<?php
session_start();
require 'db_connect.php';

// Redirect if not logged in
if (!isset($_SESSION['user_id'])) {
    header("Location: login_register.php");
    exit;
}

$errors = [];

// Handle password change
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $current_pass = $_POST['current_password'];
    $new_pass = $_POST['new_password'];
    $confirm_pass = $_POST['confirm_password'];

    $stmt = $conn->prepare("SELECT password_hash FROM Users WHERE user_id=?");
    $stmt->bind_param("i", $_SESSION['user_id']);
    $stmt->execute();
    $stmt->bind_result($hash);
    $stmt->fetch();
    $stmt->close();

    if (!password_verify($current_pass, $hash)) {
        $errors[] = "Current password is incorrect.";
    } elseif ($new_pass !== $confirm_pass) {
        $errors[] = "New passwords do not match.";
    } else {
        $new_hash = password_hash($new_pass, PASSWORD_DEFAULT);
        $update_stmt = $conn->prepare("UPDATE Users SET password_hash=? WHERE user_id=?");
        $update_stmt->bind_param("si", $new_hash, $_SESSION['user_id']);
        if ($update_stmt->execute()) {
            // Logout user and redirect to login page after successful password change
            session_unset();
            session_destroy();
            header("Location: login_register.php?msg=PasswordChanged");
            exit;
        } else {
            $errors[] = "Error updating password.";
        }
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <title>Profile</title>
    <link href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css" rel="stylesheet">
    <style>
        body {
            background-color: #f4f6f9;
        }
        .profile-card {
            max-width: 500px;
            margin: auto;
            margin-top: 50px;
            padding: 30px;
            border-radius: 15px;
            background: white;
            box-shadow: 0px 4px 15px rgba(0,0,0,0.1);
        }
        .card-title {
            font-weight: bold;
            color: #007bff;
        }
    </style>
</head>
<body>

<div class="profile-card">
    <h3 class="card-title text-center">Profile - <?php echo htmlspecialchars($_SESSION['username']); ?></h3>
    <hr>

    <?php if (!empty($errors)) { ?>
        <div class="alert alert-danger"><?php echo implode("<br>", $errors); ?></div>
    <?php } ?>

    <form method="POST">
        <div class="mb-3">
            <label class="form-label">Current Password</label>
            <input type="password" name="current_password" class="form-control" required>
        </div>
        <div class="mb-3">
            <label class="form-label">New Password</label>
            <input type="password" name="new_password" class="form-control" required>
        </div>
        <div class="mb-3">
            <label class="form-label">Confirm New Password</label>
            <input type="password" name="confirm_password" class="form-control" required>
        </div>
        <div class="d-flex justify-content-between">
            <a href="index.php" class="btn btn-secondary">⬅ Back</a>
            <button type="submit" class="btn btn-primary">Change Password</button>
        </div>
    </form>
</div>

</body>
</html>

