<?php
session_start();
include 'includes/header.php'; 
include 'includes/sidebar.php';
require '../includes/db.php';

if (!isset($_SESSION['admin_id'])) {
    die("Unauthorized access");
}

$admin_id = $_SESSION['admin_id'];
$message = "";
$type = "";

if ($_SERVER['REQUEST_METHOD'] == 'POST') {

    $current_password = $_POST['current_password'];
    $new_password     = $_POST['new_password'];
    $confirm_password = $_POST['confirm_password'];

    // ✅ Validate
    if ($new_password !== $confirm_password) {
        $message = "New passwords do not match!";
        $type = "danger";
    } else {

        $stmt = $conn->prepare("SELECT password FROM admins WHERE id = ?");
        $stmt->bind_param("i", $admin_id);
        $stmt->execute();
        $result = $stmt->get_result();
        $admin = $result->fetch_assoc();

        if (!$admin) {
            $message = "Admin not found!";
            $type = "danger";
        } elseif (!password_verify($current_password, $admin['password'])) {
            $message = "Current password is incorrect!";
            $type = "danger";
        } else {

            $new_hashed_password = password_hash($new_password, PASSWORD_DEFAULT);

            $update = $conn->prepare("UPDATE admins SET password = ? WHERE id = ?");
            $update->bind_param("si", $new_hashed_password, $admin_id);

            if ($update->execute()) {
                $message = "Password updated successfully!";
                $type = "success";
            } else {
                $message = "Error updating password!";
                $type = "danger";
            }
        }
    }
}
?>

<div class="container mt-5">
    <div class="row justify-content-center">
        <div class="col-md-6">

            <div class="card shadow-lg border-0">
                <div class="card-header bg-dark text-white text-center">
                    <h4>🔐 Change Admin Password</h4>
                </div>

                <div class="card-body">

                    <?php if ($message): ?>
                        <div class="alert alert-<?php echo $type; ?>">
                            <?php echo $message; ?>
                        </div>
                    <?php endif; ?>

                    <form method="POST">

                        <div class="mb-3">
                            <label class="form-label">Current Password</label>
                            <input type="password" name="current_password" class="form-control" required>
                        </div>

                        <div class="mb-3">
                            <label class="form-label">New Password</label>
                            <input type="password" name="new_password" class="form-control" required>
                        </div>

                        <div class="mb-3">
                            <label class="form-label">Confirm New Password</label>
                            <input type="password" name="confirm_password" class="form-control" required>
                        </div>

                        <button type="submit" class="btn btn-primary w-100">
                            Update Password
                        </button>

                    </form>

                </div>
            </div>

        </div>
    </div>
</div>

<?php include 'includes/footer.php'; ?>