<?php
/**
 * request_reset_otp.php — login page "Forgot password?" step 1.
 *
 * Unauthenticated. Answers the same way whether or not the username/email
 * matches an account (see PasswordResetManager::handleRequestOtpPublic), and is
 * throttled per client IP and per identifier because every hit can send email.
 */

require_once '../../../session.php';
define('UNAUTHENTICATED_ROUTE', true);
require_once '../../../assets/utils/db_auth.php';
require_once '../../../assets/utils/rate_limit.php';

// Resolve user by username or email
$identifier = strtolower(trim($data['identifier'] ?? ''));

if (!$identifier) {
    http_response_code(422);
    $answer['message'] = 'Please enter your username or email.';
    exit(json_encode($answer));
}

rate_limit_guard($pdo1, [
    ['reset_req_ip', rate_limit_client_ip(), 10, 900],
    ['reset_req_id', $identifier,            3,  900],
]);

$sth = $pdo1->prepare(
    "SELECT user_id, default_company FROM user WHERE username = :i OR email = :i LIMIT 1"
);
$sth->execute([':i' => $identifier]);
$user = $sth->fetch(PDO::FETCH_ASSOC);

$user_id    = $user ? (int)$user['user_id'] : null;
$company_id = $user ? (int)($user['default_company'] ?? 0) : 0;

require_once '../../../assets/utils/classes/PasswordResetManager.php';

$manager = new PasswordResetManager($pdo1, $pdo2, $include_url, $SMTP, $pinkey);
$manager->handleRequestOtpPublic($user_id, $company_id);