<?php

require_once __DIR__ . '/../lib/init.php';
Auth::requireLogin();

$errors  = [];
$success = false;

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $current  = $_POST['current_password']  ?? '';
    $new      = $_POST['new_password']      ?? '';
    $confirm  = $_POST['confirm_password']  ?? '';

    // Vérifier le mot de passe actuel
    $db   = Database::get();
    $stmt = $db->prepare('SELECT password_hash FROM app_users WHERE id = ?');
    $stmt->execute([Auth::currentUserId()]);
    $user = $stmt->fetch();

    if (!$user || !password_verify($current, $user['password_hash'])) {
        $errors[] = 'Mot de passe actuel incorrect.';
    }
    if (strlen($new) < 6) {
        $errors[] = 'Le nouveau mot de passe doit comporter au moins 6 caractères.';
    }
    if ($new !== $confirm) {
        $errors[] = 'Les nouveaux mots de passe ne correspondent pas.';
    }

    if (!$errors) {
        Auth::changePassword(Auth::currentUserId(), $new);
        AuditLog::log('user.change_password', 'user', Auth::currentUserId(), Auth::currentUsername());
        $success = true;
    }
}

$page_title = 'Changer le mot de passe';
require_once APP_ROOT . '/lib/layout_header.php';
?>

<div class="row justify-content-center">
<div class="col-lg-5">

<div class="mb-3">
    <a href="dashboard.php" class="text-muted text-decoration-none">
        <i class="bi bi-arrow-left"></i> Tableau de bord
    </a>
</div>

<div class="card">
    <div class="card-header py-3">
        <i class="bi bi-key me-2"></i>Changer le mot de passe
    </div>
    <div class="card-body">

        <?php if ($success): ?>
            <div class="alert alert-success">
                <i class="bi bi-check-circle"></i> Mot de passe modifié avec succès.
            </div>
            <a href="dashboard.php" class="btn btn-outline-secondary">
                <i class="bi bi-arrow-left"></i> Retour au tableau de bord
            </a>
        <?php else: ?>
            <?php foreach ($errors as $e): ?>
                <div class="alert alert-danger py-2"><?= h($e) ?></div>
            <?php endforeach; ?>

            <form method="post" autocomplete="off">
                <div class="mb-3">
                    <label class="form-label fw-semibold">Mot de passe actuel <span class="text-danger">*</span></label>
                    <input type="password" name="current_password" class="form-control"
                           required autofocus autocomplete="current-password">
                </div>
                <div class="mb-3">
                    <label class="form-label fw-semibold">Nouveau mot de passe <span class="text-danger">*</span></label>
                    <input type="password" name="new_password" class="form-control"
                           required autocomplete="new-password">
                    <div class="form-text">Minimum 6 caractères.</div>
                </div>
                <div class="mb-4">
                    <label class="form-label fw-semibold">Confirmer le nouveau mot de passe <span class="text-danger">*</span></label>
                    <input type="password" name="confirm_password" class="form-control"
                           required autocomplete="new-password">
                </div>
                <div class="d-flex gap-2">
                    <button type="submit" class="btn btn-primary">
                        <i class="bi bi-check-lg"></i> Enregistrer
                    </button>
                    <a href="dashboard.php" class="btn btn-outline-secondary">Annuler</a>
                </div>
            </form>
        <?php endif; ?>

    </div>
</div>

</div>
</div>

<?php require_once APP_ROOT . '/lib/layout_footer.php'; ?>
