File "verify_otp.php"

Full path: /home2/santhos2/public_html/bharath-coe.firstmatrix.in.net/api/enrollments/verify_otp.php
File size: 2.77 KiB (2841 bytes)
MIME-type: text/x-php
Charset: utf-8

Download   Open   Back

<?php
header('Content-Type: application/json');
require_once __DIR__ . '/../../config/config.php';

try {
    $token = $_POST['token'] ?? '';
    $otp   = trim((string)($_POST['otp'] ?? ''));
    // Normalize potential HTML formatted OTP from email (e.g., pasted with spaces or bold)
    $otp = strip_tags($otp);
    if ($token === '' || $otp === '') { throw new Exception('OTP and token are required'); }

    // Validate token
    $st = $pdo->prepare('SELECT t.*, s.email, s.first_name, s.last_name
                         FROM qp_setter_login_tokens t
                         JOIN staff s ON t.staff_id = s.staff_id
                         WHERE t.token = ? AND t.used = 0 AND t.expires_at > NOW()');
    $st->execute([$token]);
    $tok = $st->fetch(PDO::FETCH_ASSOC);
    if (!$tok) { throw new Exception('Invalid or expired link'); }

    // Validate OTP (fetch latest unused; check against token created_at and expiry in PHP)
    $o = $pdo->prepare('SELECT * FROM qp_setter_otps WHERE staff_id = ? AND is_used = 0 ORDER BY id DESC LIMIT 20');
    $o->execute([$tok['staff_id']]);
    $otpRow = null;
    $inputOtp = preg_replace('/\D+/', '', $otp); // keep digits only
    $nowTs = time();
    $tokenCreatedTs = strtotime($tok['created_at'] ?? '') ?: ($nowTs - 86400);
    while ($row = $o->fetch(PDO::FETCH_ASSOC)) {
        $rowOtp = preg_replace('/\D+/', '', (string)$row['otp_code']);
        $expTs = strtotime($row['expires_at'] ?? '');
        $rowCreatedTs = strtotime($row['created_at'] ?? '') ?: 0;
        if ($rowOtp !== '' && hash_equals($rowOtp, $inputOtp)) {
            if (($expTs === false || $expTs >= $nowTs) && $rowCreatedTs >= $tokenCreatedTs) { $otpRow = $row; break; }
        }
    }
    if (!$otpRow) { throw new Exception('Invalid or expired OTP'); }

    // Mark OTP as used; keep token valid until session starts
    $pdo->prepare('UPDATE qp_setter_otps SET is_used = 1 WHERE id = ?')->execute([$otpRow['id']]);

    // Start session for setter access
    if (session_status() !== PHP_SESSION_ACTIVE) { session_start(); }
    $_SESSION['qps_staff_id'] = (int)$tok['staff_id'];
    $_SESSION['qps_assignment_id'] = (int)$tok['assignment_id'];

    // If form post from browser, redirect to panel; otherwise return JSON
    $accept = $_SERVER['HTTP_ACCEPT'] ?? '';
    if (stripos($accept, 'application/json') === false) {
        require_once __DIR__ . '/../../config/config.php';
        header('Location: ' . BASE_URL . 'qp-declaration.php');
        exit;
    }
    require_once __DIR__ . '/../../config/config.php';
    echo json_encode(['status'=>'success','redirect'=> BASE_URL . 'qp-declaration.php']);
} catch (Throwable $e) {
    http_response_code(400);
    echo json_encode(['status'=>'error','message'=>$e->getMessage()]);
}
?>