<?php
// api/endpoints/ganti_password_post.php

$siswaId   = $body['siswa_id']    ?? '';
$oldPass   = $body['old_password'] ?? '';
$newPass   = $body['new_password'] ?? '';

if (empty($siswaId) || empty($oldPass) || empty($newPass)) {
    respond(['status' => 'error', 'message' => 'Data tidak lengkap'], 400);
}
if (strlen($newPass) < 6) {
    respond(['status' => 'error', 'message' => 'Password minimal 6 karakter'], 400);
}

$stmt = $pdo->prepare("SELECT * FROM users WHERE siswa_id = ?");
$stmt->execute([$siswaId]);
$user = $stmt->fetch();

if (!$user) {
    respond(['status' => 'error', 'message' => 'Akun tidak ditemukan'], 404);
}
if (!password_verify($oldPass, $user['password'])) {
    respond(['status' => 'error', 'message' => 'Password lama salah'], 401);
}

$hash = password_hash($newPass, PASSWORD_BCRYPT);
$stmt = $pdo->prepare("UPDATE users SET password = ? WHERE siswa_id = ?");
$stmt->execute([$hash, $siswaId]);

respond(['status' => 'success', 'message' => 'Password berhasil diubah']);