<?php
// ============================================================
// verify-otp.php — called via AJAX when user submits the code
// they received by SMS. Confirms it with Telnyx Verify.
// ============================================================
header('Content-Type: application/json');
require __DIR__ . '/config.php';

$code = isset($_POST['code']) ? trim($_POST['code']) : '';

if (!isset($_SESSION['otp_phone']) || $code === '') {
    echo json_encode(['success' => false, 'error' => 'No verification in progress. Please request a code first.']);
    exit;
}

$phone = $_SESSION['otp_phone'];
$url = 'https://api.telnyx.com/v2/verifications/by_phone_number/' . urlencode($phone) . '/actions/verify';

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    'Content-Type: application/json',
    'Accept: application/json',
    'Authorization: Bearer ' . TELNYX_API_KEY,
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'code'              => $code,
    'verify_profile_id' => TELNYX_VERIFY_PROFILE_ID,
]));
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$result = json_decode($response, true);
$response_code = $result['data']['response_code'] ?? null;

if ($http_code === 200 && $response_code === 'accepted') {
    $_SESSION['otp_verified'] = true;
    echo json_encode(['success' => true]);
} else {
    $error = 'Incorrect or expired code. Please try again.';
    if ($response_code === 'max_attempts_exceeded') {
        $error = 'Too many incorrect attempts. Please request a new code.';
    } elseif ($response_code === 'expired') {
        $error = 'That code has expired. Please request a new one.';
    }
    echo json_encode(['success' => false, 'error' => $error]);
}