142        if ($level === 0) {
143            $token = base64_encode($userId . ':' . time());
144        } elseif ($level === 1) {
145            $token = base64_encode('bs:' . $userId . ':' . time());
365            $decoded = bs_b64url_decode($token);
366            if (preg_match('/^(.+):([a-f0-9]{32})$/', $decoded, $m)) {
367                $st = $pdo->prepare('SELECT id, email FROM users WHERE customer_id = :c LIMIT 1');
368                $st->execute([':c' => $m[1]]);
369                if (($row = $st->fetch()) && md5((string) $row['email']) === $m[2]) {
370                    return (int) $row['id'];
371                }
372            }

148        } else {
149            $token = bin2hex(random_bytes(32));
150        }
376        return auth_consume_reset_token($pdo, $token);

102            $exists = $pdo->prepare('SELECT 1 FROM users WHERE customer_id = :cid LIMIT 1');
103            $exists->execute([':cid' => $customerId]);
104            $error = $exists->fetchColumn()
105                ? 'Incorrect password.'
106                : 'Customer ID not found.';

110            $error = 'Invalid credentials.';