<?php
header('Content-Type: application/json; charset=utf-8');
include 'config.php';

// Show PHP errors for debugging (remove in production)
error_reporting(E_ALL);
ini_set('display_errors', 1);

// 1️⃣ Detect if JSON POST or Form-data
$input = json_decode(file_get_contents('php://input'), true);

// Use JSON if available, else fallback to $_POST
$email        = trim($input['email'] ?? $_POST['email'] ?? '');
$reset_token  = trim($input['reset_token'] ?? $_POST['reset_token'] ?? '');
$new_password = trim($input['new_password'] ?? $_POST['new_password'] ?? '');

// 2️⃣ Validate required fields
if (!$email || !$reset_token || !$new_password) {
    echo json_encode([
        'success' => false,
        'message' => 'সব ফিল্ড দিতে হবে।'
    ]);
    exit;
}

// 3️⃣ Check if reset_token is valid and unused
$stmt = $conn->prepare("
    SELECT id FROM password_resets
    WHERE email=? AND reset_token=? AND used=0
    ORDER BY created_at DESC LIMIT 1
");
$stmt->bind_param("ss", $email, $reset_token);
$stmt->execute();
$result = $stmt->get_result();

if ($result->num_rows == 0) {
    echo json_encode([
        'success' => false,
        'message' => 'Invalid token or already used'
    ]);
    exit;
}

$row = $result->fetch_assoc();

// 4️⃣ 🔐 MD5 hash new password and update users table
$new_password_hash = md5($new_password);

$stmt2 = $conn->prepare("UPDATE users SET password=? WHERE email=?");
$stmt2->bind_param("ss", $new_password_hash, $email);
$stmt2->execute();

// 5️⃣ Mark reset_token as used
$stmt3 = $conn->prepare("UPDATE password_resets SET used=1 WHERE id=?");
$stmt3->bind_param("i", $row['id']);
$stmt3->execute();

// 6️⃣ Success response
echo json_encode([
    'success' => true,
    'message' => 'Password reset successfully'
]);
exit;
?>