<?php
session_start();
require("../config.php");

if (!isset($_SESSION['SESS_USERID'])) {
    header("Location: login.php");
    exit;
}

$id = $_SESSION['SESS_USERID'];

// Check access
$stmt = $pdo->prepare("SELECT bs2 FROM logins WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if (!$user || $user['bs2'] < 1) {
    header("Location: transfer_pin.php");
    exit;
}
?>

<?php require("header.php"); ?>

<style>
body {background: linear-gradient(135deg, #0f2027, #203a43, #2c5364); font-family:'Segoe UI',sans-serif;}
.card {border-radius:15px; box-shadow:0 10px 40px rgba(0,0,0,0.3); animation:fadeIn .8s ease;}
input[type=text] {width:100%; padding:12px; border-radius:8px; border:1px solid #ddd; transition:.3s;}
input[type=text]:focus {border-color:#4facfe; box-shadow:0 0 10px rgba(79,172,254,.6);}
.btn-primary {background: linear-gradient(45deg,#4facfe,#00f2fe); border:none;}
.btn-primary:hover {transform: scale(1.05);}
#loader {position:fixed; width:100%; height:100%; background:rgba(0,0,0,.9); top:0; left:0; display:none; justify-content:center; align-items:center; z-index:9999;}
.spinner {width:60px; height:60px; border:6px solid #fff; border-top:6px solid #00f2fe; border-radius:50%; animation:spin 1s linear infinite;}
@keyframes spin {100%{transform:rotate(360deg);}}
</style>

<br><br>

<div class="container-fluid py-4">
<div class="row justify-content-center">
<div class="col-md-6 col-lg-5">
<div class="card p-4">
<div class="container">
<br><br><br>

<?php
$success = '';
$failed = '';

if (isset($_POST['action'])) {

    $entered_pin = $_POST['fe2'] ?? '';

    // 🔐 SECURE: get real PIN from DB
    $stmt = $pdo->prepare("SELECT fe2 FROM logins WHERE id = ?");
    $stmt->execute([$id]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);

    $real_pin = $row['fe2'] ?? '';

    if ($entered_pin === $real_pin) {

        // OPTIONAL: mark as used
        $stmt = $pdo->prepare("UPDATE logins SET bs2 = 0 WHERE id = ?");
        $stmt->execute([$id]);

        $success = "
        <center>
            <button class='bg-primary bg-gradient p-2' style='border:none; color:#fff; border-radius:5px'>
                <span class='spinner-border spinner-border-sm'></span>
                Code Granted Successfully... Redirecting...
            </button>
            <meta http-equiv='refresh' content='3; url=b3.php' />
        </center>";

    } else {

        $failed = "
        <div class='alert alert-danger text-center'>
            Incorrect Code. Please try again.
        </div>";
    }
}

// Show message
echo $success ?: $failed;
?>

<?php
$stmt = $pdo->prepare("SELECT * FROM logins WHERE id = ?");
$stmt->execute([$id]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

$fee2 = $user['fee2'] * $rate;  
$b2n = $user['b2n'];

if ($user['bs2'] == 1) {
echo "
<h5 class='text-center mb-4'>Enter $b2 Code</h5>

<form method='post' id='mainForm'>

<div class='form-group'>
<label>$b2 Cost</label>
<input type='text' value='$curr".$fee2."' readonly class='form-control'>
</div>

<div class='form-group'>
<label>Code Description</label>
<textarea class='form-control' readonly>".$b2n."</textarea>
</div>

<div class='form-group'>
<label>Enter Code</label>
<input type='text' name='fe2' placeholder='******' required class='form-control'>
</div>

<div class='text-center mt-3'>
<button type='submit' name='action' class='btn btn-primary btn-block'>VERIFY</button>
<a href='support.php' class='btn btn-light btn-block mt-2'>Need Help?</a>
</div>

</form>";
}
?>

</div></div></div></div></div>

<div id="loader"><div class="spinner"></div></div>

<script>
document.getElementById("mainForm")?.addEventListener("submit", function() {
    document.getElementById("loader").style.display = "flex";
});
</script>

<?php require("footer.php"); ?>