<?php
session_start();

// Only allow if OTP exists
if(!isset($_SESSION['otp'])){
    header("Location: ../login.php");
    exit;
}

// Process OTP verification
$error = '';
if(isset($_POST['otp'])){
    $input_otp = trim($_POST['otp']);
    
    if(time() > $_SESSION['otp_expiry']){
        unset($_SESSION['otp'], $_SESSION['otp_expiry'], $_SESSION['login_user_id']);
        $error = "OTP expired. Please request a new one.";
    } elseif($input_otp != $_SESSION['otp']){
        $error = "Invalid OTP.";
    } else {
        // OTP correct → log user in
        $user_id = $_SESSION['login_user_id'];
        unset($_SESSION['otp'], $_SESSION['otp_expiry'], $_SESSION['login_user_id']);

        $pdo = new PDO("mysql:host=localhost;dbname=proceessor_securebank", "proceessor_user", "Fakepassword2$.");
        $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);

        $stmt = $pdo->prepare("SELECT id, account_number, first_name, middle_name, last_name, email FROM users WHERE id = :id LIMIT 1");
        $stmt->execute(['id' => $user_id]);
        $user = $stmt->fetch(PDO::FETCH_ASSOC);

        $_SESSION['user_id'] = $user['id'];
        $_SESSION['account_number'] = $user['account_number'];
        $_SESSION['full_name'] = trim($user['first_name'].' '.$user['middle_name'].' '.$user['last_name']);
        $_SESSION['email'] = $user['email'];

        header("Location: ../dashboard.php");
        exit;
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Verify OTP</title>
<link rel="icon" type="image/png" href="favicon.png">
<style>
body { font-family: 'Inter', sans-serif; background: #f2f4f8; display:flex; justify-content:center; align-items:center; height:100vh; margin:0; }
.container { background:#fff; padding:40px; border-radius:10px; box-shadow:0 10px 25px rgba(0,0,0,0.1); width:350px; text-align:center; }
.container h2 { color:#004aad; margin-bottom:20px; }
.container p { color:#555; font-size:14px; margin-bottom:25px; }
input[type="text"] { width:100%; padding:12px; margin-bottom:20px; border-radius:6px; border:1px solid #ccc; font-size:16px; text-align:center; letter-spacing:3px; }
button { width:100%; padding:12px; background:#004aad; color:#fff; border:none; border-radius:6px; font-size:16px; cursor:pointer; }
button:hover { background:#003380; }
.error { color:red; margin-bottom:15px; }
.resend { margin-top:15px; font-size:14px; }
.resend a { color:#004aad; text-decoration:none; font-weight:500; }
.resend a:hover { text-decoration:underline; }
</style>
</head>
<body>
<div class="container">
    <h2>OTP Verification</h2>
    <?php if($error): ?>
        <div class="error"><?php echo htmlspecialchars($error); ?></div>
    <?php endif; ?>
    <form method="post">
        <input type="text" name="otp" placeholder="Enter OTP" maxlength="6" required />
        <button type="submit">Verify OTP</button>
    </form>
    <div class="resend">
        Didn't receive OTP? <a href="resend_otp.php">Resend OTP</a>
    </div>
</div>
</body>
</html>