<?php
require 'db.php';
header('Content-Type: application/json');

$email = $_POST['email'] ?? '';

$stmt = $pdo->prepare("SELECT id FROM users WHERE email=?");
$stmt->execute([$email]);
$user = $stmt->fetch();

if(!$user){
    echo json_encode(["status"=>"error"]);
    exit;
}

// Generate 8 digit code
$code = str_pad(random_int(0, 99999999), 8, '0', STR_PAD_LEFT);
$expires = date("Y-m-d H:i:s", strtotime("+10 minutes"));

$stmt = $pdo->prepare("UPDATE users SET reset_code=?, reset_expires=? WHERE id=?");
$stmt->execute([$code, $expires, $user['id']]);

// For now return code (later send SMS/email)
echo json_encode([
    "status"=>"success",
    "code"=>$code
]);
