<?php
require_once __DIR__ . '/../_pdo_db_connect.php';
require_once __DIR__ . '/../_response.php';
$input = json_decode(file_get_contents('php://input'), true);
$token = $input['token'] ?? '';
$newpass = $input['new_password'] ?? '';
if (!$token || !$newpass) json_res(['error'=>'missing_fields'],400);
$pdo = get_db();
$stmt = $pdo->prepare('SELECT user_id,expires FROM password_resets WHERE token=? LIMIT 1');
$stmt->execute([$token]);
$row = $stmt->fetch();
if (!$row || strtotime($row['expires']) < time()) json_res(['error'=>'invalid_token'],400);
$hash = password_hash($newpass, PASSWORD_DEFAULT);
$pdo->prepare('UPDATE as_team_auth SET password_hash=? WHERE id=?')->execute([$hash,$row['user_id']]);
$pdo->prepare('DELETE FROM password_resets WHERE token=?')->execute([$token]);
json_res(['status'=>'ok']);
