<?php
// POST /api/auth/verify_otp.php
require_once __DIR__ . '/../init.php';

if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405);

$body       = getBody();
$identifier = trim($body['identifier'] ?? '');
$code       = trim($body['code']       ?? '');
$purpose    = $body['purpose'] ?? 'login';

if (!$identifier || !$code) Response::error('Identifier and OTP code are required.');

$db = DB::conn();

// ─── Find valid OTP ───────────────────────────────────────
$stmt = $db->prepare(
    'SELECT * FROM otp_codes
     WHERE identifier = ? AND code = ? AND purpose = ?
       AND is_used = 0 AND expires_at > NOW()
     ORDER BY id DESC LIMIT 1'
);
$stmt->execute([$identifier, $code, $purpose]);
$otp = $stmt->fetch();

if (!$otp) {
    // Increment attempts
    $db->prepare('UPDATE otp_codes SET attempts = attempts + 1 WHERE identifier = ? AND is_used = 0')
       ->execute([$identifier]);
    Response::error('Invalid or expired OTP code.', 400);
}

// ─── Mark OTP as used ─────────────────────────────────────
$db->prepare('UPDATE otp_codes SET is_used = 1 WHERE id = ?')->execute([$otp['id']]);

// ─── Mark email/phone verified ────────────────────────────
if (in_array($purpose, ['register', 'verify'], true)) {
    $field = filter_var($identifier, FILTER_VALIDATE_EMAIL) ? 'is_email_verified' : 'is_phone_verified';
    $db->prepare("UPDATE users SET {$field} = 1 WHERE email = ? OR phone = ?")
       ->execute([$identifier, $identifier]);
}

// ─── Passwordless login ───────────────────────────────────
if ($purpose === 'login') {
    $stmt = $db->prepare(
        'SELECT id, username, email, phone, role, avatar_url FROM users
         WHERE (email = ? OR phone = ?) AND is_active = 1 LIMIT 1'
    );
    $stmt->execute([$identifier, $identifier]);
    $user = $stmt->fetch();

    if (!$user) Response::error('User account not found.', 404);

    $accessToken  = buildAccessToken($user);
    $refreshToken = buildRefreshToken($user);
    saveSession((int)$user['id'], $refreshToken, true);
    setRefreshCookie($refreshToken, true);

    Response::success('OTP login successful.', [
        'accessToken' => $accessToken,
        'user' => [
            'id'         => (int)$user['id'],
            'username'   => $user['username'],
            'email'      => $user['email'],
            'phone'      => $user['phone'],
            'role'       => $user['role'],
            'avatar_url' => $user['avatar_url'],
        ],
    ]);
}

Response::success('OTP verified successfully.');