<?php
// File: admin/change_password.php
ini_set('display_errors', 0);
error_reporting(E_ALL);

require_once '../includes/db_connect.php';
require_once '../includes/security.php';

secureSessionStart();
if (!isset($_SESSION['admin_id']) || !validateAdminSession()) { header("Location: login.php"); exit; }

$msg = ''; $msgType = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    verifyCsrf();
    $current  = $_POST['current_password'] ?? '';
    $new      = $_POST['new_password']     ?? '';
    $confirm  = $_POST['confirm_password'] ?? '';

    try {
        $stmt = $pdo->prepare("SELECT password_hash FROM admin_users WHERE id = ?");
        $stmt->execute([$_SESSION['admin_id']]);
        $user = $stmt->fetch();

        if (!$user || !password_verify($current, $user['password_hash'])) {
            $msg = "Password lama tidak sesuai."; $msgType = 'error';
        } elseif (strlen($new) < 8) {
            $msg = "Password baru minimal 8 karakter."; $msgType = 'error';
        } elseif (!preg_match('/[A-Z]/', $new) || !preg_match('/[0-9]/', $new)) {
            // AUDIT FIX: Minimal 1 huruf kapital dan 1 angka
            $msg = "Password harus mengandung minimal 1 huruf kapital dan 1 angka."; $msgType = 'error';
        } elseif (similar_text(strtolower($new), strtolower($current)) / max(strlen($new), 1) > 0.7) {
            $msg = "Password baru terlalu mirip dengan password lama."; $msgType = 'error';
        } elseif ($new !== $confirm) {
            $msg = "Konfirmasi password tidak cocok."; $msgType = 'error';
        } else {
            $hash = password_hash($new, PASSWORD_BCRYPT);
            $pdo->prepare("UPDATE admin_users SET password_hash = ? WHERE id = ?")->execute([$hash, $_SESSION['admin_id']]);
            $msg = "Password berhasil diubah!"; $msgType = 'success';
        }
    } catch (Exception $e) {
        error_log("Change password error: " . $e->getMessage());
        $msg = "Terjadi kesalahan. Silakan coba lagi."; $msgType = 'error';
    }
}

$page_title = 'Ganti Password';
require 'includes/header.php';
?>
<main class="flex-1 overflow-y-auto p-6 md:p-10 bg-gray-50 w-full">
    <div class="max-w-md mx-auto">
        <h2 class="text-3xl font-bold text-gray-800 mb-8">Ganti Password</h2>

        <?php if ($msg): ?>
        <div class="p-4 rounded-lg mb-6 flex items-center gap-2 <?= $msgType === 'success' ? 'bg-green-100 text-green-700' : 'bg-red-100 text-red-700' ?>">
            <i class="fa-solid <?= $msgType === 'success' ? 'fa-check-circle' : 'fa-triangle-exclamation' ?>"></i>
            <?= htmlspecialchars($msg) ?>
        </div>
        <?php endif; ?>

        <div class="bg-white p-8 rounded-xl shadow-sm border border-gray-200">
            <form method="POST" autocomplete="off">
                <?= csrfInput() ?>
                <div class="mb-5">
                    <label class="block text-sm font-bold mb-2 text-gray-700">Password Lama</label>
                    <input type="password" name="current_password" autocomplete="current-password"
                           class="w-full p-3 border rounded-lg focus:ring-2 focus:ring-blue-400 outline-none" required>
                </div>
                <div class="mb-5">
                    <label class="block text-sm font-bold mb-2 text-gray-700">Password Baru <span class="font-normal text-gray-400">(min. 8 karakter)</span></label>
                    <input type="password" name="new_password" autocomplete="new-password" minlength="8"
                           class="w-full p-3 border rounded-lg focus:ring-2 focus:ring-blue-400 outline-none" required>
                </div>
                <div class="mb-8">
                    <label class="block text-sm font-bold mb-2 text-gray-700">Konfirmasi Password Baru</label>
                    <input type="password" name="confirm_password" autocomplete="new-password" minlength="8"
                           class="w-full p-3 border rounded-lg focus:ring-2 focus:ring-blue-400 outline-none" required>
                </div>
                <button type="submit" class="w-full bg-blue-600 text-white font-bold py-3 rounded-lg hover:bg-blue-700 transition flex items-center justify-center gap-2">
                    <i class="fa-solid fa-lock"></i> Simpan Password Baru
                </button>
            </form>
        </div>
    </div>
</main>
<?php require 'includes/footer.php'; ?>
