diff --git a/.env.example b/.env.example index c0660ea..bac8af7 100644 --- a/.env.example +++ b/.env.example @@ -63,3 +63,7 @@ AWS_BUCKET= AWS_USE_PATH_STYLE_ENDPOINT=false VITE_APP_NAME="${APP_NAME}" + +SMS_API_URL=http://216.250.14.144:3000/api/data +SMS_API_TIMEOUT=10 +SMS_API_CONNECT_TIMEOUT=5 diff --git a/app/Enums/OtpVerificationResult.php b/app/Enums/OtpVerificationResult.php new file mode 100644 index 0000000..4edfe02 --- /dev/null +++ b/app/Enums/OtpVerificationResult.php @@ -0,0 +1,10 @@ +components([ TextEntry::make('phone') + ->formatStateUsing(fn (string $state): string => format_phone($state)) ->copyable(), TextEntry::make('code') ->copyable(), diff --git a/app/Filament/Resources/Coupons/Tables/CouponsTable.php b/app/Filament/Resources/Coupons/Tables/CouponsTable.php index 6731d9d..99d68c9 100644 --- a/app/Filament/Resources/Coupons/Tables/CouponsTable.php +++ b/app/Filament/Resources/Coupons/Tables/CouponsTable.php @@ -4,7 +4,6 @@ namespace App\Filament\Resources\Coupons\Tables; use App\Filament\Tables\Filters\CreatedAtDateFilter; use Filament\Actions\ViewAction; -use Filament\Actions\DeleteAction; use Filament\Tables\Columns\TextColumn; use Filament\Tables\Table; @@ -18,6 +17,7 @@ class CouponsTable TextColumn::make('id') ->sortable(), TextColumn::make('phone') + ->formatStateUsing(fn (string $state): string => format_phone($state)) ->searchable() ->sortable() ->copyable(), @@ -37,7 +37,6 @@ class CouponsTable ]) ->recordActions([ ViewAction::make(), - DeleteAction::make(), ]); } } diff --git a/app/Filament/Resources/PhoneVerifications/Schemas/PhoneVerificationInfolist.php b/app/Filament/Resources/PhoneVerifications/Schemas/PhoneVerificationInfolist.php index acf5163..1694e75 100644 --- a/app/Filament/Resources/PhoneVerifications/Schemas/PhoneVerificationInfolist.php +++ b/app/Filament/Resources/PhoneVerifications/Schemas/PhoneVerificationInfolist.php @@ -13,9 +13,7 @@ class PhoneVerificationInfolist return $schema ->components([ TextEntry::make('phone') - ->copyable(), - TextEntry::make('otp') - ->label('OTP') + ->formatStateUsing(fn (string $state): string => format_phone($state)) ->copyable(), TextEntry::make('expires_at') ->dateTime(), diff --git a/app/Filament/Resources/PhoneVerifications/Tables/PhoneVerificationsTable.php b/app/Filament/Resources/PhoneVerifications/Tables/PhoneVerificationsTable.php index 9563426..a40fe17 100644 --- a/app/Filament/Resources/PhoneVerifications/Tables/PhoneVerificationsTable.php +++ b/app/Filament/Resources/PhoneVerifications/Tables/PhoneVerificationsTable.php @@ -4,7 +4,6 @@ namespace App\Filament\Resources\PhoneVerifications\Tables; use App\Filament\Tables\Filters\CreatedAtDateFilter; use Filament\Actions\ViewAction; -use Filament\Actions\DeleteAction; use Filament\Tables\Columns\IconColumn; use Filament\Tables\Columns\TextColumn; use Filament\Tables\Table; @@ -19,12 +18,10 @@ class PhoneVerificationsTable TextColumn::make('id') ->sortable(), TextColumn::make('phone') + ->formatStateUsing(fn (string $state): string => format_phone($state)) ->searchable() ->sortable() ->copyable(), - TextColumn::make('otp') - ->label('OTP') - ->copyable(), TextColumn::make('expires_at') ->dateTime() ->sortable(), @@ -44,7 +41,6 @@ class PhoneVerificationsTable ]) ->recordActions([ ViewAction::make(), - DeleteAction::make(), ]); } } diff --git a/app/Helpers/helpers.php b/app/Helpers/helpers.php index e3d2a7b..499e88e 100644 --- a/app/Helpers/helpers.php +++ b/app/Helpers/helpers.php @@ -1,6 +1,8 @@ $exception->getMessage(), - 'line' => $exception->getLine(), - ]); + try { + $response = Http::timeout(config('services.sms.timeout')) + ->connectTimeout(config('services.sms.connect_timeout')) + ->retry( + times: 3, + sleepMilliseconds: 50, + throw: false, + when: function (Throwable $exception, PendingRequest $request): bool { + if ($exception instanceof ConnectionException) { + return true; + } - return true; + if ($exception instanceof RequestException) { + return $exception->response->serverError(); + } + + return false; + } + ) + ->post(config('services.sms.url'), [ + 'phone' => '+993'.