">
            </div>
            <button type="submit">Verify Code</button>
        </form>
        
        <div class="links">
            <a href="forgot-password.php">Resend Code</a>
            <a href="login.php">Back to Login</a>
        </div>
    </div>
</body>
</html>