{{--
    Reset password — reached from the emailed link, which carries the token in
    the path and the address in the query string. Both are echoed straight back
    to Fortify: the token hidden, the address readonly (a reset is only valid
    for the address the link was issued for). Everything is escaped, so a
    tampered link renders as text rather than markup.

    Readonly keys off the *presence of the query parameter*, not off the field
    having a value. Keying it off the value locked a user who typed their own
    address and mistyped it into the typo, with no way to correct it.

    The new-password field is built from <x-form.group> rather than
    <x-form.input> so the group's `hint` prop can carry the policy line inside
    the field wrapper, between the control and the error — the escape hatch
    that component's docblock describes. Everything else is the ordinary
    library input.

    $request is supplied by Fortify's ResetPasswordViewResponse.
--}}
@extends('layouts.guest')

@section('title', __('auth_pages.reset.title'))

@section('content')

    @php
        $token = (string) $request->route('token');
        // The link's address, when it carried one. Old input still wins for
        // display (form_input_value does that) so a failed submit keeps what
        // the user typed; only the lock is query-driven.
        $linkedEmail = $request->query('email');
        $passwordDescribedBy = $errors->has('password') ? 'password_error password_hint' : 'password_hint';
    @endphp

    <!--begin::Heading-->
    <div class="text-center mb-8">
        <h1 class="fs-2 fw-bold mb-2">{{ __('auth_pages.reset.heading') }}</h1>
        <p class="text-muted fs-7 mb-0">{{ __('auth_pages.reset.intro') }}</p>
    </div>
    <!--end::Heading-->

    <x-form.open id="nrems_reset_password_form" :action="route('password.update')" />

        <input type="hidden" name="token" value="{{ $token }}" />

        <x-form.input
            name="email"
            type="email"
            :label="__('auth_pages.reset.email')"
            required
            :value="is_string($linkedEmail) ? $linkedEmail : ''"
            :readonly="is_string($linkedEmail)"
            autocomplete="email"
            inputmode="email" />

        <!--begin::New password-->
        <x-form.group name="password" :label="__('auth_pages.reset.password')" required for="password" :hint="__('auth_pages.reset.password_hint')">
            <input
                @class(['form-control form-control-solid', 'is-invalid' => $errors->has('password')])
                id="password"
                type="password"
                name="password"
                autocomplete="new-password"
                aria-describedby="{{ $passwordDescribedBy }}"
                @error('password') aria-invalid="true" @enderror
                required
                autofocus />
        </x-form.group>
        <!--end::New password-->

        <x-form.input
            name="password_confirmation"
            type="password"
            :label="__('auth_pages.reset.password_confirmation')"
            required
            group-class="mb-8"
            autocomplete="new-password" />

        <button class="btn btn-primary w-100" type="submit">{{ __('auth_pages.reset.submit') }}</button>
    <x-form.close />

    <div class="text-center mt-6">
        <a class="fs-7 fw-semibold text-primary" href="{{ route('login') }}">{{ __('auth_pages.reset.back') }}</a>
    </div>

    <x-form.jsvalidation :request="\App\Http\Requests\Auth\ResetPasswordPageRequest::class" selector="#nrems_reset_password_form" />

@endsection