<?php
require_once __DIR__ . '/includes/auth.php';
if (!isLoggedIn()) { header('Location: login.php'); exit; }

$error = '';
$success = false;
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $pw1 = $_POST['password1'] ?? '';
    $pw2 = $_POST['password2'] ?? '';
    if (strlen($pw1) < 8) {
        $error = 'Password must be at least 8 characters.';
    } elseif ($pw1 !== $pw2) {
        $error = 'Passwords do not match.';
    } else {
        changeOwnPassword($pw1);
        $success = true;
    }
}
$forced = mustChangePassword();
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Change password — <?= htmlspecialchars(SITE_NAME) ?></title>
  <script src="https://cdn.tailwindcss.com"></script>
  <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet">
  <style>body{font-family:'Inter',system-ui,sans-serif}</style>
</head>
<body class="min-h-screen flex items-center justify-center bg-gradient-to-b from-[#0d1938] via-[#0d1938] to-slate-950 px-4">
  <div class="w-full max-w-md">
    <div class="flex flex-col items-center mb-6">
      <div class="flex h-14 w-14 items-center justify-center rounded-2xl bg-blue-600 text-white shadow-lg text-2xl">🛡</div>
      <h1 class="mt-4 text-xl font-bold text-white"><?= $forced ? 'Set a new password' : 'Change password' ?></h1>
      <p class="text-sm text-slate-400 mt-1 text-center">
        <?= $forced ? 'For security, you must set your own password before continuing.' : 'Update the password for your login.' ?>
      </p>
    </div>

    <?php if ($success): ?>
      <div class="bg-white rounded-xl border border-slate-200 shadow-lg p-6 sm:p-8 text-center space-y-4">
        <div class="rounded-lg bg-emerald-50 border border-emerald-200 px-3 py-2 text-sm text-emerald-700">Password updated.</div>
        <a href="dashboard.php" class="inline-block w-full rounded-lg bg-blue-600 hover:bg-blue-700 text-white font-semibold py-2.5 text-sm">Continue</a>
      </div>
    <?php else: ?>
      <form method="post" class="bg-white rounded-xl border border-slate-200 shadow-lg p-6 sm:p-8 space-y-5">
        <div>
          <label class="block text-xs font-semibold uppercase tracking-wide text-slate-500 mb-1.5">New password</label>
          <input type="password" name="password1" required minlength="8" autofocus class="w-full rounded-lg border border-slate-300 px-3 py-2.5 text-sm">
        </div>
        <div>
          <label class="block text-xs font-semibold uppercase tracking-wide text-slate-500 mb-1.5">Confirm new password</label>
          <input type="password" name="password2" required minlength="8" class="w-full rounded-lg border border-slate-300 px-3 py-2.5 text-sm">
        </div>
        <p class="text-xs text-slate-400">Use at least 8 characters. Avoid reusing the default password.</p>
        <?php if ($error): ?>
          <div class="rounded-lg bg-rose-50 border border-rose-200 px-3 py-2 text-sm text-rose-700"><?= htmlspecialchars($error) ?></div>
        <?php endif; ?>
        <button type="submit" class="w-full rounded-lg bg-blue-600 hover:bg-blue-700 text-white font-semibold py-2.5 text-sm">Update password</button>
        <?php if (!$forced): ?>
          <a href="dashboard.php" class="block text-center text-sm text-slate-500 hover:text-slate-700">Cancel</a>
        <?php endif; ?>
        <a href="logout.php" class="block text-center text-xs text-slate-400 hover:text-slate-600">Sign out instead</a>
      </form>
    <?php endif; ?>
  </div>
</body>
</html>
