<?php
/**
 * 找回密码接口  POST /api/auth/forgot.php
 * 入参：username / contact_email
 * 说明：占位实现 —— 校验账号存在后返回成功（后续可接入 SMTP 发送重置邮件/短信验证码）。
 * 批次1：经 Api::boot(['public' => true]) 免登录，但写请求仍校验 Ajax + CSRF。
 */
require_once __DIR__ . '/../common/Api.php';

Api::boot(['public' => true]);

$username     = trim($_POST['username'] ?? '');
$contactEmail = trim($_POST['contact_email'] ?? '');

if ($username === '' || $contactEmail === '') {
    Response::error('请输入账号和联系邮箱');
}
if (!filter_var($contactEmail, FILTER_VALIDATE_EMAIL)) {
    Response::error('邮箱格式不正确');
}

$pdo = DB::getInstance()->getPdo();
$stmt = $pdo->prepare("SELECT id, username, real_name FROM system_users WHERE username = ? AND is_active = 1 LIMIT 1");
$stmt->execute([$username]);
$user = $stmt->fetch();

if (!$user) {
    Response::error('账号不存在或已禁用');
}

// TODO: 接入 SMTP 后向 contactEmail 发送重置链接/验证码
logAction((int)$user['id'], $user['username'], 'forgot', 'auth', 'system_users', (int)$user['id'], ['contact_email' => $contactEmail]);

Response::success(null, '重置邮件已发送（占位实现，请接入SMTP后生效）');