<?php
if (isset($_POST['pwd_reset_btn'])) {
    $old_pwd = inject_checker($connection, $_POST['old_pwd']);
    $new_pwd = inject_checker($connection, $_POST['new_pwd']);
    $confirm_new_pwd = inject_checker($connection, $_POST['confirm_new_pwd']);

    if (empty($old_pwd) || empty($new_pwd) || empty($confirm_new_pwd)) {
        $_SESSION['msg'] = "All fields are required.";
        $_SESSION['type'] = "danger";
    } elseif ($new_pwd !== $confirm_new_pwd) {
        $_SESSION['msg'] = "New passwords do not match.";
        $_SESSION['type'] = "danger";
    } else {
        $staff_id = $_SESSION['staff']; // make sure staff session is active

        // Fetch current hashed password from database
        $stmt = $connection->prepare("SELECT password FROM staff WHERE id = ?");
        $stmt->bind_param("i", $staff_id);
        $stmt->execute();
        $stmt->bind_result($stored_hashed_password);
        $stmt->fetch();
        $stmt->close();

        if (!password_verify($old_pwd, $stored_hashed_password)) {
            $_SESSION['msg'] = "The old password is incorrect.";
            $_SESSION['type'] = "danger";
        } else {
            // Hash new password
            $hashed_new_pwd = password_hash($new_pwd, PASSWORD_DEFAULT);

            $update_stmt = $connection->prepare("UPDATE staff SET password = ? WHERE id = ?");
            $update_stmt->bind_param("si", $hashed_new_pwd, $staff_id);

            if ($update_stmt->execute()) {
                $_SESSION['msg'] = "Password updated successfully.";
                $_SESSION['type'] = "success";
            } else {
                $_SESSION['msg'] = "Password update failed.";
                $_SESSION['type'] = "danger";
            }
            $update_stmt->close();
        }
    }

    // Redirect to avoid resubmission on refresh
    header("Location: teacher_reset_password"); // replace with correct filename
    exit;
}
?>

<div class="page-title">
  <div>
    <h1><i class="fa fa-key"></i> Reset Password</h1>
    <p>Change Default Password to your own prefered password</p>
  </div>
</div>

<div class="card">
    <div class='row'>
        <div class='col-xs-12 col-sm-12 col-md-6'>
            <div class='panel panel-primary'>
                <div class='panel-heading'>
                    <h3 class='log-text'>Reset Your Password</h3>
                </div>
                <div class='panel-body'>
                    <form method='POST' action=''>
                        <div class='input-group'>
                            <span class='input-group-addon'>Old Password</span>
                            <input type='password' name='old_pwd' placeholder='Type Current Password' class='form-control' required />
                        </div>
                        <br />
                        <div class='input-group'>
                            <span class='input-group-addon'>New Password</span>
                            <input type='password' name='new_pwd' placeholder='Type New Password' class='form-control' required />
                        </div>
                        <br />
                        <div class='input-group'>
                            <span class='input-group-addon'>Confirm Password</span>
                            <input type='password' name='confirm_new_pwd' placeholder='Re-type New Password' class='form-control' required />
                        </div>
                        <br />
                        <input type='submit' name='pwd_reset_btn' value='Reset' class='btn btn-primary btn-block' />
                    </form>
                </div>
            </div>
        </div>
    </div>
</div>
