<?php
// pages/force_change_pw.php — 임시 비밀번호 발급 후 강제 변경
require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../config/auth.php';
if (!isLoggedIn()) { header('Location: '.BASE_URL.'index.php'); exit; }

$db = (new Database())->getConnection();
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $newPw = $_POST['new_password'] ?? '';
    $newPw2 = $_POST['new_password2'] ?? '';
    if (strlen($newPw) < 6) { $error = '비밀번호는 6자 이상이어야 합니다.'; }
    elseif ($newPw !== $newPw2) { $error = '비밀번호가 일치하지 않습니다.'; }
    else {
        $hash = password_hash($newPw, PASSWORD_DEFAULT);
        $db->prepare("UPDATE user_account SET password_hash=?, must_change_pw=0, pw_changed_at=NOW() WHERE user_id=?")
           ->execute([$hash, $_SESSION['user_id']]);
        $_SESSION['must_change_pw'] = 0;
        header('Location: '.BASE_URL.'pages/dashboard.php'); exit;
    }
}
?>
<!DOCTYPE html><html lang="ko"><head><meta charset="UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1.0">
<title>비밀번호 변경</title><link rel="stylesheet" href="<?=BASE_URL?>assets/css/style.css">
<link href="https://fonts.googleapis.com/css2?family=Noto+Sans+KR:wght@400;500;600;700&display=swap" rel="stylesheet">
</head><body>
<div class="login-page"><div class="login-card">
<h1>🔒 비밀번호 변경</h1>
<p class="subtitle">임시 비밀번호가 발급되었습니다. 새 비밀번호를 설정해주세요.</p>
<div class="alert alert-warning">⚠ 새 비밀번호 설정 전까지 시스템 이용이 제한됩니다.</div>
<?php if ($error): ?><div class="alert alert-danger"><?= htmlspecialchars($error) ?></div><?php endif; ?>
<form method="POST">
<div class="form-group"><label>새 비밀번호 <span class="required">*</span></label><input type="password" name="new_password" required minlength="6" placeholder="6자 이상" autofocus></div>
<div class="form-group"><label>새 비밀번호 확인 <span class="required">*</span></label><input type="password" name="new_password2" required minlength="6"></div>
<button type="submit" class="btn btn-primary">비밀번호 변경</button>
</form></div></div></body></html>