$phone, + 'code' => $message, + ]); + + if (! $response->successful()) { + Log::error('SMS API request failed', [ + 'status' => $response->status(), + 'body' => $response->body(), + ]); + + return false; } - ) - ->post('http://216.250.14.144:3000/api/data', [ - 'phone' => '+993' . $phone, - 'code' => $message, + + return true; + } catch (Throwable $exception) { + Log::error('SMS API exception', [ + 'message' => $exception->getMessage(), ]); - return $response->body(); + return false; + } } } @@ -38,19 +62,36 @@ if (! function_exists('unmask_phone')) { */ function unmask_phone(string $phone): string { - // Keep digits only $digits = preg_replace('/\D+/', '', $phone); - // Remove Turkmenistan country code if present if (str_starts_with($digits, '993')) { $digits = substr($digits, 3); } - // Return only valid 8-digit TM mobile number if (preg_match('/^6\d{7}$/', $digits)) { return $digits; } return ''; } -} \ No newline at end of file +} + +if (! function_exists('format_phone')) { + /** + * Format an 8-digit TM mobile number for display (+993 6X XX XX XX). + */ + function format_phone(string $phone): string + { + if (! preg_match('/^6\d{7}$/', $phone)) { + return $phone; + } + + return sprintf( + '+993 %s %s %s %s', + substr($phone, 0, 2), + substr($phone, 2, 2), + substr($phone, 4, 2), + substr($phone, 6, 2), + ); + } +} diff --git a/app/Http/Controllers/VerificationController.php b/app/Http/Controllers/VerificationController.php index b46921f..643817a 100644 --- a/app/Http/Controllers/VerificationController.php +++ b/app/Http/Controllers/VerificationController.php @@ -2,75 +2,61 @@ namespace App\Http\Controllers; -use Illuminate\Http\Request; -use App\Models\PhoneVerification; +use App\Enums\OtpVerificationResult; +use App\Http\Requests\SendOtpRequest; +use App\Http\Requests\VerifyOtpRequest; use App\Models\Coupon; -use Illuminate\Support\Str; -use Illuminate\Support\Facades\Log; +use App\Services\CouponService; +use App\Services\OtpService; +use Illuminate\Contracts\View\View; +use Illuminate\Http\RedirectResponse; +use Illuminate\Http\Request; +use Symfony\Component\HttpFoundation\Cookie; class VerificationController extends Controller { - public function index() - { - if (request()->cookie('device_registered')) { - return redirect()->route('verification.congratulations'); - } + private const DEVICE_COOKIE_NAME = 'device_registered'; - if (session()->has('coupon_code')) { - return redirect()->route('verification.congratulations'); + public function __construct( + private OtpService $otpService, + private CouponService $couponService, + ) {} + + public function index(): View|RedirectResponse + { + if ($redirect = $this->redirectIfAlreadyRegistered()) { + return $redirect; } return view('verification.index'); } - public function sendOtp(Request $request) + public function sendOtp(SendOtpRequest $request): RedirectResponse { - if ($request->cookie('device_registered')) { + if ($request->cookie(self::DEVICE_COOKIE_NAME)) { return back()->withErrors(['phone' => 'Siz eýýäm agza bolduňyz.']); } - $request->validate([ - 'phone' => ['required', 'regex:/^\+993 [67]\d \d{2} \d{2} \d{2}$/'] - ], [ - 'phone.regex' => 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).' - ]); - - $phone = unmask_phone($request->phone); + $phone = $request->unmaskedPhone(); $existingCoupon = Coupon::query()->where('phone', $phone)->first(); if ($existingCoupon) { return back()->withErrors(['phone' => 'Bu telefon belgisi eýýäm ulanyldy.'])->withInput(); } - - // Generate a 4-digit OTP - $otp = (string) rand(1000, 9999); - - // Store in DB - PhoneVerification::updateOrCreate( - ['phone' => $phone], - [ - 'otp' => $otp, - 'expires_at' => now()->addMinutes(10), - 'verified' => false - ] - ); - sendSMS($phone, 'Tassyklaýyş belgi: ' . $otp); + if (! $this->otpService->issue($phone)) { + return back()->withErrors(['phone' => 'SMS iberilmedi. Soňrak synanyşyň.'])