<?php
/**
 * Profil / Passwort-Änderung — Valu-Basic v2.0
 * Single-User: Nur Passwort und Theme ändern
 */

require_once __DIR__ . '/config.php';
requireBackendAccess();

$pageTitle = 'Mein Profil';
$message = '';
$error = '';

// POST: Passwort ändern
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    validateRequest();

    $action = $_POST['action'] ?? '';

    if ($action === 'change_password') {
        $current  = $_POST['current_password'] ?? '';
        $new      = $_POST['new_password'] ?? '';
        $confirm  = $_POST['confirm_password'] ?? '';

        $user = $pdo->query("SELECT * FROM users WHERE id = " . (int)$_SESSION['user_id'])->fetch();

        if (!$user || !password_verify($current, $user['password'])) {
            $error = 'Aktuelles Passwort ist falsch.';
        } elseif (strlen($new) < 8) {
            $error = 'Neues Passwort muss mindestens 8 Zeichen haben.';
        } elseif ($new !== $confirm) {
            $error = 'Passwörter stimmen nicht überein.';
        } else {
            $hash = password_hash($new, PASSWORD_ARGON2ID);
            $pdo->prepare("UPDATE users SET password = ? WHERE id = ?")->execute([$hash, $_SESSION['user_id']]);
            $message = 'Passwort erfolgreich geändert.';
        }
    }

    if ($action === 'change_theme') {
        $theme = $_POST['theme'] ?? 'cloud';
        $allowed = ['cloud','dark','navy','emerald','forest','cherry','lavender','midnight','mint','ocean','sand','sunset','glass'];
        if (in_array($theme, $allowed)) {
            $pdo->prepare("UPDATE users SET theme = ? WHERE id = ?")->execute([$theme, $_SESSION['user_id']]);
            $_SESSION['theme'] = $theme;
            $message = 'Theme gespeichert.';
        }
    }
}

$user = $pdo->query("SELECT * FROM users WHERE id = " . (int)$_SESSION['user_id'])->fetch();

include __DIR__ . '/layout/header_next_page.php';
?>

<div class="vs-page-content">
    <div class="vs-page-header">
        <h1>👤 <?php echo $pageTitle; ?></h1>
    </div>

    <?php if ($message): ?>
        <div class="alert alert-success"><?php echo htmlspecialchars($message); ?></div>
    <?php endif; ?>
    <?php if ($error): ?>
        <div class="alert alert-danger"><?php echo htmlspecialchars($error); ?></div>
    <?php endif; ?>

    <div class="card mb-4">
        <div class="card-header"><h3>🔑 Passwort ändern</h3></div>
        <div class="card-body">
            <form method="POST">
                <?php echo Security::getCSRFInput(); ?>
                <input type="hidden" name="action" value="change_password">
                <div class="form-group">
                    <label>Aktuelles Passwort</label>
                    <input type="password" name="current_password" class="form-control" required>
                </div>
                <div class="form-group">
                    <label>Neues Passwort (min. 8 Zeichen)</label>
                    <input type="password" name="new_password" class="form-control" required minlength="8">
                </div>
                <div class="form-group">
                    <label>Neues Passwort bestätigen</label>
                    <input type="password" name="confirm_password" class="form-control" required>
                </div>
                <button type="submit" class="btn btn-primary">Passwort ändern</button>
            </form>
        </div>
    </div>

    <div class="card">
        <div class="card-header"><h3>🎨 Theme</h3></div>
        <div class="card-body">
            <form method="POST">
                <?php echo Security::getCSRFInput(); ?>
                <input type="hidden" name="action" value="change_theme">
                <div class="form-group">
                    <select name="theme" class="form-control" onchange="this.form.submit()">
                        <?php foreach (['cloud','dark','navy','emerald','forest','cherry','lavender','midnight','mint','ocean','sand','sunset','glass'] as $t): ?>
                            <option value="<?php echo $t; ?>" <?php echo ($user['theme'] ?? 'cloud') === $t ? 'selected' : ''; ?>>
                                <?php echo ucfirst($t); ?>
                            </option>
                        <?php endforeach; ?>
                    </select>
                </div>
            </form>
        </div>
    </div>

    <!-- Upgrade-Hinweis -->
    <?php if (defined('VALU_BASIC_MODE') && VALU_BASIC_MODE): ?>
    <div class="card mt-4" style="border-color: #f0a500;">
        <div class="card-body" style="text-align:center; padding: 2rem;">
            <h3>🚀 Zur Vollversion upgraden</h3>
            <p>ValuSafe bietet Multi-User, Versicherungsmodul, Barcode-Lookup und mehr.</p>
            <a href="<?php echo defined('VALUSAFE_UPGRADE_URL') ? VALUSAFE_UPGRADE_URL : '#'; ?>"
               target="_blank" class="btn btn-primary">
                ValuSafe kennenlernen →
            </a>
        </div>
    </div>
    <?php endif; ?>
</div>

<?php include __DIR__ . '/layout/footer_next_page.php'; ?>
