xamxam/app/public/admin/password-reset.php

<?php
/**
 * Reset password page (unauthenticated).
 *
 * GET  → show a "set new password" form if the token is valid (token in a
 *        hidden field, never in a POST-redirect URL).
 * POST → redeem the one-time token, install the new password, redirect to login.
 */
require_once __DIR__ . '/../../bootstrap.php';
require_once APP_ROOT . '/src/AdminAuth.php';
require_once APP_ROOT . '/src/App.php';

// Reset only makes sense with a password configured.
if (!AdminAuth::hasPassword()) {
    header('Location: /admin/');
    exit;
}

App::boot();

$token = trim($_GET['token'] ?? $_POST['token'] ?? '');
$error = null;

// ── POST: redeem token + set new password ─────────────────────────────────
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    if (empty($_POST['csrf_token']) || empty($_SESSION['csrf_token'])
        || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
        $error = 'Erreur de sécurité : token invalide.';
    } else {
        $new   = $_POST['new_password'] ?? '';
        $conf  = $_POST['confirm_password'] ?? '';

        if (strlen($new) < 12) {
            $error = 'Le mot de passe doit contenir au moins 12 caractères.';
        } elseif ($new !== $conf) {
            $error = 'Les mots de passe ne correspondent pas.';
        } elseif (!AdminAuth::redeemPasswordResetToken($token, $new)) {
            $error = 'Ce lien est invalide, a déjà été utilisé, ou a expiré.';
        } else {
            App::flash('success', 'Mot de passe mis à jour. Connectez-vous.');
            header('Location: /admin/login.php');
            exit;
        }
    }
}

// ── Render (GET, or POST with a validation error) ─────────────────────────
$pageTitle = 'Réinitialiser le mot de passe';
$isAdmin = true; $isLogin = true; $bodyClass = 'admin-body';
require_once APP_ROOT . '/templates/head.php';
include APP_ROOT . '/templates/header.php';
include APP_ROOT . '/templates/admin/password-reset.php';
echo "\n</body>\n</html>";