->withInput(); + } - // Store phone in session for the next step session()->put('verify_phone', $phone); return redirect()->route('verification.verify.form'); } - public function verifyForm() + public function verifyForm(): View|RedirectResponse { - if (request()->cookie('device_registered')) { - return redirect()->route('verification.congratulations'); - } - - if (session()->has('coupon_code')) { - return redirect()->route('verification.congratulations'); + if ($redirect = $this->redirectIfAlreadyRegistered()) { + return $redirect; } if (! session()->has('verify_phone')) { @@ -78,105 +64,137 @@ class VerificationController extends Controller } return view('verification.verify', [ - 'phone' => session()->get('verify_phone') + 'phone' => session()->get('verify_phone'), ]); } - public function resendOtp() + public function resendOtp(Request $request): RedirectResponse { + if ($request->cookie(self::DEVICE_COOKIE_NAME)) { + return redirect()->route('verification.congratulations'); + } + $phone = session()->get('verify_phone'); - if (!$phone) { + if (! $phone) { return redirect()->route('verification.index'); } - // Generate a 4-digit OTP - $otp = (string) rand(1000, 9999); - - // Store in DB - PhoneVerification::updateOrCreate( - ['phone' => $phone], - [ - 'otp' => $otp, - 'expires_at' => now()->addMinutes(10), - 'verified' => false - ] - ); + if (Coupon::query()->where('phone', $phone)->exists()) { + return redirect()->route('verification.congratulations'); + } - sendSMS($phone, $otp); + if (! $this->otpService->issue($phone)) { + return back()->withErrors(['otp' => 'SMS iberilmedi. Soňrak synanyşyň.']); + } return back()->with('status', 'Täze kod iberildi!'); } - public function verifyOtp(Request $request) + public function verifyOtp(VerifyOtpRequest $request): RedirectResponse { - $request->validate([ - 'phone' => 'required', - 'otp' => 'required|digits:4' - ]); + $phone = session()->get('verify_phone'); - $verification = PhoneVerification::query()->where('phone', $request->phone)->first(); - - if (!$verification || $verification->otp !== $request->otp) { - return back()->withErrors(['otp' => 'Nädogry kod.']); + if (! $phone) { + return redirect()->route('verification.index'); } - if ($verification->expires_at < now()) { + $result = $this->otpService->verify($phone, $request->string('otp')->toString()); + + if ($result === OtpVerificationResult::Expired) { return back()->withErrors(['otp' => 'Kodyň möhleti gutardy.']); } - // Mark as verified - $verification->update(['verified' => true]); + if ($result === OtpVerificationResult::Invalid) { + return back()->withErrors(['otp' => 'Nädogry kod.']); + } - // Generate or get Coupon - $coupon = Coupon::firstOrCreate( - ['phone' => $request->phone], - ['code' => $this->generateCouponCode()] - ); + $coupon = $this->couponService->findOrCreateForPhone($phone); - // Put coupon code in session for the congratulations page session()->put('coupon_code', $coupon->code); - // We set a long-lived cookie to mark this device as registered (e.g. 5 years) - return redirect()->route('verification.congratulations') - ->cookie('device_registered', 'true', 60 * 24 * 365 * 5); + return redirect() + ->route('verification.congratulations') + ->withCookie($this->makeDeviceCookie($phone)); } - public function congratulations() + public function congratulations(): View|RedirectResponse { - // If they have the cookie but lost the session, we don't know their code unless we query - // But for simplicity based on the flow, we'll try to find it by phone if available - if (!session()->has('coupon_code') && !request()->cookie('device_registered')) { + if (! session()->has('coupon_code') && ! request()->cookie(self::DEVICE_COOKIE_NAME)) { return redirect()->route('verification.index'); } $code = session()->get('coupon_code'); - if (!