<?php
require 'db.php';
header('Content-Type: application/json');

$email = $_POST['email'] ?? '';
$code = $_POST['code'] ?? '';
$password = $_POST['password'] ?? '';

$stmt = $pdo->prepare("SELECT id FROM users WHERE email=? AND reset_code=? AND reset_expires > NOW()");
$stmt->execute([$email, $code]);
$user = $stmt->fetch();

if(!$user){
    echo json_encode(["status"=>"error"]);
    exit;
}

$hashed = password_hash($password, PASSWORD_DEFAULT);

$stmt = $pdo->prepare("UPDATE users SET password=?, reset_code=NULL, reset_expires=NULL WHERE id=?");
$stmt->execute([$hashed, $user['id']]);

echo json_encode(["status"=>"success"]);
