<?php
header('Content-Type: application/json');
require_once './descope_config.php';

$email = trim($_POST['email'] ?? '');
$otp_code = trim($_POST['otp_code'] ?? '');

if (!$email || !$otp_code) {
    echo json_encode(['status' => 'fail', 'message' => '이메일/OTP 없음']);
    exit;
}

// Descope OTP 인증 (verify)
$url = 'https://api.descope.com/v1/auth/otp/verify/email';
$data = [
    "loginId" => $email,
    "code"    => $otp_code
];

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer " . $DESCOPE_API_KEY,
    "Content-Type: application/json"
]);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$response = curl_exec($ch);
$code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$resData = json_decode($response, true);

if ($code == 200 && isset($resData['refreshJwt'])) {
    echo json_encode([
        'status'     => 'ok',
        'refreshJwt' => $resData['refreshJwt'],
    ]);
} else {
    $msg = $resData['errorDescription'] ?? 'OTP 인증 실패';
    echo json_encode(['status' => 'fail', 'message' => $msg, 'raw' => $response]);
}