<?php
require __DIR__ . '/_boot.php';
require __DIR__ . '/partials/nav.php';
if (!$user) { header('Location: login-dev.php'); exit; }
$safe = static fn($value) => htmlspecialchars((string)$value, ENT_QUOTES, 'UTF-8');
?>
<!doctype html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <title>Change password</title>
  <link rel="stylesheet" href="assets/css/app.css">
</head>
<body>
<?php pyrk_render_nav('client'); ?>
<main class="container account-security-page">
  <section class="panel account-security-card">
    <div class="section-head">
      <div>
        <p class="eyebrow">Account security</p>
        <h1>Change password</h1>
        <p class="muted">Update your Pyrk login password. Choose a password with at least 8 characters, one letter, and one number.</p>
      </div>
      <div class="account-lock-icon">🔐</div>
    </div>

    <div class="account-profile-strip">
      <?php if (!empty($user['profile_photo_path'])): ?>
        <img class="avatar-img xl" src="<?= $safe($user['profile_photo_path']) ?>" alt="<?= $safe($user['full_name'] ?? 'User') ?>">
      <?php else: ?>
        <span class="avatar xl"><?= $safe(strtoupper(substr($user['full_name'] ?? 'P', 0, 1))) ?></span>
      <?php endif; ?>
      <div>
        <strong><?= $safe($user['full_name'] ?? 'User') ?></strong>
        <small><?= $safe($user['email'] ?? '') ?> · <?= $safe(str_replace('_', ' ', $user['role_name'] ?? '')) ?></small>
      </div>
    </div>

    <form id="changePasswordForm" class="account-password-form">
      <label>Current password
        <input type="password" name="current_password" autocomplete="current-password" required>
      </label>
      <label>New password
        <input type="password" name="new_password" autocomplete="new-password" required minlength="8">
      </label>
      <label>Confirm new password
        <input type="password" name="confirm_password" autocomplete="new-password" required minlength="8">
      </label>
      <button class="btn" type="submit">Change password</button>
      <p id="accountMsg" class="notice"></p>
    </form>
  </section>
</main>
<script>window.PYRK_API_BASE='../api'; window.PYRK_CSRF='<?= $safe($csrf) ?>';</script>
<script src="assets/js/api.js"></script>
<script src="assets/js/change_password.js"></script>
</body>
</html>
