<?php
session_start();
require_once __DIR__ . '/config/config.php';

// Must have verified code
if (!isset($_SESSION['reset_user_id'])) {
    header('Location: forgot-password.php');
    exit;
}

$userId = $_SESSION['reset_user_id'];
$codeId = $_SESSION['reset_code_id'];
$error = '';
$success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $password = $_POST['password'] ?? '';
    $confirm = $_POST['confirm'] ?? '';
    
    if (strlen($password) < 6) {
        $error = 'Password must be at least 6 characters';
    } elseif ($password !== $confirm) {
        $error = 'Passwords do not match';
    } else {
        $pdo = getDBConnection();
        
        // Update password
        $hash = password_hash($password, PASSWORD_DEFAULT);
        $stmt = $pdo->prepare("UPDATE users SET password = ? WHERE id = ?");
        $stmt->execute([$hash, $userId]);
        
        // Mark code as used
        $stmt = $pdo->prepare("UPDATE password_resets SET used = 1 WHERE id = ?");
        $stmt->execute([$codeId]);
        
        // Clear session
        unset($_SESSION['reset_email']);
        unset($_SESSION['reset_user_id']);
        unset($_SESSION['reset_code_id']);
        
        $success = true;
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Reset Password</title>
    <style>
        *{margin:0;padding:0;box-sizing:border-box}
        body{font-family:Arial,sans-serif;background:#0A1628;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:20px}
        .card{background:#0F2744;padding:30px;border-radius:12px;width:100%;max-width:400px;text-align:center}
        h1{color:#F5A623;margin-bottom:20px}
        .form-group{margin-bottom:20px;text-align:left}
        label{color:#fff;display:block;margin-bottom:8px}
        input{width:100%;padding:12px;background:#1E3A5F;border:1px solid #2D4A6F;border-radius:8px;color:#fff;font-size:16px}
        input:focus{outline:none;border-color:#F5A623}
        button{width:100%;padding:14px;background:#F5A623;color:#000;border:none;border-radius:8px;font-size:16px;font-weight:bold;cursor:pointer}
        button:hover{background:#FFD93D}
        .btn-green{background:#10B981}
        .btn-green:hover{background:#059669}
        .error{background:#EF4444;color:#fff;padding:10px;border-radius:8px;margin-bottom:20px}
        .success{background:#10B981;color:#fff;padding:20px;border-radius:8px;margin-bottom:20px}
        .success h2{margin-bottom:10px}
    </style>
</head>
<body>
    <div class="card">
        <?php if($success): ?>
            <div class="success">
                <h2>✓ Password Reset!</h2>
                <p>Your password has been changed.</p>
            </div>
            <a href="login.php"><button class="btn-green">Go to Login</button></a>
        <?php else: ?>
            <h1>New Password</h1>
            
            <?php if($error): ?><div class="error"><?php echo $error; ?></div><?php endif; ?>
            
            <form method="POST">
                <div class="form-group">
                    <label>New Password</label>
                    <input type="password" name="password" required minlength="6" placeholder="Enter new password">
                </div>
                <div class="form-group">
                    <label>Confirm Password</label>
                    <input type="password" name="confirm" required placeholder="Confirm password">
                </div>
                <button type="submit">Reset Password</button>
            </form>
        <?php endif; ?>
    </div>
</body>
</html>