<?php
require_once __DIR__ . '/app/bootstrap.php';
$user = require_auth();

if ((int)($user['must_change_password'] ?? 0) !== 1) {
    redirect('dashboard.php');
}

$authPage = true;
$pageTitle = 'Obavezna promena lozinke';
$pageSubtitle = 'Postavljanje nove lične lozinke';
$errors = [];

if (is_post()) {
    validate_csrf();
    $currentPassword = (string)($_POST['current_password'] ?? '');
    $newPassword = (string)($_POST['new_password'] ?? '');
    $confirmPassword = (string)($_POST['confirm_password'] ?? '');

    $stmt = db()->prepare('SELECT password_hash FROM users WHERE id = ? LIMIT 1');
    $stmt->execute([(int)$user['id']]);
    $passwordHash = (string)$stmt->fetchColumn();

    if ($passwordHash === '' || !password_verify($currentPassword, $passwordHash)) {
        $errors[] = 'Trenutna ili privremena lozinka nije ispravna.';
    }
    if (strlen($newPassword) < 10) {
        $errors[] = 'Nova lozinka mora imati najmanje 10 karaktera.';
    }
    if ($newPassword !== $confirmPassword) {
        $errors[] = 'Nova lozinka i potvrda nove lozinke nisu iste.';
    }
    if ($currentPassword !== '' && $newPassword !== '' && hash_equals($currentPassword, $newPassword)) {
        $errors[] = 'Nova lozinka mora biti drugačija od trenutne lozinke.';
    }

    if (!$errors) {
        $stmt = db()->prepare('UPDATE users SET password_hash = ?, must_change_password = 0, updated_at = ? WHERE id = ?');
        $stmt->execute([password_hash($newPassword, PASSWORD_DEFAULT), now_app_datetime_sql(), (int)$user['id']]);
        session_regenerate_id(true);
        unset($_SESSION['csrf_token']);
        flash('success', 'Lozinka je promenjena. Sada možete da pristupite sistemu.');
        redirect('dashboard.php');
    }
}

require_once __DIR__ . '/app/header.php';
?>
<form method="post" class="card login-card form-card forced-password-card" autocomplete="off">
    <?= csrf_field() ?>
    <span class="badge badge-danger">Obavezna promena</span>
    <h2>Postavite novu lozinku</h2>
    <p class="muted">Pre pristupa sistemu unesite lozinku koju ste dobili od administratora, zatim postavite i potvrdite novu ličnu lozinku.</p>

    <?php foreach ($errors as $error): ?>
        <div class="alert alert-danger"><?= e($error) ?></div>
    <?php endforeach; ?>

    <label>Trenutna / privremena lozinka
        <input type="password" name="current_password" required autocomplete="current-password" autofocus>
    </label>
    <label>Nova lozinka
        <input type="password" name="new_password" required minlength="10" autocomplete="new-password">
    </label>
    <label>Potvrdite novu lozinku
        <input type="password" name="confirm_password" required minlength="10" autocomplete="new-password">
    </label>

    <button class="button button-primary login-submit" type="submit"><span>Promeni lozinku i nastavi</span><span aria-hidden="true">→</span></button>
    <a class="button button-light" href="<?= e(url('logout.php?csrf=' . rawurlencode(csrf_token()))) ?>">Odjava</a>
</form>
<?php require_once __DIR__ . '/app/footer.php'; ?>
