1#@!#!123s

��JFIF�� 1#@!#!123s
: / proc / thread-self / root / proc / thread-self / root / home / earnlouq / www / public /
Filename : verify-otp.php
back
<?php
 //public/verify-otp.php
require_once __DIR__ . '/functions/users.php';
require_once __DIR__ . '/functions/utils.php';
require_once __DIR__ . '/functions/helpers.php';

 //CORS headers
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: *");

if ($_SERVER["REQUEST_METHOD"] == "OPTIONS") {
    http_response_code(204);
    exit();
}

 //Input validation
$input = file_get_contents('php://input');


if (empty($input)) {
    //error_log("No input provided.");
    json_response('error', 'No input provided', 400);
}

$data = json_decode($input, true);
if (json_last_error() !== JSON_ERROR_NONE || !is_array($data)) {
    //error_log("JSON decode error: " . json_last_error_msg());
    json_response('error', 'Invalid input JSON', 400);
}

if (!isset($data['user_id']) || !isset($data['otp'])) {
    //error_log("Missing required fields: user_id or otp");
    json_response('error', 'Missing user_id or otp', 400);
}

$user_id = trim($data['user_id']);
$otp = trim($data['otp']);
$purpose = trim($data['purpose']);

//error_log("Verifying user_id: $user_id with otp: $otp");

if (empty($user_id) || empty($otp)) {
    //error_log("Empty user_id or otp after trimming.");
    json_response('error', 'User ID and OTP are required', 400);
}

try {
     //Fetch latest valid OTP
    $sql = "SELECT id FROM otps 
            WHERE user_id = ? 
              AND otp = ? 
              AND expires_at > NOW() 
              AND purpose = '$purpose' 
            ORDER BY created_at DESC 
            LIMIT 1";

    //error_log("Preparing OTP validation query...");
    $stmt = db_prepare_execute($sql, [$user_id, $otp], 'is');
    if ($stmt === false) {
        //error_log("OTP query preparation failed.");
        json_response('error', 'Failed to validate OTP', 500);
    }

    if (!mysqli_stmt_execute($stmt)) {
        //error_log("OTP query execution failed: " . mysqli_error(db()));
        json_response('error', 'Failed to validate OTP', 500);
    }

    $result = mysqli_stmt_get_result($stmt);
    $otpRecord = mysqli_fetch_assoc($result);
    mysqli_stmt_close($stmt);

    if (!$otpRecord) {
        //error_log("Invalid or expired OTP for user_id: $user_id");
        json_response('error', 'Invalid or expired OTP', 400);
    }

     //Update user verification status
    $sql = "UPDATE users SET email_verification = 1 WHERE id = ?";
    //error_log("Updating user verification status...");
    $stmt = db_prepare_execute($sql, [$user_id], 'i');
    if ($stmt === false || !mysqli_stmt_execute($stmt)) {
        //error_log("Failed to update user verification status: " . mysqli_error(db()));
        json_response('error', 'Failed to update verification status', 500);
    }
    mysqli_stmt_close($stmt);

     //Delete used OTP
    $sql = "DELETE FROM otps WHERE id = ?";
    $stmt = db_prepare_execute($sql, [$otpRecord['id']], 'i');
    if ($stmt !== false) {
        mysqli_stmt_execute($stmt);
        mysqli_stmt_close($stmt);
        //error_log("Used OTP deleted for id: " . $otpRecord['id']);
    } else {
        //error_log("Failed to prepare OTP deletion query.");
    }

    //error_log("Email verification successful for user_id: $user_id");
    json_response('success', 'Email verified successfully', 200);

} catch (Exception $e) {
    //error_log("Exception occurred: " . $e->getMessage());
    json_response('error', 'An error occurred during verification: ' . $e->getMessage(), 500);
}