<?php
require_once __DIR__ . '/../_pdo_db_connect.php';
require_once __DIR__ . '/../_response.php';
$input = json_decode(file_get_contents('php://input'), true);
$email = $input['email'] ?? '';
if (!$email) json_res(['error'=>'missing_email'],400);
$pdo = get_db();
$stmt = $pdo->prepare('SELECT id FROM as_team_auth WHERE email=:e LIMIT 1');
$stmt->execute([':e'=>$email]);
$user = $stmt->fetch();
if (!$user) json_res(['status'=>'ok']); // do not reveal existence
$token = bin2hex(random_bytes(24));
$expires = date('Y-m-d H:i:s', time()+3600);
$pdo->prepare('INSERT INTO password_resets(user_id,token,expires) VALUES(?,?,?)')
    ->execute([$user['id'],$token,$expires]);
// TODO: send email with link
json_res(['status'=>'ok']);
