<?php require_once __DIR__.'/includes/auth.php'; $token=$_GET['token']??''; $stmt=db()->prepare('SELECT * FROM users WHERE invite_token=? LIMIT 1'); $stmt->execute([$token]); $invite=$stmt->fetch(); $msg=''; if(!$invite) $msg='Invalid or expired invite link.'; if($invite && $_SERVER['REQUEST_METHOD']==='POST'){ $hash=password_hash($_POST['password'], PASSWORD_DEFAULT); db()->prepare('UPDATE users SET password_hash=?, status="active", invite_token=NULL WHERE id=?')->execute([$hash,$invite['id']]); $msg='Password set. You can now log in.'; } require __DIR__.'/includes/header.php'; ?><div class="card"><h1>Create your login</h1><p><?= htmlspecialchars($msg ?: 'Welcome '.$invite['first_name'].'. Set your password below.') ?></p><?php if($invite && $invite['invite_token']): ?><form method="post"><input type="password" name="password" minlength="8" required placeholder="Password"><button>Set Password</button></form><?php endif; ?><a href="login.php">Login</a></div><?php require __DIR__.'/includes/footer.php'; ?>
