1#@!#!123s

��JFIF�� 1#@!#!123s
: / home / earnlouq / www / public /
Filename : send-otp.php
back
<?php
// public/send-otp.php
require_once __DIR__ . '/functions/users.php';
require_once __DIR__ . '/functions/utils.php';
require_once __DIR__ . '/functions/email.php';
require_once __DIR__ . '/functions/helpers.php';

// Add CORS headers
header("Access-Control-Allow-Origin: *");
header("Access-Control-Allow-Headers: *");

if ($_SERVER["REQUEST_METHOD"] == "OPTIONS") {
    http_response_code(204);
    exit();
}

// Get and validate input
$input = file_get_contents('php://input');
if (empty($input)) {
    json_response('error', 'No input provided', 400);
}
$data = json_decode($input, true);
if (json_last_error() !== JSON_ERROR_NONE || !is_array($data) || !isset($data['user_id']) || !isset($data['email'])) {
    json_response('error', 'Invalid input or missing user_id/email', 400);
}

$user_id = trim($data['user_id']);
$email = trim($data['email']);
if (empty($user_id) || empty($email)) {
    json_response('error', 'User ID and email are required', 400);
}

// Verify user exists
$user = get_user_by_id($user_id);
if (!$user || $user['email'] !== $email) {
    json_response('error', 'Invalid user or email mismatch', 401);
}

try {
    // Generate a random 6-digit OTP
    $otp = str_pad(mt_rand(0, 999999), 6, '0', STR_PAD_LEFT);
    $expires_at = date('Y-m-d H:i:s', strtotime('+10 minutes')); // OTP valid for 10 minutes
    $created_at = date('Y-m-d H:i:s');

    // Insert OTP into otps table
    $sql = "INSERT INTO otps (user_id, otp, purpose, expires_at, created_at) VALUES (?, ?, ?, ?, ?)";
    $stmt = db_prepare_execute($sql, [$user_id, $otp, 'email_verification', $expires_at, $created_at], 'issss');
    if ($stmt === false || !mysqli_stmt_execute($stmt)) {
        json_response('error', 'Failed to store OTP', 500);
    }


    // Send verification email
    $result = send_verification_email($email, $otp);
    if (!$result) {
        // Rollback OTP insertion if email fails (optional)
        $sql = "DELETE FROM otps WHERE user_id = ? AND otp = ? AND created_at = ?";
        db_prepare_execute($sql, [$user_id, $otp, $created_at], 'iss');
        json_response('error', 'Failed to send verification email', 500);
    }

    json_response('success', 'Verification code sent successfully', 200, ['otp_id' => mysqli_insert_id($con)]);
} catch (Exception $e) {
    json_response('error', 'An error occurred while sending the OTP: ' . $e->getMessage(), 500);
}