<?php
require_once __DIR__.'/../inc/config.php';
require_once __DIR__.'/../inc/db.php';
require_once __DIR__.'/../inc/csrf.php';

// ... require_once ...
if(empty($_SESSION['admin_id'])){ header('Location: login.php'); exit; } // 1. Semak login dahulu
if ($_SESSION['admin_role'] !== 'admin') { // 2. Kemudian baru semak role
    exit('Akses disekat. Anda tiada kebenaran untuk melihat halaman ini.');
}

if(empty($_SESSION['admin_id'])){ header('Location: login.php'); exit; }
$msg='';
if($_SERVER['REQUEST_METHOD']==='POST'){
  if(!csrf_verify()) $msg='CSRF gagal';
  else{
    $cur=$_POST['current']??''; $n1=$_POST['new1']??''; $n2=$_POST['new2']??'';
    if($n1!==$n2) $msg='Kata laluan baru tidak sepadan'; elseif(strlen($n1)<10) $msg='Minimum 10 aksara';
    else{
      $st=db()->prepare("SELECT * FROM admins WHERE id=?"); $st->execute([$_SESSION['admin_id']]); $a=$st->fetch();
      if(!$a || !password_verify($cur,$a['password_hash'])) $msg='Kata laluan semasa salah';
      else{ $hash=password_hash($n1, PASSWORD_BCRYPT, ['cost'=>12]); $up=db()->prepare("UPDATE admins SET password_hash=? WHERE id=?"); $up->execute([$hash,$_SESSION['admin_id']]); $msg='Kata laluan berjaya dikemaskini'; }
    }
  }
}
?>
<!doctype html>
<html>
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <link rel="stylesheet" href="../public/assets/css/style.css">
    <title>Tukar Kata Laluan</title>
    <style>
        .admin-wrapper { display: flex; align-items: flex-start; gap: 24px; }
        .admin-sidebar { width: 220px; flex-shrink: 0; }
        .admin-content { flex-grow: 1; }
        
        /* --- KEMAS KINI CSS UNTUK BORANG --- */
        .admin-content form label {
            display: block;
            margin-bottom: 16px;
            font-weight: 600;
        }
        .admin-content form input {
            width: 100%;
            padding: 10px;
            border: 1px solid #d1d5db;
            border-radius: 8px;
            margin-top: 6px;
            box-sizing: border-box;
        }
    </style>
</head>
<body>
<div class="container">
    <div class="admin-wrapper">
        <aside class="admin-sidebar">
            <?php require_once '_menu.php'; ?>
        </aside>
        <main class="admin-content">
            <h1>Tukar Kata Laluan</h1>
            <div class="card">
                <?php if($msg):?><p class="notice" style="background-color: #eef2ff; color: #1e293b;"><?=$msg?></p><?php endif;?>
                <form method="post">
                    <?=csrf_field()?>
                    <label>Kata Laluan Semasa
                        <input type="password" name="current" required>
                    </label>
                    <label>Kata Laluan Baru
                        <input type="password" name="new1" required>
                    </label>
                    <label>Sahkan Kata Laluan Baru
                        <input type="password" name="new2" required>
                    </label>
                    <button class="cta">Simpan Perubahan</button>
                </form>
            </div>
        </main>
    </div>
</div>
</body>
</html>