<?php

session_start();

include('dbConnect.php');
include('session.php');

date_default_timezone_set('Pacific/Auckland');

/*
|--------------------------------------------------------------------------
| SESSION DETAILS
|--------------------------------------------------------------------------
*/

$LoginMemberID     = (int)($_SESSION['LoginMemberID'] ?? 0);
$LoginAccessLevel  = $_SESSION['LoginAccessLevel'] ?? 0;
$user_first        = $_SESSION['u_first'] ?? '';
$user_surname      = $_SESSION['u_last'] ?? '';
$user_email        = $_SESSION['u_email'] ?? '';

if ($LoginMemberID <= 0) {
    header("Location: login.php?Please-login");
    exit();
}

/*
|--------------------------------------------------------------------------
| CSRF PROTECTION
|--------------------------------------------------------------------------
*/

if (
    !isset($_SESSION['change_password_csrf']) ||
    empty($_SESSION['change_password_csrf'])
) {
    $_SESSION['change_password_csrf'] = bin2hex(random_bytes(32));
}

$csrf_token = $_SESSION['change_password_csrf'];

/*
|--------------------------------------------------------------------------
| VARIABLES
|--------------------------------------------------------------------------
*/

$password_error   = '';
$password_success = false;

/*
|--------------------------------------------------------------------------
| PASSWORD CHANGE
|--------------------------------------------------------------------------
*/

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['submit'])) {

    /*
    |--------------------------------------------------------------------------
    | CHECK CSRF TOKEN
    |--------------------------------------------------------------------------
    */

    $posted_token = $_POST['csrf_token'] ?? '';

    if (
        empty($posted_token) ||
        !hash_equals($_SESSION['change_password_csrf'], $posted_token)
    ) {
        $password_error =
            'Your session could not be verified. Please refresh the page and try again.';
    }

    /*
    |--------------------------------------------------------------------------
    | GET PASSWORDS
    |--------------------------------------------------------------------------
    */

    $new_password     = $_POST['user_pass_1'] ?? '';
    $confirm_password = $_POST['confirm_password'] ?? '';

    /*
    |--------------------------------------------------------------------------
    | SERVER-SIDE PASSWORD VALIDATION
    |--------------------------------------------------------------------------
    */

    if ($password_error === '') {

        if ($new_password === '' || $confirm_password === '') {

            $password_error =
                'Please enter and confirm your new password.';

        } elseif ($new_password !== $confirm_password) {

            $password_error =
                'The passwords do not match.';

        } elseif (strlen($new_password) < 8) {

            $password_error =
                'Your password must contain at least 8 characters.';

        } elseif (!preg_match('/[a-z]/', $new_password)) {

            $password_error =
                'Your password must contain at least one lowercase letter.';

        } elseif (!preg_match('/[A-Z]/', $new_password)) {

            $password_error =
                'Your password must contain at least one uppercase letter.';

        } elseif (!preg_match('/[0-9]/', $new_password)) {

            $password_error =
                'Your password must contain at least one number.';
        }
    }

    /*
    |--------------------------------------------------------------------------
    | GET CURRENT PASSWORD
    |--------------------------------------------------------------------------
    */

    $current_password_hash = '';

    if ($password_error === '') {

        $stmt = $mysqli->prepare("
            SELECT user_pass
            FROM user
            WHERE user_id = ?
            LIMIT 1
        ");

        if (!$stmt) {
            $password_error = 'Unable to check your account.';
        } else {

            $stmt->bind_param("i", $LoginMemberID);
            $stmt->execute();

            $result = $stmt->get_result();
            $current_user = $result->fetch_assoc();

            $stmt->close();

            if (!$current_user) {

                $password_error =
                    'Unable to find your user account.';

            } else {

                $current_password_hash =
                    $current_user['user_pass'] ?? '';
            }
        }
    }

    /*
    |--------------------------------------------------------------------------
    | DO NOT ALLOW CURRENT PASSWORD
    |--------------------------------------------------------------------------
    */

    if (
        $password_error === '' &&
        !empty($current_password_hash) &&
        password_verify(
            $new_password,
            $current_password_hash
        )
    ) {

        $password_error =
            'You cannot reuse your current password. Please choose a different password.';
    }

