File manager - Edit - /home/webapp69.cm.in.th/u69319090038/Shop/api/auth/verify_otp.php
Back
<?php // POST /api/auth/verify_otp.php require_once __DIR__ . '/../init.php'; if ($_SERVER['REQUEST_METHOD'] !== 'POST') Response::error('Method not allowed.', 405); $body = getBody(); $identifier = trim($body['identifier'] ?? ''); $code = trim($body['code'] ?? ''); $purpose = $body['purpose'] ?? 'login'; if (!$identifier || !$code) Response::error('Identifier and OTP code are required.'); $db = DB::conn(); // ─── Find valid OTP ─────────────────────────────────────── $stmt = $db->prepare( 'SELECT * FROM otp_codes WHERE identifier = ? AND code = ? AND purpose = ? AND is_used = 0 AND expires_at > NOW() ORDER BY id DESC LIMIT 1' ); $stmt->execute([$identifier, $code, $purpose]); $otp = $stmt->fetch(); if (!$otp) { // Increment attempts $db->prepare('UPDATE otp_codes SET attempts = attempts + 1 WHERE identifier = ? AND is_used = 0') ->execute([$identifier]); Response::error('Invalid or expired OTP code.', 400); } // ─── Mark OTP as used ───────────────────────────────────── $db->prepare('UPDATE otp_codes SET is_used = 1 WHERE id = ?')->execute([$otp['id']]); // ─── Mark email/phone verified ──────────────────────────── if (in_array($purpose, ['register', 'verify'], true)) { $field = filter_var($identifier, FILTER_VALIDATE_EMAIL) ? 'is_email_verified' : 'is_phone_verified'; $db->prepare("UPDATE users SET {$field} = 1 WHERE email = ? OR phone = ?") ->execute([$identifier, $identifier]); } // ─── Passwordless login ─────────────────────────────────── if ($purpose === 'login') { $stmt = $db->prepare( 'SELECT id, username, email, phone, role, avatar_url FROM users WHERE (email = ? OR phone = ?) AND is_active = 1 LIMIT 1' ); $stmt->execute([$identifier, $identifier]); $user = $stmt->fetch(); if (!$user) Response::error('User account not found.', 404); $accessToken = buildAccessToken($user); $refreshToken = buildRefreshToken($user); saveSession((int)$user['id'], $refreshToken, true); setRefreshCookie($refreshToken, true); Response::success('OTP login successful.', [ 'accessToken' => $accessToken, 'user' => [ 'id' => (int)$user['id'], 'username' => $user['username'], 'email' => $user['email'], 'phone' => $user['phone'], 'role' => $user['role'], 'avatar_url' => $user['avatar_url'], ], ]); } Response::success('OTP verified successfully.');
| ver. 1.4 |
Github
|
.
| PHP 7.4.33 | Generation time: 0.24 |
proxy
|
phpinfo
|
Settings