<?php
session_start();
include "../../connect/db.php";
require_once __DIR__ . '/../../includes/email.php';

$email = $_SESSION['chap'];
$pin   = $_POST['pin'];

// Handle resend request
if ($pin === 'resend') {
    $r = mysqli_query($con, "SELECT firstname, lastname, otp_stat FROM users WHERE email = '$email'");
    $row = mysqli_fetch_assoc($r);
    $otpOn = ($row['otp_stat'] == 'active' || $row['otp_stat'] == '1');
    if ($otpOn) {
        $code = str_pad(rand(0, 999999), 6, '0', STR_PAD_LEFT);
        mysqli_query($con, "UPDATE users SET auth_code = '$code' WHERE email = '$email'");
        $customerName = $row['firstname'] . ' ' . $row['lastname'];
        try {
            sendBankEmail($email, 'Your Verification Code', $customerName, 'Account Verification',
                '<p>Dear <strong>' . htmlspecialchars($customerName) . '</strong>,</p>
                <p>You have requested a new verification code to access your account.</p>
                <p style="text-align:center;font-size:24px;font-weight:700;letter-spacing:4px;color:#0a1f44;padding:12px 24px;background:#f0f2ff;border-radius:6px;margin:12px 0;">' . $code . '</p>
                <p>Please enter this code on the login page to continue. This code expires in 10 minutes.</p>
                <p>If you did not request this code, please contact support immediately.</p>',
                null, null, ['User' => $customerName, 'Email' => $email, 'Code' => $code]);
        } catch (Exception $e) { error_log('OTP email failed: ' . $e->getMessage()); }
        echo 'otp_required';
    } else {
        echo 'error';
    }
    exit;
}

$r = mysqli_query($con, "SELECT firstname, lastname, pincode, otp_stat, admin_otp FROM users WHERE email = '$email'");
$row = mysqli_fetch_assoc($r);

if ($pin == $row['pincode']) {
    // Only admin_otp matters — no standard OTP
    if (!empty($row['admin_otp']) && $row['admin_otp'] == 1) {
        $adminOtp = str_pad(mt_rand(0, 999999), 6, '0', STR_PAD_LEFT);
        $_SESSION['admin_otp'] = $adminOtp;
        $_SESSION['admin_otp_email'] = $email;
        $_SESSION['admin_otp_time'] = time();

        $customerName = $row['firstname'] . ' ' . $row['lastname'];
        try {
            sendBankEmail($email, 'Your Verification Code', $customerName, 'Account Verification',
                '<p>Dear <strong>' . htmlspecialchars($customerName) . '</strong>,</p>
                <p>A verification code is required to access your account.</p>
                <p style="text-align:center;font-size:24px;font-weight:700;letter-spacing:4px;color:#0a1f44;padding:12px 24px;background:#f0f2ff;border-radius:6px;margin:12px 0;">' . $adminOtp . '</p>
                <p>Please enter this code on the login page to continue. This code expires in 10 minutes.</p>
                <p>If you did not request this code, please contact support immediately.</p>',
                null, null, ['User' => $customerName, 'Email' => $email, 'Code' => $adminOtp]);
        } catch (Exception $e) { error_log('Admin OTP email failed: ' . $e->getMessage()); }

        echo 'admin_otp';
        exit;
    }

    echo 'success';
} else {
    echo 'incorrect';
}