    /*
    |--------------------------------------------------------------------------
    | GET PASSWORD HISTORY
    |--------------------------------------------------------------------------
    */

    $password_history = [];

    if ($password_error === '') {

        $stmt = $mysqli->prepare("
            SELECT
                data_id,
                data_value,
                data_date,
                password_slot
            FROM user_data
            WHERE data_user_id = ?
            AND data_type = 'new-password'
            ORDER BY data_date DESC, data_id DESC
        ");

        if (!$stmt) {

            $password_error =
                'Unable to check your password history.';

        } else {

            $stmt->bind_param(
                "i",
                $LoginMemberID
            );

            $stmt->execute();

            $result = $stmt->get_result();

            while ($row = $result->fetch_assoc()) {
                $password_history[] = $row;
            }

            $stmt->close();
        }
    }

    /*
    |--------------------------------------------------------------------------
    | PURGE ANY PASSWORDS OLDER THAN THE NEWEST 6
    |--------------------------------------------------------------------------
    */

    if (
        $password_error === '' &&
        count($password_history) > 6
    ) {

        $records_to_delete =
            array_slice($password_history, 6);

        $delete_stmt = $mysqli->prepare("
            UPDATE user_data
            SET
                data_type = 'old-password-purged',
                password_slot = NULL
            WHERE data_id = ?
            AND data_user_id = ?
            AND data_type = 'new-password'
        ");

        if ($delete_stmt) {

            foreach ($records_to_delete as $record) {

                $delete_id =
                    (int)$record['data_id'];

                $delete_stmt->bind_param(
                    "ii",
                    $delete_id,
                    $LoginMemberID
                );

                $delete_stmt->execute();
            }

            $delete_stmt->close();
        }

        $password_history =
            array_slice($password_history, 0, 6);
    }

    /*
    |--------------------------------------------------------------------------
    | ASSIGN PASSWORD SLOTS TO EXISTING RECORDS
    |--------------------------------------------------------------------------
    */

    if ($password_error === '') {

        $used_slots = [];

        foreach ($password_history as &$history_record) {

            $slot = (int)($history_record['password_slot'] ?? 0);

            if ($slot >= 1 && $slot <= 6 && !in_array($slot, $used_slots, true)) {
                $used_slots[] = $slot;
                continue;
            }

            $new_slot = 1;
            while (in_array($new_slot, $used_slots, true) && $new_slot <= 6) {
                $new_slot++;
            }

            if ($new_slot > 6) {
                $new_slot = 6;
            }

            $data_id = (int)$history_record['data_id'];

            $slot_stmt = $mysqli->prepare("
                UPDATE user_data
                SET password_slot = ?
                WHERE data_id = ?
                AND data_user_id = ?
                AND data_type = 'new-password'
            ");

            if ($slot_stmt) {

                $slot_stmt->bind_param(
                    "iii",
                    $new_slot,
                    $data_id,
                    $LoginMemberID
                );

                $slot_stmt->execute();
                $slot_stmt->close();

                $history_record['password_slot'] = $new_slot;
                $used_slots[] = $new_slot;
            }
        }

        unset($history_record);
    }

    /*
    |--------------------------------------------------------------------------
    | CHECK AGAINST PREVIOUS 6 PASSWORDS
    |--------------------------------------------------------------------------
    */

    if ($password_error === '') {

        foreach ($password_history as $old_password) {

            $old_hash =
                $old_password['data_value'] ?? '';

            if (
                !empty($old_hash) &&
                password_verify(
                    $new_password,
                    $old_hash
                )
            ) {

                $password_error =
                    'You cannot reuse any of your last 6 passwords. Please choose a different password.';

                break;
            }
        }
    }

    /*
    |--------------------------------------------------------------------------
    | SAVE NEW PASSWORD
    |--------------------------------------------------------------------------
    */

    if ($password_error === '') {

        $new_hash =
            password_hash(
                $new_password,
                PASSWORD_DEFAULT
            );

        $mysqli->begin_transaction();

        try {

            /*
            |--------------------------------------------------------------------------
            | UPDATE CURRENT PASSWORD
            |--------------------------------------------------------------------------
            */

