<?php
	ini_set('display_errors',1);
	include "../fines/dist/db.php";
    	// Делаем проверку метода 
	$method = $_SERVER['REQUEST_METHOD'];
	if($method!='POST'){
        http_response_code(400);
        header("Content-Type: application/json");
        $result_array['error']="Method not allowed";  
        echo json_encode($result_array);
        return;        
    }
	
	// Читаем параметры
	$data = file_get_contents('php://input');
	$json_input = json_decode($data,1);

	if($json_input === null && json_last_error() !== JSON_ERROR_NONE){
        http_response_code(400);
        header("Content-Type: application/json");
        $result_array['error']="Error  json syntax, cannot br parsed";  
        echo json_encode($result_array);
        return;        
    }

	if (isset($json_input['username'])) $login = $json_input['username']; else $login="";
	if (isset( $json_input['oldpassword'])) $password = $json_input['oldpassword']; else $password="";    
    if (isset( $json_input['newpassword'])) $newpassword = $json_input['newpassword']; else $newpassword="";    

    $login=trim($login," ");
    $password=trim($password," ");
    $newpassword=trim($newpassword," ");

    if($login=="" || $password=="" || $newpassword==""){
        http_response_code(400);
        header("Content-Type: application/json");
        $result_array['error']="Неверный имя пользователь или пароль";  
        echo json_encode($result_array);
        return;            
    }

    global $con;
	$params = [$login];
    $sql = "SELECT id,password from RBDA.dbo.users with (nolock)  
            where login = ? and status='10'";

    try{
        $query = sqlsrv_query($con,$sql,$params);
        $arr = ["code"=>"100","message"=>"Не найден имя пользователя"];
        if(sqlsrv_has_rows($query))
        {
            $row = sqlsrv_fetch_array($query);
            if (password_verify($password,$row['password'])) 
               $arr = ["code"=>"200","id"=>$row['id']];
            else
               $arr = ["code"=>"100","message"=>"Неверный пароль"];
        }
        }catch(Exception $ex){
            
            $arr = ["code"=>"102","id"=>0,"message"=>$ex->getMessage(),"sql"=>$sql];
        }
        if ($arr['code']==200)
        {
            $sql="Update RBDA.dbo.users set password='" .password_hash($newpassword,PASSWORD_DEFAULT) ."' where id=".$arr['id'];
            $query = sqlsrv_query($con,$sql);
            if ($query!=false)
            {
                $result_array['message']="Пароль успешно изменен";
                http_response_code(200);
                header("Content-Type: application/json");
                echo json_encode($result_array);          
                return;
            } else{
                $result_array['message']="Ошибка изменения пароля";
                http_response_code(200);
                header("Content-Type: application/json");
                echo json_encode($result_array);          
                return;
            }
        }else{
            $result_array['error']=$arr['message'];
            http_response_code(400);
            header("Content-Type: application/json");
            echo json_encode($result_array);
            return;          
        }

?>