<?php
/**
 * Template Name: Lost Password
 * Description: Custom template for user password recovery in CAS Free
 */

if (!defined('ABSPATH')) {
  exit;
}

// phpcs:ignore WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedConstantFound -- DONOTCACHEPAGE is a WordPress/cache interoperability constant and must keep its established name.
if (!defined('DONOTCACHEPAGE')) define('DONOTCACHEPAGE', true);
nocache_headers();

if (function_exists('custausu_auth_template_header')) { custausu_auth_template_header(); } else { get_header(); }

$custausu_tpl_req_path = isset($_SERVER['REQUEST_URI'])
  ? sanitize_text_field(wp_unslash((string) $_SERVER['REQUEST_URI']))
  : '';
$custausu_tpl_lang = function_exists('custausu_auth_pages_frontend_route_lang') ? custausu_auth_pages_frontend_route_lang() : 'en';
$custausu_tpl_login_url    = function_exists('custausu_route_url') ? custausu_route_url('login', $custausu_tpl_lang, wp_login_url()) : wp_login_url();
$custausu_tpl_register_url = function_exists('custausu_route_url') ? custausu_route_url('register', $custausu_tpl_lang, wp_registration_url()) : wp_registration_url();

// redirect_to (come negli altri template)
$custausu_tpl_rt_raw = '';
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only navigation query arg used to preserve redirect target on the lost-password form.
if (isset($_GET['redirect_to'])) {
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only navigation query arg; value is unslashed and URL-sanitized immediately.
    $custausu_tpl_rt_raw = esc_url_raw((string) wp_unslash($_GET['redirect_to']));
}
$custausu_tpl_rt_norm = $custausu_tpl_rt_raw ? custausu_redirect_to_normalize($custausu_tpl_rt_raw, $custausu_tpl_lang, 'lostpassword_links') : '';

// Debug (no side effects)
if (function_exists('custausu_log')) {
    custausu_log('lostpassword', 'template loaded', [
        'tpl'   => 'lost-password.php',
        'lang'  => $custausu_tpl_lang,
        'uri'   => ($custausu_tpl_req_path ?: ''),
        'rt'    => ($custausu_tpl_rt_norm ?: ''),
    ], 'debug');
}

// --- ERROR MESSAGES ---
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only lost-password result query arg used only to select a message.
if (isset($_GET['lost'])) {
    // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only result query arg; value is unslashed and sanitized immediately.
    $lost = sanitize_key(wp_unslash((string) $_GET['lost']));

// Debug (no side effects)
if (function_exists('custausu_log')) {
    custausu_log('lostpassword', 'lost error displayed', [
        'code' => $lost,
        'lang' => $custausu_tpl_lang,
    ], 'info');
}
    switch ($lost) {
        case 'empty':
            echo '<div class="errors-resetpsw">' . wp_kses_post(__('⚠️ Please enter your username or email.', 'custom-auth-suite')) . '</div>';
            break;
        case 'security':
            echo '<div class="errors-resetpsw">' . wp_kses_post(__('⚠️ Security check failed.<br />Please quit browser and try again.', 'custom-auth-suite')) . '</div>';
            break;
        case 'notfound':
            echo '<div class="errors-resetpsw">' . wp_kses_post(__('⚠️ Account not found.<br />Please check username/email and try again.', 'custom-auth-suite')) . '</div>';
            break;
        case 'inactive':
            echo '<div class="errors-resetpsw">' . wp_kses_post(__('⚠️ Account is inactive.<br />Please contact website admin.', 'custom-auth-suite')) . '</div>';
            break;
        case 'error':
            echo '<div class="errors-resetpsw">' . wp_kses_post(__('⚠️ An unexpected error occurred.<br />Please try again later.', 'custom-auth-suite')) . '</div>';
            break;
    }
}

?>

<div class="lostpassword-container">
  <div class="custom-auth-anim">
    <h2><?php esc_html_e('Lost Password', 'custom-auth-suite'); ?></h2>
    <p class="custausu-auth-description"><?php esc_html_e('Enter your Username or eMail to receive a password reset link.', 'custom-auth-suite'); ?></p>

    <form name="lostpasswordform"
      id="lostpasswordform"
      method="post"
      action="<?php echo esc_url( admin_url('admin-post.php?action=custom_auth_suite_lostpassword') ); ?>">
        <?php wp_nonce_field('custom_auth_suite_lostpassword'); ?>
        <label for="user_login"><?php esc_html_e('Username or eMail', 'custom-auth-suite'); ?></label>
        <input type="text" name="user_login" id="user_login" required>
        <input type="hidden" name="current_page_lang" value="<?php echo esc_attr($custausu_tpl_lang); ?>">
        <input type="hidden" name="current_page_slug" value="<?php echo esc_attr( wp_parse_url( home_url( add_query_arg([]) ), PHP_URL_PATH ) ?: '/' ); ?>">
        <button type="submit"><?php esc_html_e('Send Reset Link', 'custom-auth-suite'); ?></button>
    </form>
 
    <p>
        <a href="<?php echo esc_url( $custausu_tpl_rt_norm ? custausu_url_with_redirect_to($custausu_tpl_login_url, $custausu_tpl_rt_norm) : $custausu_tpl_login_url ); ?>">
        <?php esc_html_e('Back to Login', 'custom-auth-suite'); ?></a> | 
        <a href="<?php echo esc_url( $custausu_tpl_rt_norm ? custausu_url_with_redirect_to($custausu_tpl_register_url, $custausu_tpl_rt_norm) : $custausu_tpl_register_url ); ?>">
        <?php esc_html_e('Create an Account', 'custom-auth-suite'); ?></a>
    </p>
  </div>
</div>


<?php if (function_exists('custausu_auth_template_footer')) { custausu_auth_template_footer(); } else { get_footer(); } ?>