$code && session()->has('verify_phone')) { - $coupon = Coupon::query()->where('phone', session()->get('verify_phone'))->first(); - if ($coupon) { - $code = $coupon->code; - session()->put('coupon_code', $code); - } + if (! $code) { + $phone = $this->phoneFromDeviceCookie(); + + if ($phone) { + $coupon = Coupon::query()->where('phone', $phone)->first(); + if ($coupon) { + $code = $coupon->code; + session()->put('coupon_code', $code); + } + } } - // If for some reason code is completely lost (e.g. cookie exists but session cleared and no phone), - // we can't show a specific code. In this specific scenario, we'll default to redirecting back. - if (!$code) { - return redirect()->route('verification.index')->withoutCookie('device_registered'); + if (! $code && session()->has('verify_phone')) { + $coupon = Coupon::query()->where('phone', session()->get('verify_phone'))->first(); + if ($coupon) { + $code = $coupon->code; + session()->put('coupon_code', $code); + } + } + + if (! $code) { + return redirect() + ->route('verification.index') + ->withoutCookie(self::DEVICE_COOKIE_NAME); } return view('verification.congratulations', [ - 'code' => $code + 'code' => $code, ]); } - private function generateCouponCode() + private function redirectIfAlreadyRegistered(): ?RedirectResponse { - // Format X_YYYY (X is integer, Y is capital char) - $x = rand(1, 9); - $yyyy = substr(str_shuffle("ABCDEFGHIJKLMNOPQRSTUVWXYZ"), 0, 4); + if (request()->cookie(self::DEVICE_COOKIE_NAME) || session()->has('coupon_code')) { + return redirect()->route('verification.congratulations'); + } - return "{$x}_{$yyyy}"; + return null; + } + + private function makeDeviceCookie(string $phone): Cookie + { + return cookie( + self::DEVICE_COOKIE_NAME, + encrypt($phone), + 60 * 24 * 365 * 5, + '/', + null, + null, + true, + false, + 'lax', + ); + } + + private function phoneFromDeviceCookie(): ?string + { + $value = request()->cookie(self::DEVICE_COOKIE_NAME); + + if (! $value) { + return null; + } + + try { + $phone = decrypt($value); + + return is_string($phone) && preg_match('/^6\d{7}$/', $phone) ? $phone : null; + } catch (\Throwable) { + return null; + } } } diff --git a/app/Http/Requests/SendOtpRequest.php b/app/Http/Requests/SendOtpRequest.php new file mode 100644 index 0000000..a6e4875 --- /dev/null +++ b/app/Http/Requests/SendOtpRequest.php @@ -0,0 +1,52 @@ +> + */ + public function rules(): array + { + return [ + 'phone' => ['required', 'regex:/^\+993 [67]\d \d{2} \d{2} \d{2}$/'], + ]; + } + + /** + * @return array + */ + public function messages(): array + { + return [ + 'phone.regex' => 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).', + ]; + } + + public function withValidator(Validator $validator): void + { + $validator->after(function (Validator $validator): void { + if ($validator->errors()->isNotEmpty()) { + return; + } + + if (unmask_phone($this->string('phone')->toString()) === '') { + $validator->errors()->add('phone', 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).'); + } + }); + } + + public function unmaskedPhone(): string + { + return unmask_phone($this->string('phone')->toString()); + } +} diff --git a/app/Http/Requests/VerifyOtpRequest.php b/app/Http/Requests/VerifyOtpRequest.php new file mode 100644 index 0000000..6cc4410 --- /dev/null +++ b/app/Http/Requests/VerifyOtpRequest.php @@ -0,0 +1,23 @@ +> + */ + public function rules(): array + { + return [ + 'otp' => ['required', 'digits:4'], + ]; + } +} diff --git a/app/Models/Coupon.php b/app/Models/Coupon.php index 9bcd727..4bf1756 100644 --- a/app/Models/Coupon.php +++ b/app/Models/Coupon.php @@ -2,9 +2,20 @@ namespace App\Models; +use Database\Factories\CouponFactory; +use Illuminate\Database\Eloquent\Factories\HasFactory; use Illuminate\Database\Eloquent\Model; +use Illuminate\Database\Eloquent\Relations\HasOne; class Coupon extends Model { + /** @use HasFactory */ + use HasFactory; + protected $fillable = ['phone', 'code']; + + public function phoneVerification(): HasOne + { + return $this->hasOne(PhoneVerification::class, 'phone', 'phone'); + } } diff --git a/app/Models/PhoneVerification.php b/app/Models/PhoneVerification.php index bded4b3..35373d6 100644 --- a/app/Models/PhoneVerification.php +++ b/app/Models/PhoneVerification.php @@ -2,13 +2,28 @@ namespace App\Models; +use Database\Factories\PhoneVerificationFactory; +use Illuminate\Database\Eloquent\Factories\HasFactory; use Illuminate\Database\Eloquent\Model; +use Illuminate\Database\Eloquent\Relations\HasOne; class PhoneVerification extends Model { + /** @use HasFactory */ + use HasFactory; + protected $fillable = ['phone', 'otp', 'expires_at', 'verified']; - protected $casts = [ - 'expires_at' => 'datetime', - 'verified' => 'boolean' - ]; + + protected function casts(): array + { + return [ + 'expires_at' => 'datetime', + 'verified' => 'boolean', + ]; + } + + public function coupon(): HasOne + { + return $this->hasOne(Coupon::class, 'phone', 'phone'); + } } diff --git a/app/Services/CouponService.php b/app/Services/CouponService.php new file mode 100644 index 0000000..b22c243 --- /dev/null +++ b/app/Services/CouponService.php @@ -0,0 +1,45 @@ +where('phone', $phone)->first(); + + if ($existing) { + return $existing; + } + + return $this->createWithUniqueCode($phone); + } + + private function createWithUniqueCode(string $phone): Coupon + { + for ($attempt = 0; $attempt < 10; $attempt++) { + try { + return Coupon::query()->create([ + 'phone' => $phone, + 'code' => $this->generateCouponCode(), + ]); + } catch (UniqueConstraintViolationException) { + continue; + } + } + + throw new \RuntimeException('Unable to generate a unique coupon code.'); + } + + private function generateCouponCode(): string + { + $x = random_int(1, 9); + $yyyy = Str::upper(Str::random(4)); + + return "{$x}_{$yyyy}"; + } +} diff --git a/app/Services/OtpService.php b/app/Services/OtpService.php new file mode 100644 index 0000000..02c4701 --- /dev/null +++ b/app/Services/OtpService.php @@ -0,0 +1,54 @@ +generateOtp(); + + PhoneVerification::query()->updateOrCreate( + ['phone' => $phone], + [ + 'otp' => Hash::make($otp), + 'expires_at' => now()->addMinutes(self::OTP_EXPIRY_MINUTES), + 'verified' => false, + ], + ); + + return sendSMS($phone, 'Tassyklaýyş belgi: '.$otp); + } + + public function verify(string $phone, string $otp): OtpVerificationResult + { + $verification = PhoneVerification::query()->where('phone', $phone)->first(); + + if (! $verification) { + return OtpVerificationResult::Invalid; + } + + if ($verification->expires_at->isPast()) { + return OtpVerificationResult::Expired; + } + + if (! Hash::check($otp, $verification->otp)) { + return OtpVerificationResult::Invalid; + } + + $verification->update(['verified' => true]); + + return OtpVerificationResult::Verified; + } + + private function generateOtp(): string + { + return (string) random_int(1000, 9999); + } +} diff --git a/config/services.php b/config/services.php index 6a90eb8..539563f 100644 --- a/config/services.php +++ b/config/services.php @@ -35,4 +35,10 @@ return [ ], ], + 'sms' => [ + 'url' => env('SMS_API_URL', 'http://216.250.14.144:3000/api/data'), + 'timeout' => (int) env('SMS_API_TIMEOUT', 10), + 'connect_timeout' => (int) env('SMS_API_CONNECT_TIMEOUT', 5), + ], + ]; diff --git a/database/factories/CouponFactory.php b/database/factories/CouponFactory.php new file mode 100644 index 0000000..fdff13d --- /dev/null +++ b/database/factories/CouponFactory.php @@ -0,0 +1,26 @@ + + */ +class CouponFactory extends Factory +{ + protected $model = Coupon::class; + + /** + * @return array + */ + public function definition(): array + { + return [ + 'phone' => '6'.fake()->unique()->numerify('#######'), + 'code' => random_int(1, 9).'