<?php
session_start();
require("../config.php");

if (!isset($_SESSION['SESS_USERID'])) {
    header("Location: login.php");
    exit;
}

$id = $_SESSION['SESS_USERID'];

// Get step from URL (default = 1)
$step = isset($_GET['step']) ? (int)$_GET['step'] : 1;

// Prevent invalid steps
if ($step < 1 || $step > 10) {
    die("Invalid step");
}

// Dynamic column names
$bs_col  = "bs".$step;
$fe_col  = "fe".$step;
$fee_col = "fee".$step;
$bn_col  = "b".$step."n";

// Check access
$stmt = $pdo->prepare("SELECT $bs_col FROM logins WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user || $user[$bs_col] < 1) {
    header("Location: transfer_pin.php");
    exit;
}

require("header.php");
?>

<style>
body {background: linear-gradient(135deg, #0f2027, #203a43, #2c5364); font-family:'Segoe UI',sans-serif;}
.card {border-radius:15px; box-shadow:0 10px 40px rgba(0,0,0,0.3);}
input[type=text] {width:100%; padding:12px; border-radius:8px; border:1px solid #ddd;}
.btn-primary {background: linear-gradient(45deg,#4facfe,#00f2fe); border:none;}
#loader {position:fixed; width:100%; height:100%; background:rgba(0,0,0,.9); display:none; justify-content:center; align-items:center;}
.spinner {width:60px; height:60px; border:6px solid #fff; border-top:6px solid #00f2fe; border-radius:50%; animation:spin 1s linear infinite;}
@keyframes spin {100%{transform:rotate(360deg);}}
</style>

<div class="container py-4">
<div class="row justify-content-center">
<div class="col-md-6">
<div class="card p-4">

<?php
$success = '';
$failed = '';

// Handle form
if (isset($_POST['action'])) {

    $entered_pin = $_POST['pin'] ?? '';

    // Get real PIN
    $stmt = $pdo->prepare("SELECT $fe_col FROM logins WHERE id = ?");
    $stmt->execute([$id]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);

    $real_pin = $row[$fe_col] ?? '';

    if ($entered_pin === $real_pin) {

        // Mark step as completed
        $stmt = $pdo->prepare("UPDATE logins SET $bs_col = 0 WHERE id = ?");
        $stmt->execute([$id]);

        // Decide next page
        if ($step == 10) {
            $next_url = "transfer_pin.php"; // FINAL STEP
        } else {
            $next_step = $step + 1;
            $next_url = "verify.php?step=".$next_step;
        }

        $success = "
        <center>
            <button class='bg-primary p-2 text-white' style='border:none; border-radius:5px'>
                Verifying... Redirecting...
            </button>
            <meta http-equiv='refresh' content='3; url=$next_url' />
        </center>";

    } else {
        $failed = "<div class='alert alert-danger text-center'>Incorrect Code</div>";
    }
}

echo $success ?: $failed;

// Load full user data
$stmt = $pdo->prepare("SELECT * FROM logins WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

$fee = $user[$fee_col] * $rate;
$desc = $user[$bn_col];
?>

<h5 class="text-center mb-4">Enter B<?php echo $step; ?> Code</h5>

<form method="post" id="mainForm">

<div class="form-group">
<label>Cost</label>
<input type="text" value="<?php echo $curr.$fee; ?>" readonly class="form-control">
</div>

<div class="form-group">
<label>Description</label>
<textarea class="form-control" readonly><?php echo $desc; ?></textarea>
</div>

<div class="form-group">
<label>Enter Code</label>
<input type="text" name="pin" required class="form-control">
</div>

<div class="text-center mt-3">
<button type="submit" name="action" class="btn btn-primary">VERIFY</button>
</div>

</form>

</div></div></div></div>

<div id="loader"><div class="spinner"></div></div>

<script>
document.getElementById("mainForm")?.addEventListener("submit", function() {
    document.getElementById("loader").style.display = "flex";
});
</script>

<?php require("footer.php"); ?>