            $stmt = $mysqli->prepare("
                UPDATE user
                SET
                    user_updated_date = NOW(),
                    user_pass = ?
                WHERE user_id = ?
            ");

            if (!$stmt) {
                throw new Exception(
                    'Unable to prepare password update.'
                );
            }

            $stmt->bind_param(
                "si",
                $new_hash,
                $LoginMemberID
            );

            if (!$stmt->execute()) {
                throw new Exception(
                    'Unable to update password.'
                );
            }

            $stmt->close();

            /*
            |--------------------------------------------------------------------------
            | GET CURRENT PASSWORD HISTORY AGAIN
            |--------------------------------------------------------------------------
            */

            $stmt = $mysqli->prepare("
                SELECT
                    data_id,
                    password_slot,
                    data_date
                FROM user_data
                WHERE data_user_id = ?
                AND data_type = 'new-password'
                ORDER BY data_date ASC, data_id ASC
            ");

            if (!$stmt) {
                throw new Exception(
                    'Unable to prepare password history.'
                );
            }

            $stmt->bind_param(
                "i",
                $LoginMemberID
            );

            $stmt->execute();

            $result =
                $stmt->get_result();

            $password_records = [];

            while ($row = $result->fetch_assoc()) {
                $password_records[] = $row;
            }

            $stmt->close();

            /*
            |--------------------------------------------------------------------------
            | FEWER THAN 6 PASSWORD HISTORY RECORDS
            |--------------------------------------------------------------------------
            */

            if (count($password_records) < 6) {

                $used_slots = [];

                foreach ($password_records as $record) {

                    $record_slot =
                        (int)($record['password_slot'] ?? 0);

                    if (
                        $record_slot >= 1 &&
                        $record_slot <= 6
                    ) {
                        $used_slots[] =
                            $record_slot;
                    }
                }

                $new_slot = 1;

                while (
                    in_array(
                        $new_slot,
                        $used_slots,
                        true
                    ) &&
                    $new_slot <= 6
                ) {
                    $new_slot++;
                }

                if ($new_slot > 6) {
                    $new_slot = 6;
                }

                $stmt = $mysqli->prepare("
                    INSERT INTO user_data
                    (
                        data_type,
                        data_value,
                        data_user_id,
                        data_date,
                        password_slot
                    )
                    VALUES
                    (
                        'new-password',
                        ?,
                        ?,
                        NOW(),
                        ?
                    )
                ");

                if (!$stmt) {
                    throw new Exception(
                        'Unable to create password history.'
                    );
                }

                $stmt->bind_param(
                    "sii",
                    $new_hash,
                    $LoginMemberID,
                    $new_slot
                );

                if (!$stmt->execute()) {
                    throw new Exception(
                        'Unable to save password history.'
                    );
                }

                $stmt->close();

            } else {

                /*
                |--------------------------------------------------------------------------
                | ALREADY HAVE 6 - REUSE OLDEST SLOT
                |--------------------------------------------------------------------------
                */

                $oldest_record =
                    $password_records[0];

                $oldest_id =
                    (int)$oldest_record['data_id'];

                $oldest_slot =
                    (int)($oldest_record['password_slot'] ?? 0);

                if (
                    $oldest_slot < 1 ||
                    $oldest_slot > 6
                ) {
                    $oldest_slot = 1;
                }

                $stmt = $mysqli->prepare("
                    UPDATE user_data
                    SET
                        data_value = ?,
                        data_date = NOW(),
                        password_slot = ?
                    WHERE data_id = ?
                    AND data_user_id = ?
                    AND data_type = 'new-password'
                ");

                if (!$stmt) {
                    throw new Exception(
                        'Unable to update password history.'
                    );
                }

                $stmt->bind_param(
                    "siii",
                    $new_hash,
                    $oldest_slot,
                    $oldest_id,
                    $LoginMemberID
                );

                if (!$stmt->execute()) {
                    throw new Exception(
                        'Unable to update password history.'
                    );
                }

                $stmt->close();
            }

            /*
            |--------------------------------------------------------------------------
            | REMOVE ADMIN PASSWORD RESET REQUIREMENT
            |--------------------------------------------------------------------------
            */

            $stmt = $mysqli->prepare("
                UPDATE user_data
                SET
                    data_type = 'password-reset-completed',
                    data_date = NOW()
                WHERE data_user_id = ?
                AND data_type = 'password-reset-required'
            ");

            if (!$stmt) {
                throw new Exception(
                    'Unable to clear password reset requirement.'
                );
            }

