<?php
require_once __DIR__ . '/../lib/auth.php';

if (is_logged_in()) {
    header('Location: dashboard.php');
    exit;
}

$step  = $_POST['step'] ?? 'request';
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    verify_csrf();

    if ($step === 'request') {
        $username = trim($_POST['username'] ?? '');
        if ($username === '') {
            $error = 'Bitte Benutzername eingeben.';
        } else {
            omsorgcore_forgot_password_request(_omsorgcore_config(), $username);
            // Bewusst immer weiter zu Schritt 2, unabhängig vom Ergebnis - kein Rückschluss darauf,
            // ob der Username existiert (siehe PasswordResetService.RequestResetAsync in omsorgCore).
            $step = 'verify';
        }
    } elseif ($step === 'verify') {
        $username = trim($_POST['username'] ?? '');
        $pin      = trim($_POST['pin'] ?? '');
        $result   = omsorgcore_forgot_password_verify(_omsorgcore_config(), $username, $pin);

        if ($result['ok']) {
            $resetToken = $result['data']['resetToken'];
            $step = 'reset';
        } else {
            $error = 'Code ungültig oder abgelaufen.';
        }
    } elseif ($step === 'reset') {
        $resetToken = $_POST['reset_token'] ?? '';
        $new        = $_POST['new_password'] ?? '';
        $repeat     = $_POST['new_password_repeat'] ?? '';

        if (strlen($new) < 8) {
            $error = 'Das neue Passwort muss mindestens 8 Zeichen lang sein.';
        } elseif ($new !== $repeat) {
            $error = 'Die Passwörter stimmen nicht überein.';
        } else {
            $result = omsorgcore_forgot_password_reset(_omsorgcore_config(), $resetToken, $new);
            if ($result['ok']) {
                header('Location: ../index.php?pwchanged=1');
                exit;
            }
            $error = 'Zurücksetzen fehlgeschlagen. Bitte Vorgang erneut starten.';
            $step  = 'request';
        }
    }
}
?>
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1">
<title>OMSORG Felix – Passwort vergessen</title>
<link rel="stylesheet" href="../app.css">
</head>
<body>

<div class="login-page">
  <div class="login-card glass">
    <h2 style="font-family:'KindelSerif',Georgia,serif;font-size:1.5rem;margin:0 0 6px">Passwort vergessen</h2>

    <?php if ($error): ?>
      <div class="error" style="margin-bottom:16px"><?= e($error) ?></div>
    <?php endif; ?>

    <?php if ($step === 'request'): ?>
      <p class="hint" style="margin:0 0 22px">Gib deinen Benutzernamen ein, wir senden dir einen Code per E-Mail.</p>
      <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="step" value="request">
        <label>
          Benutzername
          <input type="text" name="username" autocomplete="username" required autofocus>
        </label>
        <button type="submit" class="btn" style="width:100%;margin-top:6px">Code anfordern</button>
      </form>

    <?php elseif ($step === 'verify'): ?>
      <p class="hint" style="margin:0 0 22px">Gib den Code ein, den wir dir per E-Mail geschickt haben.</p>
      <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="step" value="verify">
        <input type="hidden" name="username" value="<?= e($username ?? '') ?>">
        <label>
          Code
          <input type="text" name="pin" inputmode="numeric" pattern="[0-9]*" maxlength="6" required autofocus>
        </label>
        <button type="submit" class="btn" style="width:100%;margin-top:6px">Code bestätigen</button>
      </form>

    <?php elseif ($step === 'reset'): ?>
      <p class="hint" style="margin:0 0 22px">Lege dein neues Passwort fest.</p>
      <form method="post">
        <?= csrf_field() ?>
        <input type="hidden" name="step" value="reset">
        <input type="hidden" name="reset_token" value="<?= e($resetToken ?? '') ?>">
        <label>
          Neues Passwort
          <input type="password" name="new_password" autocomplete="new-password" required minlength="8" autofocus>
        </label>
        <label>
          Neues Passwort wiederholen
          <input type="password" name="new_password_repeat" autocomplete="new-password" required minlength="8">
        </label>
        <button type="submit" class="btn" style="width:100%;margin-top:6px">Passwort setzen</button>
      </form>
    <?php endif; ?>

    <p class="hint" style="text-align:center;margin-top:14px">
      <a href="../index.php">Zurück zum Login</a>
    </p>
  </div>
</div>

</body>
</html>
