reset-password.php

<?php

declare(strict_types=1);

require __DIR__ . '/src/bootstrap.php';

use App\Services\AuthService;

if (is_authenticated()) {
    redirect('account.php');
}

$token = trim((string) ($_GET['token'] ?? $_POST['token'] ?? ''));
$flashError = null;
$flashSuccess = null;

if (is_post_request()) {
    if (!verify_csrf($_POST['_csrf'] ?? null, 'reset_password')) {
        $flashError = copy_text('messages.common.security_token_expired', 'Security token expired. Try again.');
    } else {
        $auth = new AuthService();
        $result = $auth->resetPassword(
            $token,
            (string) ($_POST['password'] ?? ''),
            (string) ($_POST['password_confirmation'] ?? '')
        );

        if ($result['success']) {
            $flashSuccess = $result['message'];
        } else {
            $flashError = $result['message'];
        }
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title><?= e(copy_text('auth.reset.title', 'New password')); ?> | <?= e(config('app.name')); ?></title>
    <link rel="stylesheet" href="<?= e(asset('assets/css/app.css')); ?>">
    <?= public_head_markup(); ?>
</head>
<body class="<?= e(page_lock_class('auth-body')); ?>">
    <main class="auth-layout">
        <section class="auth-intro">
            <span class="eyebrow"><?= e(copy_text('auth.reset.eyebrow', 'RESET')); ?></span>
            <h1><?= e(copy_text('auth.reset.heading', 'Choose a new password')); ?></h1>
            <p><?= e(copy_text('auth.reset.text', 'Use a strong password with at least 8 characters.')); ?></p>
            <a class="text-link" href="<?= e(base_url('login.php')); ?>"><?= e(copy_text('common.back_to_sign_in', 'Back to sign in')); ?></a>
        </section>
        <section class="auth-card">
            <?php if ($flashError): ?>
                <div class="flash flash--error"><?= e((string) $flashError); ?></div>
            <?php endif; ?>
            <?php if ($flashSuccess): ?>
                <div class="flash flash--success"><?= e((string) $flashSuccess); ?></div>
                <a class="button" href="<?= e(base_url('login.php')); ?>"><?= e(copy_text('auth.reset.success_cta', 'Go to sign in')); ?></a>
            <?php elseif ($token === ''): ?>
                <div class="notice-card">
                    <strong><?= e(copy_text('auth.reset.invalid_title', 'Reset link unavailable')); ?></strong>
                    <p><?= e(copy_text('auth.reset.invalid_text', 'This reset link is not valid anymore. Request a new one and try again.')); ?></p>
                </div>
            <?php else: ?>
                <form method="post" class="auth-form">
                    <?= csrf_input('reset_password'); ?>
                    <input type="hidden" name="token" value="<?= e($token); ?>">
                    <label>
                        <span><?= e(copy_text('auth.reset.password', 'New password')); ?></span>
                        <input type="password" name="password" required>
                    </label>
                    <label>
                        <span><?= e(copy_text('auth.reset.password_confirmation', 'Confirm new password')); ?></span>
                        <input type="password" name="password_confirmation" required>
                    </label>
                    <button class="button" type="submit"><?= e(copy_text('auth.reset.submit', 'Save new password')); ?></button>
                </form>
            <?php endif; ?>
        </section>
    </main>

    <?php require ROOT_PATH . '/partials/public-footer.php'; ?>

    <div id="cookie-notice-root"></div>
    <div id="age-gate-root"></div>

    <script<?= nonce_attr(); ?>>
        window.__VIDEW__ = <?= page_bootstrap(default_bootstrap_payload('reset-password')); ?>;
    </script>
    <?= gui_runtime_tags(); ?>
</body>
</html>