<?php
require __DIR__ . '/_bootstrap.php';
require __DIR__ . '/_codes.php';

/**
 * @OA\Post(
 *   path="/email-verify.php",
 *   tags={"Auth"},
 *   summary="Confirm the e-mail with a 6-digit code and log in",
 *   description="On success a bearer token is issued, so the app enters without a second login. Error codes: code_invalid (retry) or code_expired (request a new code).",
 *   security={},
 *   @OA\RequestBody(required=true, @OA\JsonContent(
 *     required={"email","code","device_name"},
 *     @OA\Property(property="email", type="string", format="email"),
 *     @OA\Property(property="code", type="string", example="123456"),
 *     @OA\Property(property="device_name", type="string", example="iPhone 15")
 *   )),
 *   @OA\Response(response=200, description="Verified", @OA\JsonContent(
 *     @OA\Property(property="data", type="object",
 *       @OA\Property(property="token", type="string"),
 *       @OA\Property(property="user", ref="#/components/schemas/User")
 *     )
 *   )),
 *   @OA\Response(response=422, ref="#/components/responses/ValidationError")
 * )
 */
require_method('POST');

$in     = body();
$email  = trim((string) ($in['email'] ?? ''));
$code   = trim((string) ($in['code'] ?? ''));
$device = trim((string) ($in['device_name'] ?? ''));

$fields = [];
if ($email === '')  { $fields['email']       = ['Required']; }
if ($code === '')   { $fields['code']        = ['Required']; }
if ($device === '') { $fields['device_name'] = ['Required']; }
if ($fields) {
    json_error(422, 'Validation failed', $fields);
}

$result = check_code($pdo, 'auth_email_verifications', $email, $code);
if ($result !== 'ok') {
    json_error(422, $result === 'code_expired' ? 'Code expired, request a new one' : 'Invalid code', null, $result);
}

$stmt = $pdo->prepare('SELECT * FROM auth_users WHERE email = ? LIMIT 1');
$stmt->execute([$email]);
$user = $stmt->fetch();
if (!$user) {
    json_error(422, 'Invalid code', null, 'code_invalid');
}

$pdo->prepare('UPDATE auth_users SET email_verified_at = NOW() WHERE id = ?')->execute([$user['id']]);

json_data([
    'token' => issue_token($pdo, (int) $user['id'], $device),
    'user'  => present_user($user),
]);