60 lines
2.1 KiB
PHP
60 lines
2.1 KiB
PHP
<?php
|
|
require __DIR__ . '/_bootstrap.php';
|
|
require __DIR__ . '/_codes.php';
|
|
|
|
/**
|
|
* @OA\Post(
|
|
* path="/email-verify.php",
|
|
* tags={"Auth"},
|
|
* summary="Confirm the e-mail with a 6-digit code and log in",
|
|
* description="On success a bearer token is issued, so the app enters without a second login. Error codes: code_invalid (retry) or code_expired (request a new code).",
|
|
* security={},
|
|
* @OA\RequestBody(required=true, @OA\JsonContent(
|
|
* required={"email","code","device_name"},
|
|
* @OA\Property(property="email", type="string", format="email"),
|
|
* @OA\Property(property="code", type="string", example="123456"),
|
|
* @OA\Property(property="device_name", type="string", example="iPhone 15")
|
|
* )),
|
|
* @OA\Response(response=200, description="Verified", @OA\JsonContent(
|
|
* @OA\Property(property="data", type="object",
|
|
* @OA\Property(property="token", type="string"),
|
|
* @OA\Property(property="user", ref="#/components/schemas/User")
|
|
* )
|
|
* )),
|
|
* @OA\Response(response=422, ref="#/components/responses/ValidationError")
|
|
* )
|
|
*/
|
|
require_method('POST');
|
|
|
|
$in = body();
|
|
$email = trim((string) ($in['email'] ?? ''));
|
|
$code = trim((string) ($in['code'] ?? ''));
|
|
$device = trim((string) ($in['device_name'] ?? ''));
|
|
|
|
$fields = [];
|
|
if ($email === '') { $fields['email'] = ['Required']; }
|
|
if ($code === '') { $fields['code'] = ['Required']; }
|
|
if ($device === '') { $fields['device_name'] = ['Required']; }
|
|
if ($fields) {
|
|
json_error(422, 'Validation failed', $fields);
|
|
}
|
|
|
|
$result = check_code($pdo, 'auth_email_verifications', $email, $code);
|
|
if ($result !== 'ok') {
|
|
json_error(422, $result === 'code_expired' ? 'Code expired, request a new one' : 'Invalid code', null, $result);
|
|
}
|
|
|
|
$stmt = $pdo->prepare('SELECT * FROM auth_users WHERE email = ? LIMIT 1');
|
|
$stmt->execute([$email]);
|
|
$user = $stmt->fetch();
|
|
if (!$user) {
|
|
json_error(422, 'Invalid code', null, 'code_invalid');
|
|
}
|
|
|
|
$pdo->prepare('UPDATE auth_users SET email_verified_at = NOW() WHERE id = ?')->execute([$user['id']]);
|
|
|
|
json_data([
|
|
'token' => issue_token($pdo, (int) $user['id'], $device),
|
|
'user' => present_user($user),
|
|
]);
|