<?php
if (!defined('VALID_ACCESS')) { include(__DIR__ . '/include/config.php'); }

define('OTP_EXPIRATION', 60);

if (!isset($_SESSION['user_id'])) {
    header('Location: ' . $site_data['web_url'] . '/login');
    exit();
}

/* ================= RESEND OTP ================= */
if (isset($_GET['resend'])) {

    $otp = rand(100000, 999999);

    $_SESSION['otp'] = $otp;
    $_SESSION['otp_time'] = time();

    $email = $_SESSION['email'];

    $subject = WEB_NAME . " - Email Verification Code";

    $message = "
    <html><body style='font-family:sans-serif;max-width:600px;margin:0 auto;padding:20px'>
    <div style='background:#4D148C;padding:20px;text-align:center;border-radius:8px 8px 0 0'>
    <h1 style='color:#fff;margin:0'>" . WEB_NAME . " Verification</h1></div>
    <div style='padding:25px;background:#f9f9f9;border-radius:0 0 8px 8px;border:1px solid #e0e0e0;border-top:none'>
    <p>Your verification code:</p>
    <div style='text-align:center'>
    <div style='background:#4D148C;color:#fff;font-size:28px;font-weight:bold;padding:15px 25px;border-radius:8px;letter-spacing:5px'>{$otp}</div>
    </div>
    <p style='margin-top:15px'><strong>Note:</strong> Expires in 60 seconds.</p>
    </div></body></html>";

    send_system_email($email, $subject, $message, $pdo, $site_data);

    $_SESSION['message_info'] = "A new verification code has been sent.";
    header('Location: ' . $site_data['web_url'] . '/verify');
    exit();
}

/* ================= VERIFY OTP ================= */
if ($_SERVER['REQUEST_METHOD'] == 'POST') {

    $entered_otp = trim($_POST['otp']);

    if (!isset($_SESSION['otp'], $_SESSION['otp_time'])) {
        $_SESSION['error'] = "No verification code found. Please resend OTP.";
        header('Location: ' . $site_data['web_url'] . '/verify');
        exit();
    }

    if (time() - $_SESSION['otp_time'] > OTP_EXPIRATION) {
        $_SESSION['error'] = "OTP expired. Please resend code.";
        header('Location: ' . $site_data['web_url'] . '/verify');
        exit();
    }

    if ($entered_otp == $_SESSION['otp']) {

        // ✅ update database
        $stmt = $pdo->prepare("UPDATE users SET email_verified = 1 WHERE id = ?");
        $stmt->execute([$_SESSION['user_id']]);

        // session flags
        $_SESSION['verified'] = true;
        $_SESSION['verification_success'] = true;

        unset($_SESSION['otp'], $_SESSION['otp_time']);

        // return to same page to show success message
        header('Location: ' . $site_data['web_url'] . '/verify');
        exit();

    } else {
        $_SESSION['error'] = "Invalid verification code.";
        header('Location: ' . $site_data['web_url'] . '/verify');
        exit();
    }
}

$page_title = $site_data['web_name'] . " | Verify Email";
include('include/header.php');
?>

<!-- ================= SUCCESS MESSAGE + REDIRECT ================= -->

<?php if (isset($_SESSION['verification_success'])): ?>
    <div class="alert alert-success" style="margin:20px;padding:15px;">
        ✅ Email Verified Successfully! Redirecting to dashboard...
    </div>

    <script>
        setTimeout(function () {
            window.location.href = "<?= $site_data['web_url'] ?>/user/dashboard";
        }, 2000);
    </script>

    <?php unset($_SESSION['verification_success']); ?>
<?php endif; ?>