_'.Str::upper(Str::random(4)), + ]; + } +} diff --git a/database/factories/PhoneVerificationFactory.php b/database/factories/PhoneVerificationFactory.php new file mode 100644 index 0000000..55e118e --- /dev/null +++ b/database/factories/PhoneVerificationFactory.php @@ -0,0 +1,42 @@ + + */ +class PhoneVerificationFactory extends Factory +{ + protected $model = PhoneVerification::class; + + /** + * @return array + */ + public function definition(): array + { + return [ + 'phone' => '6'.fake()->unique()->numerify('#######'), + 'otp' => Hash::make('1234'), + 'expires_at' => now()->addMinutes(10), + 'verified' => false, + ]; + } + + public function expired(): static + { + return $this->state(fn (array $attributes) => [ + 'expires_at' => now()->subMinute(), + ]); + } + + public function withOtp(string $otp): static + { + return $this->state(fn (array $attributes) => [ + 'otp' => Hash::make($otp), + ]); + } +} diff --git a/resources/views/verification/congratulations.blade.php b/resources/views/verification/congratulations.blade.php index ff75a6a..bee3b6f 100644 --- a/resources/views/verification/congratulations.blade.php +++ b/resources/views/verification/congratulations.blade.php @@ -138,18 +138,26 @@ } } + let animationFrameId; + function animateConfetti() { ctx.clearRect(0, 0, canvas.width, canvas.height); particles.forEach(p => { p.update(); p.draw(); }); - requestAnimationFrame(animateConfetti); + animationFrameId = requestAnimationFrame(animateConfetti); } initConfetti(); animateConfetti(); + setTimeout(() => { + cancelAnimationFrame(animationFrameId); + particles = []; + ctx.clearRect(0, 0, canvas.width, canvas.height); + }, 10000); + // Copy Functionality function copyCode() { const code = document.getElementById('couponCode').innerText; diff --git a/resources/views/verification/verify.blade.php b/resources/views/verification/verify.blade.php index 9ac26f1..3c4c2f3 100644 --- a/resources/views/verification/verify.blade.php +++ b/resources/views/verification/verify.blade.php @@ -35,7 +35,7 @@

Belgiňizi tassyklaň

- Şu belgä iberilen 4 sanly kody giriziň: +933 {{ $phone }} + Şu belgä iberilen 4 sanly kody giriziň: {{ format_phone($phone) }}

@@ -53,7 +53,6 @@
@csrf - @@ -121,20 +120,20 @@ }); }); - verifyBtn.addEventListener('click', () => { + form.addEventListener('submit', (e) => { let code = ''; inputs.forEach(input => code += input.value); - if (code.length === 4) { - hiddenOtp.value = code; - - verifyBtn.innerHTML = ' Tassyklanýar...'; - - setTimeout(() => { - form.submit(); - }, 500); // small delay to show animation - } else { + + if (code.length !== 4) { + e.preventDefault(); alert('Haýyş, 4 sanly kody giriziň.'); + return; } + + hiddenOtp.value = code; + + verifyBtn.disabled = true; + verifyBtn.innerHTML = ' Tassyklanýar...'; }); // Resend OTP Countdown Logic diff --git a/routes/web.php b/routes/web.php index f1f580d..715d814 100644 --- a/routes/web.php +++ b/routes/web.php @@ -1,11 +1,17 @@ name('verification.index'); -Route::post('/send-otp', [VerificationController::class, 'sendOtp'])->name('verification.send'); +Route::post('/send-otp', [VerificationController::class, 'sendOtp']) + ->middleware('throttle:3,1') + ->name('verification.send'); Route::get('/verify', [VerificationController::class, 'verifyForm'])->name('verification.verify.form'); -Route::post('/verify', [VerificationController::class, 'verifyOtp'])->name('verification.verify'); -Route::post('/resend-otp', [VerificationController::class, 'resendOtp'])->name('verification.resend'); +Route::post('/verify', [VerificationController::class, 'verifyOtp']) + ->middleware('throttle:10,1') + ->name('verification.verify'); +Route::post('/resend-otp', [VerificationController::class, 'resendOtp']) + ->middleware('throttle:3,1') + ->name('verification.resend'); Route::get('/congratulations', [VerificationController::class, 'congratulations'])->name('verification.congratulations'); diff --git a/tests/Feature/VerificationFlowTest.php b/tests/Feature/VerificationFlowTest.php new file mode 100644 index 0000000..21dac10 --- /dev/null +++ b/tests/Feature/VerificationFlowTest.php @@ -0,0 +1,173 @@ + Http::response('ok', 200), + ]); + } + + public function test_index_page_loads_for_new_visitors(): void + { + $this->get(route('verification.index')) + ->assertOk() + ->assertViewIs('verification.index'); + } + + public function test_send_otp_starts_verification_flow(): void + { + $this->post(route('verification.send'), ['phone' => self::PHONE]) + ->assertRedirect(route('verification.verify.form')); + + $this->assertDatabaseHas(PhoneVerification::class, [ + 'phone' => self::UNMASKED_PHONE, + 'verified' => false, + ]); + + Http::assertSentCount(1); + } + + public function test_send_otp_rejects_duplicate_phone(): void + { + Coupon::factory()->create(['phone' => self::UNMASKED_PHONE]); + + $this->from(route('verification.index')) + ->post(route('verification.send'), ['phone' => self::PHONE]) + ->assertRedirect(route('verification.index')) + ->assertSessionHasErrors('phone'); + } + + public function test_send_otp_rejects_invalid_phone_format(): void + { + $this->from(route('verification.index')) + ->post(route('verification.send'), ['phone' => '+993 81 23 45 67']) + ->assertRedirect(route('verification.index')) + ->assertSessionHasErrors('phone'); + } + + public function test_verify_form_requires_session_phone(): void + { + $this->get(route('verification.verify.form')) + ->assertRedirect(route('verification.index')); + } + + public function test_full_verification_flow_issues_coupon(): void + { + $this->post(route('verification.send'), ['phone' => self::PHONE]) + ->assertRedirect(route('verification.verify.form')); + + $otp = $this->extractOtpFromLastSms(); + + $this->get(route('verification.verify.form'))->assertOk(); + + $this->post(route('verification.verify'), ['otp' => $otp]) + ->assertRedirect(route('verification.congratulations')) + ->assertCookie('device_registered'); + + $this->assertDatabaseHas(Coupon::class, [ + 'phone' => self::UNMASKED_PHONE, + ]); + + $this->get(route('verification.congratulations')) + ->assertOk() + ->assertViewHas('code'); + } + + public function test_verify_otp_rejects_wrong_code(): void + { + PhoneVerification::factory() + ->withOtp('1234') + ->create(['phone' => self::UNMASKED_PHONE]); + + $this->withSession(['verify_phone' => self::UNMASKED_PHONE]) + ->from(route('verification.verify.form')) + ->post(route('verification.verify'), ['otp' => '9999']) + ->assertRedirect(route('verification.verify.form')) + ->assertSessionHasErrors('otp'); + } + + public function test_verify_otp_rejects_expired_code(): void + { + PhoneVerification::factory() + ->withOtp('1234') + ->expired() + ->create(['phone' => self::UNMASKED_PHONE]); + + $this->withSession(['verify_phone' => self::UNMASKED_PHONE]) + ->from(route('verification.verify.form')) + ->post(route('verification.verify'), ['otp' => '1234']) + ->assertRedirect(route('verification.verify.form')) + ->assertSessionHasErrors(['otp' => 'Kodyň möhleti gutardy.']); + } + + public function test_verify_otp_requires_session_phone(): void + { + $this->post(route('verification.verify'), ['otp' => '1234']) + ->assertRedirect(route('verification.index')); + } + + public function test_resend_otp_sends_new_sms(): void + { + $this->withSession(['verify_phone' => self::UNMASKED_PHONE]) + ->from(route('verification.verify.form')) + ->post(route('verification.resend')) + ->assertRedirect(route('verification.verify.form')) + ->assertSessionHas('status'); + + Http::assertSentCount(1); + } + + public function test_congratulations_recovers_coupon_from_device_cookie(): void + { + $coupon = Coupon::factory()->create(['phone' => self::UNMASKED_PHONE]); + + $this->withCookie('device_registered', encrypt(self::UNMASKED_PHONE)) + ->get(route('verification.congratulations')) + ->assertOk() + ->assertViewIs('verification.congratulations') + ->assertSee($coupon->code); + } + + public function test_send_otp_is_rate_limited(): void + { + for ($i = 0; $i < 3; $i++) { + $this->post(route('verification.send'), ['phone' => self::PHONE]); + } + + $this->post(route('verification.send'), ['phone' => self::PHONE]) + ->assertStatus(429); + } + + private function extractOtpFromLastSms(): string + { + $recorded = Http::recorded()->all(); + + $this->assertNotEmpty($recorded); + + [$request] = $recorded[array_key_last($recorded)]; + + preg_match('/(\d{4})/', (string) $request->data()['code'], $matches); + + $this->assertNotEmpty($matches[1]); + + return $matches[1]; + } +}