<?php
session_start();
require 'config/db.php';

$msg = "";
if (isset($_POST['verify'])) {
    $otp = $_POST['otp'];
    $email = $_SESSION['verify_email'];

    $stmt = $pdo->prepare("SELECT id FROM users WHERE email = ? AND otp_code = ?");
    $stmt->execute([$email, $otp]);
    
    if ($stmt->fetch()) {
        $pdo->prepare("UPDATE users SET is_verified = 1, otp_code = NULL WHERE email = ?")->execute([$email]);
        $_SESSION['user_id'] = $stmt->fetchColumn(); // Auto login
        header("Location: login.php?msg=verified");
    } else {
        $msg = "Invalid OTP. Try again.";
    }
}
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <title>Verify Email</title>
    <style>body{font-family:sans-serif; background:#f4f6f8; display:flex; justify-content:center; align-items:center; height:100vh;}</style>
</head>
<body>
    <div style="background:white; padding:40px; border-radius:8px; box-shadow:0 2px 10px rgba(0,0,0,0.1); text-align:center;">
        <h2>Verify Your Email</h2>
        <p>We sent a code to <strong><?php echo $_SESSION['verify_email']; ?></strong></p>
        <?php if($msg): echo "<p style='color:red'>$msg</p>"; endif; ?>
        <form method="POST">
            <input type="text" name="otp" placeholder="Enter 4-digit OTP" required style="padding:10px; font-size:18px; width:100px; text-align:center; letter-spacing:5px; margin-bottom:20px;">
            <br>
            <button type="submit" name="verify" style="padding:10px 20px; background:#2ecc71; color:white; border:none; border-radius:5px; cursor:pointer;">Verify</button>
        </form>
    </div>
</body>
</html>