            $stmt->bind_param(
                "i",
                $LoginMemberID
            );

            if (!$stmt->execute()) {
                throw new Exception(
                    'Unable to clear password reset requirement.'
                );
            }

            $stmt->close();

            /*
            |--------------------------------------------------------------------------
            | COMMIT
            |--------------------------------------------------------------------------
            */

            $mysqli->commit();

            $password_success = true;

            $_SESSION['change_password_csrf'] =
                bin2hex(random_bytes(32));

            $csrf_token =
                $_SESSION['change_password_csrf'];

        } catch (Throwable $e) {

            $mysqli->rollback();

            error_log('ChangePW error: ' . $e->getMessage());

            $password_error =
                'Your password could not be changed. Please try again.';
        }
    }
}

?>

<!DOCTYPE html>
<html lang="en">

<head>

<?php
$title = 'Change password';
?>

<title>
    <?php
    echo htmlspecialchars(
        $title,
        ENT_QUOTES,
        'UTF-8'
    );
    ?>
</title>

<link
    rel="stylesheet"
    type="text/css"
    href="css/style.css"
>

<style>

#message {
    background: #f1f1f1;
    color: #000;
    position: relative;
    padding: 20px;
    margin-top: 10px;
}

#message p {
    padding: 10px 35px;
    font-size: 18px;
}

.valid {
    color: green;
}

.valid:before {
    position: relative;
    left: -35px;
    content: "✔";
}

.invalid {
    color: red;
}

.invalid:before {
    position: relative;
    left: -35px;
    content: "✖";
}

</style>

</head>

<body>

<?php
include_once('Menu.php');
?>

<center>

<div class="container">

    <div class="card card-md-5 bg-light mt-md-0">

        <div class="card-body">

            <h1>Change password</h1>

            <?php
            if ($password_success) {
            ?>

                <div class="alert alert-success">

                    <h3>
                        <i
                            class="fa fa-thumbs-o-up"
                            style="font-size:36px"
                        ></i>

                        Password changed successfully
                    </h3>

                    <p>
                        <?php
                        echo htmlspecialchars(
                            $user_first . ' ' . $user_surname,
                            ENT_QUOTES,
                            'UTF-8'
                        );
                        ?>,
                        your password has been changed.
                    </p>

                    <p>
                        You will be returned to the home page.
                    </p>

                </div>

                <script>
                setTimeout(function () {
                    window.location.href = 'index.php';
                }, 3000);
                </script>

            <?php
            } else {
            ?>

                <?php
                if (
                    isset($_GET['required']) &&
                    $_GET['required'] == '1'
                ) {
                ?>

                    <div class="alert alert-warning">

                        <h3>Password change required</h3>

                        <p>
                            Your password has been reset by an administrator.
                            The password you just used was temporary.
                        </p>

                        <p>
                            Please choose your own new password before continuing
                            to the intranet.
                        </p>

                    </div>

                <?php
                } else {
                ?>

                    <p>
                        <?php
                        echo htmlspecialchars(
                            $user_first,
                            ENT_QUOTES,
                            'UTF-8'
                        );
                        ?>,
                        you're about to change your password.
                        Please enter your new password below.
                    </p>

                <?php
                }
                ?>

                <?php
                if (!empty($password_error)) {
                ?>

                    <div class="alert alert-danger">

                        <strong>
                            Password not changed.
                        </strong>

                        <br>

                        <?php
                        echo htmlspecialchars(
                            $password_error,
                            ENT_QUOTES,
                            'UTF-8'
                        );
                        ?>

                    </div>

                <?php
                }
                ?>

                <form
                    action=""
                    method="post"
                    autocomplete="off"
                >

                    <input
                        type="hidden"
                        name="csrf_token"
                        value="<?php
                        echo htmlspecialchars(
                            $csrf_token,
                            ENT_QUOTES,
                            'UTF-8'
                        );
                        ?>"
                    >

                    <div class="form-group row">

                        <label
                            for="user_pass_1"
                            class="col-sm-4 col-form-label"
                        >
                            <b>New Password</b>
                        </label>

