{# auth/reset.html — choose a new password from an emailed link (milestone 497).
   `username` is set while the link works; otherwise only `error` shows. #}
{% extends "base.html" %}
{% block title %}Choose a new password — Steward{% endblock %}
{% block content %}
<div class="invite-page">
  <div class="card">
    <h1 class="invite-title">Choose a new password</h1>
    {% if username %}
    <p class="invite-lede">For <strong>{{ username }}</strong>. Once it's set you're signed in here, and signed out anywhere else.</p>
    {% endif %}
    {% if error %}<div class="alert alert-error" role="alert">{{ error }}</div>{% endif %}
    {% if username %}
    <form method="post" action="/reset/{{ key }}">{{ csrf_field() }}
      <input type="text" name="username" value="{{ username }}" autocomplete="username" hidden>
      <div class="field">
        <label class="field-label" for="reset-pw">New password</label>
        <input class="input" id="reset-pw" type="password" name="password" minlength="{{ min_password }}" required autofocus autocomplete="new-password">
        <span class="field-hint">At least {{ min_password }} characters.</span>
      </div>
      <div class="field">
        <label class="field-label" for="reset-pw2">New password again</label>
        <input class="input" id="reset-pw2" type="password" name="confirm" required autocomplete="new-password">
      </div>
      <button type="submit" class="btn invite-submit">Set password and sign in</button>
    </form>
    {% else %}
    <a href="/forgot" class="btn btn-ghost">Ask for a new link</a>
    {% endif %}
  </div>
</div>
{% endblock %}