<?php
// staff/forgot_password.php — single screen. No SMS gateway, so this notifies
// the restaurant admin to reset the staff member's password.
session_start();
include_once("config/db.php");

$done = false; $error = "";
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $id = trim($_POST['identifier'] ?? '');
    if ($id === '') {
        $error = "Please enter your phone or email.";
    } else {
        $s = $conn->prepare("SELECT id, name, restaurant_id FROM users WHERE (phone=? OR email=?) AND role IN('waiter','staff') LIMIT 1");
        $s->bind_param("ss", $id, $id); $s->execute();
        $u = $s->get_result()->fetch_assoc();
        if ($u) {
            $msg = htmlspecialchars($u['name']) . " requested a password reset. Please set a new password for them in Staff Management.";
            if ($ins = $conn->prepare("INSERT INTO notifications (restaurant_id, type, title, message, related_id) VALUES (?, 'new_order', 'Password Reset Request', ?, ?)")) {
                $rid = (int)$u['restaurant_id']; $sid = (int)$u['id'];
                $ins->bind_param("isi", $rid, $msg, $sid); $ins->execute();
            }
        }
        // neutral response regardless (no account enumeration)
        $done = true;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
<title>Forgot Password — Dabil Staff</title>
<link href="https://fonts.googleapis.com/css2?family=Plus+Jakarta+Sans:wght@400;500;600;700;800&display=swap" rel="stylesheet">
<style>
*,*::before,*::after{box-sizing:border-box;margin:0;padding:0}
:root{--primary:#225AE3;--primary-dark:#1a47b8;--primary-bg:#EEF3FD;--text:#0F172A;--text-muted:#64748B;--text-light:#94A3B8;--bg:#EDF0F5;--border:#E2E8F0;--field-bg:#F7F9FC;--success:#10B981;--font:'Plus Jakarta Sans',-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif}
html,body{height:100%;font-family:var(--font);background:var(--bg);color:var(--text)}
a{text-decoration:none}
.auth-wrap{min-height:100%;display:flex;align-items:center;justify-content:center;padding:calc(env(safe-area-inset-top) + 20px) 16px calc(env(safe-area-inset-bottom) + 24px)}
.auth-card{width:100%;max-width:420px;background:#fff;border-radius:24px;padding:28px 22px;box-shadow:0 12px 40px rgba(15,23,42,.08)}
.auth-back{width:34px;height:34px;border-radius:50%;background:var(--primary-bg);color:var(--primary);display:flex;align-items:center;justify-content:center;margin-bottom:18px}
h1{font-size:1.5rem;font-weight:800;letter-spacing:-.03em;margin-bottom:6px}
.sub{font-size:.9rem;color:var(--text-muted);margin-bottom:22px;line-height:1.5}
.f-label{display:block;font-size:.84rem;font-weight:700;margin-bottom:8px}
.field input{width:100%;height:54px;border:1.5px solid var(--border);background:var(--field-bg);border-radius:14px;padding:0 16px;font-size:max(16px,.95rem);font-family:var(--font);outline:none;margin-bottom:18px}
.field input:focus{border-color:var(--primary);background:#fff;box-shadow:0 0 0 3px rgba(34,90,227,.1)}
.btn-primary{width:100%;height:54px;border:none;border-radius:14px;background:var(--primary);color:#fff;font-weight:700;font-size:1rem;cursor:pointer;box-shadow:0 8px 22px rgba(34,90,227,.3)}
.btn-primary:active{background:var(--primary-dark)}
.banner-err{background:#FEF2F2;border:1px solid #FECACA;color:#B91C1C;font-size:.85rem;border-radius:12px;padding:12px 14px;margin-bottom:16px;text-align:center}
.success{text-align:center}
.success .ic{width:64px;height:64px;border-radius:50%;background:#ECFDF5;color:var(--success);display:flex;align-items:center;justify-content:center;margin:0 auto 16px}
.success h2{font-size:1.15rem;font-weight:800;margin-bottom:8px}
.success p{font-size:.88rem;color:var(--text-muted);line-height:1.6}
.back-link{display:block;text-align:center;color:var(--primary);font-weight:700;font-size:.9rem;margin-top:20px}
</style>
</head>
<body>
<div class="auth-wrap">
  <div class="auth-card">
    <?php if ($done): ?>
      <div class="success">
        <div class="ic"><svg width="30" height="30" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"><path d="M22 11.08V12a10 10 0 11-5.93-9.14"/><polyline points="22 4 12 14.01 9 11.01"/></svg></div>
        <h2>Request sent</h2>
        <p>If that account exists, we've alerted your restaurant manager to reset your password. They'll share new login details with you.</p>
        <a href="login.php" class="back-link">Back to sign in</a>
      </div>
    <?php else: ?>
      <a href="login.php" class="auth-back" aria-label="Back"><svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round"><polyline points="15 18 9 12 15 6"/></svg></a>
      <h1>Forgot password?</h1>
      <p class="sub">Enter your phone or email and we'll ask your restaurant manager to reset it for you.</p>
      <?php if ($error): ?><div class="banner-err"><?php echo htmlspecialchars($error); ?></div><?php endif; ?>
      <form method="POST">
        <label class="f-label">Phone or Email</label>
        <div class="field"><input type="text" name="identifier" placeholder="Phone number or email" required></div>
        <button type="submit" class="btn-primary">Send Request</button>
      </form>
    <?php endif; ?>
  </div>
</div>
</body>
</html>