                        <div class="col-sm-8">

                            <input
                                type="password"
                                maxlength="100"
                                name="user_pass_1"
                                pattern="(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}"
                                title="Must contain at least one number, one uppercase letter, one lowercase letter, and at least 8 characters."
                                required
                                class="form-control"
                                id="user_pass_1"
                                autocomplete="new-password"
                            >

                        </div>

                    </div>

                    <div class="form-group row">

                        <label
                            for="confirm_password"
                            class="col-sm-4 col-form-label"
                        >
                            <b>Confirm Password</b>
                        </label>

                        <div class="col-sm-8">

                            <input
                                type="password"
                                maxlength="100"
                                name="confirm_password"
                                id="confirm_password"
                                class="form-control"
                                autocomplete="new-password"
                                required
                            >

                        </div>

                    </div>

                    <div class="form-group row">

                        <label
                            class="col-sm-4 col-form-label"
                        >
                            <b>Show Password</b>
                        </label>

                        <div class="col-sm-1">

                            <input
                                type="checkbox"
                                onclick="showPasswords()"
                                class="form-control"
                            >

                        </div>

                    </div>

                    <div
                        id="message"
                        class="card-body text-left"
                    >

                        <h3>
                            Password must contain:
                        </h3>

                        <p id="letter" class="invalid">
                            A <b>lowercase</b> letter
                        </p>

                        <p id="capital" class="invalid">
                            A <b>capital (uppercase)</b> letter
                        </p>

                        <p id="number" class="invalid">
                            A <b>number</b>
                        </p>

                        <p id="length" class="invalid">
                            Minimum <b>8 characters</b>
                        </p>

                        <p id="match" class="invalid">
                            <b>Matching passwords</b>
                        </p>

                        <p>
                            You cannot reuse any of your
                            <b>last 6 passwords</b>.
                        </p>

                    </div>

                    <br>

                    <center>

                        <input
                            type="submit"
                            name="submit"
                            value="Submit your new password"
                            class="btn btn-success"
                        >

                    </center>

                </form>

            <?php
            }
            ?>

        </div>

    </div>

</div>

</center>

<script>

var myInput =
    document.getElementById("user_pass_1");

var confirmInput =
    document.getElementById("confirm_password");

var letter =
    document.getElementById("letter");

var capital =
    document.getElementById("capital");

var number =
    document.getElementById("number");

var length =
    document.getElementById("length");

var match =
    document.getElementById("match");

if (myInput) {
    myInput.addEventListener(
        'keyup',
        validatePassword
    );
}

if (confirmInput) {
    confirmInput.addEventListener(
        'keyup',
        validatePassword
    );
}

function validatePassword() {

    if (!myInput || !confirmInput) {
        return;
    }

    var lowerCaseLetters = /[a-z]/g;

    if (myInput.value.match(lowerCaseLetters)) {
        letter.classList.remove("invalid");
        letter.classList.add("valid");
    } else {
        letter.classList.remove("valid");
        letter.classList.add("invalid");
    }

    var upperCaseLetters = /[A-Z]/g;

    if (myInput.value.match(upperCaseLetters)) {
        capital.classList.remove("invalid");
        capital.classList.add("valid");
    } else {
        capital.classList.remove("valid");
        capital.classList.add("invalid");
    }

    var numbers = /[0-9]/g;

    if (myInput.value.match(numbers)) {
        number.classList.remove("invalid");
        number.classList.add("valid");
    } else {
        number.classList.remove("valid");
        number.classList.add("invalid");
    }

    if (myInput.value.length >= 8) {
        length.classList.remove("invalid");
        length.classList.add("valid");
    } else {
        length.classList.remove("valid");
        length.classList.add("invalid");
    }

    if (
        myInput.value !== '' &&
        myInput.value === confirmInput.value
    ) {
        match.classList.remove("invalid");
        match.classList.add("valid");
    } else {
        match.classList.remove("valid");
        match.classList.add("invalid");
    }
}

function showPasswords() {

    if (!myInput || !confirmInput) {
        return;
    }

    if (myInput.type === "password") {
        myInput.type = "text";
        confirmInput.type = "text";
    } else {
        myInput.type = "password";
        confirmInput.type = "password";
    }
}

</script>

</body>

</html>