forgot_process.php

<?php
require 'db.php';

if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $email = trim($_POST['email'] ?? '');

    if (empty($email)) {
        http_response_code(400);
        echo json_encode(['success' => false, 'message' => 'Email required']);
        exit();
    }

    // Check if email exists
    $check = $conn->prepare("SELECT id FROM users WHERE email = ?");
    $check->bind_param("s", $email);
    $check->execute();
    
    if ($check->get_result()->num_rows > 0) {
        $token = bin2hex(random_bytes(32));
        $expires = date("Y-m-d H:i:s", strtotime("+1 hour"));

        $stmt = $conn->prepare("INSERT INTO password_resets (email, token, expires) VALUES (?, ?, ?)");
        $stmt->bind_param("sss", $email, $token, $expires);
        $stmt->execute();

        // TODO: Send email with reset link using email_config.php
        // For now, log the token for development
        error_log("Password reset token for $email: $token");

        echo json_encode(['success' => true, 'message' => 'Reset link sent to email']);
    } else {
        http_response_code(404);
        echo json_encode(['success' => false, 'message' => 'Email not found']);
    }
}
?>