<?php
require __DIR__ . '/_bootstrap.php';

/**
 * @OA\Post(
 *   path="/password-change.php",
 *   tags={"Auth"},
 *   summary="Change the password of the signed-in user",
 *   description="Revokes every other token; the current device stays signed in.",
 *   security={{"bearerAuth":{}}},
 *   @OA\RequestBody(required=true, @OA\JsonContent(
 *     required={"current_password","new_password"},
 *     @OA\Property(property="current_password", type="string", format="password"),
 *     @OA\Property(property="new_password", type="string", format="password", minLength=8)
 *   )),
 *   @OA\Response(response=200, ref="#/components/responses/Success"),
 *   @OA\Response(response=401, ref="#/components/responses/Unauthorized"),
 *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
 * )
 */
require_method('POST');
$user = require_auth($pdo);

$in      = body();
$current = (string) ($in['current_password'] ?? '');
$new     = (string) ($in['new_password'] ?? '');

if (strlen($new) < 8) {
    json_error(422, 'Validation failed', ['new_password' => ['At least 8 characters']]);
}
if (!password_verify($current, (string) $user['password'])) {
    json_error(422, 'Validation failed', ['current_password' => ['Wrong password']]);
}

$pdo->prepare('UPDATE auth_users SET password = ? WHERE id = ?')
    ->execute([password_hash($new, PASSWORD_DEFAULT), $user['id']]);

// Keep the device that just changed the password signed in.
$pdo->prepare('DELETE FROM api_tokens WHERE user_id = ? AND token <> ?')
    ->execute([$user['id'], hash('sha256', (string) bearer_token())]);

json_ok();