<?php
require_once __DIR__ . '/lib/bootstrap.php';
$me = require_login();
$err = ''; $ok = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    require_csrf();
    $old = (string)($_POST['old'] ?? '');
    $n1  = (string)($_POST['new1'] ?? '');
    $n2  = (string)($_POST['new2'] ?? '');
    if (!password_verify($old, $me['pass_hash'])) $err = 'Current password wrong.';
    elseif (strlen($n1) < 4)  $err = 'New password too short.';
    elseif ($n1 !== $n2)      $err = 'New passwords do not match.';
    else {
        db()->prepare("UPDATE users SET pass_hash=? WHERE id=?")
            ->execute([password_hash($n1, PASSWORD_DEFAULT), $me['id']]);
        $ok = 'Password changed.';
    }
}

page_start('Change password', ['back' => '/profile.php']);
if ($err) p_err($err);
if ($ok)  p_ok($ok);
p_form('/password.php', [
    ['name' => 'old',  'label' => 'Current password', 'type' => 'password'],
    ['name' => 'new1', 'label' => 'New password',     'type' => 'password'],
    ['name' => 'new2', 'label' => 'Repeat new',       'type' => 'password'],
], 'Change');
p_links([['/profile.php', 'Back to profile']]);
page_end();