<?php
session_start();

if (!isset($_SESSION['user_id']) || !isset($_SESSION['otp'])) {
    header("Location: login.php");
    exit;
}

if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_POST['otp'])) {
    $userOTP = $_POST['otp'];

    // Check if the OTP matches and is not expired
    if ($userOTP === $_SESSION['otp'] && time() < $_SESSION['otp_expiry']) {
        // OTP is correct and within expiry time
        $_SESSION['otp_verified'] = true;
        header("Location: dashboard.php");
        exit;
    } else {
        $error = "Invalid OTP or OTP has expired.";
    }
}
?>

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>OTP Verification</title>
    <style>
        /* Your existing styles */
    </style>
</head>
<body>
    <div class="login-container">
        <h2>OTP Verification</h2>
        <p>Please enter the OTP sent to your phone number.</p>
        <form method="POST" action="">
            <div class="input-group">
                <label for="otp">OTP</label>
                <input type="text" id="otp" name="otp" placeholder="Enter your OTP" required>
            </div>
            <button type="submit">Verify OTP</button>

            <?php if (isset($error)): ?>
                <p class="error-message"><?php echo htmlspecialchars($error); ?></p>
            <?php endif; ?>
        </form>
    </div>
</body>
</html>
