soil-report-ai/login/forgot-password.php

<?php
require_once __DIR__ . '/../config/database.php';
require_once __DIR__ . '/../lib/auth.php';
require_once __DIR__ . '/../lib/csrf.php';
require_once __DIR__ . '/../vendor/autoload.php';
require_once __DIR__ . '/../lib/mailer.php';

if (isLoggedIn()) {
    header('Location: /dashboard/dashboard.php');
    exit;
}

$sent  = false;
$error = '';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (!verifyCsrfToken($_POST['csrf_token'] ?? '')) {
        $error = 'Invalid request. Please try again.';
    } else {
        $email = trim($_POST['email'] ?? '');

        if ($email === '' || !filter_var($email, FILTER_VALIDATE_EMAIL)) {
            $error = 'Please enter a valid email address.';
        } else {
            // createPasswordResetToken returns null if email not found,
            // but we show the same success message to avoid email enumeration.
            $token = createPasswordResetToken($email);

            if ($token !== null) {
                sendPasswordResetEmail($email, $token);
            }

            $sent = true; // Always show success to prevent email enumeration
        }
    }
}

$pageTitle = 'Forgot Password';
include __DIR__ . '/_head.php';
?>

<div class="container">
    <div class="row justify-content-center">
        <div class="col-xl-10 col-lg-12 col-md-9">
            <div class="card o-hidden border-0 shadow-lg my-5">
                <div class="card-body p-0">
                    <div class="row">
                        <div class="col-lg-6 d-none d-lg-block bg-login-image"></div>
                        <div class="col-lg-6">
                            <div class="p-5">
                                <div class="text-center mb-4">
                                    <h1 class="h4 text-gray-900">Forgot Your Password?</h1>
                                    <p class="text-muted small">Enter your email and we'll send you a reset link.</p>
                                </div>

                                <?php if ($sent): ?>
                                    <div class="alert alert-success" role="alert">
                                        If that email is registered, a reset link has been sent. Please check your inbox.
                                    </div>
                                <?php else: ?>
                                    <?php if ($error !== ''): ?>
                                        <div class="alert alert-danger"><?= htmlspecialchars($error, ENT_QUOTES, 'UTF-8') ?></div>
                                    <?php endif; ?>

                                    <form method="POST" action="/login/forgot-password.php" novalidate>
                                        <input type="hidden" name="csrf_token" value="<?= generateCsrfToken() ?>">
                                        <div class="mb-3">
                                            <input type="email" name="email" class="form-control form-control-user"
                                                   placeholder="Email Address" required autofocus
                                                   value="<?= htmlspecialchars($_POST['email'] ?? '', ENT_QUOTES, 'UTF-8') ?>">
                                        </div>
                                        <button type="submit" class="btn btn-success btn-user w-100 mb-3">
                                            Send Reset Link
                                        </button>
                                    </form>
                                <?php endif; ?>

                                <hr>
                                <div class="text-center">
                                    <a class="small" href="/login/register.php">Create an Account!</a>
                                </div>
                                <div class="text-center">
                                    <a class="small" href="/login/login.php">Already have an account? Login!</a>
                                </div>
                            </div>
                        </div>
                    </div>
                </div>
            </div>
        </div>
    </div>
</div>

<?php include __DIR__ . '/_foot.php'; ?>