good

.env.example

@@ -63,3 +63,7 @@ AWS_BUCKET=
 AWS_USE_PATH_STYLE_ENDPOINT=false
 
 VITE_APP_NAME="${APP_NAME}"
+
+SMS_API_URL=http://216.250.14.144:3000/api/data
+SMS_API_TIMEOUT=10
+SMS_API_CONNECT_TIMEOUT=5

app/Enums/OtpVerificationResult.php

@@ -0,0 +1,10 @@
+<?php
+
+namespace App\Enums;
+
+enum OtpVerificationResult
+{
+    case Verified;
+    case Invalid;
+    case Expired;
+}

app/Filament/Resources/Coupons/Schemas/CouponInfolist.php

@@ -12,6 +12,7 @@ class CouponInfolist
         return $schema
             ->components([
                 TextEntry::make('phone')
+                    ->formatStateUsing(fn (string $state): string => format_phone($state))
                     ->copyable(),
                 TextEntry::make('code')
                     ->copyable(),

app/Filament/Resources/Coupons/Tables/CouponsTable.php

@@ -4,7 +4,6 @@ namespace App\Filament\Resources\Coupons\Tables;
 
 use App\Filament\Tables\Filters\CreatedAtDateFilter;
 use Filament\Actions\ViewAction;
-use Filament\Actions\DeleteAction;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
 
@@ -18,6 +17,7 @@ class CouponsTable
                 TextColumn::make('id')
                     ->sortable(),
                 TextColumn::make('phone')
+                    ->formatStateUsing(fn (string $state): string => format_phone($state))
                     ->searchable()
                     ->sortable()
                     ->copyable(),
@@ -37,7 +37,6 @@ class CouponsTable
             ])
             ->recordActions([
                 ViewAction::make(),
-                DeleteAction::make(),
             ]);
     }
 }

app/Filament/Resources/PhoneVerifications/Schemas/PhoneVerificationInfolist.php

@@ -13,9 +13,7 @@ class PhoneVerificationInfolist
         return $schema
             ->components([
                 TextEntry::make('phone')
-                    ->copyable(),
+                    ->formatStateUsing(fn (string $state): string => format_phone($state))
-                TextEntry::make('otp')
-                    ->label('OTP')
                     ->copyable(),
                 TextEntry::make('expires_at')
                     ->dateTime(),

app/Filament/Resources/PhoneVerifications/Tables/PhoneVerificationsTable.php

@@ -4,7 +4,6 @@ namespace App\Filament\Resources\PhoneVerifications\Tables;
 
 use App\Filament\Tables\Filters\CreatedAtDateFilter;
 use Filament\Actions\ViewAction;
-use Filament\Actions\DeleteAction;
 use Filament\Tables\Columns\IconColumn;
 use Filament\Tables\Columns\TextColumn;
 use Filament\Tables\Table;
@@ -19,12 +18,10 @@ class PhoneVerificationsTable
                 TextColumn::make('id')
                     ->sortable(),
                 TextColumn::make('phone')
+                    ->formatStateUsing(fn (string $state): string => format_phone($state))
                     ->searchable()
                     ->sortable()
                     ->copyable(),
-                TextColumn::make('otp')
-                    ->label('OTP')
-                    ->copyable(),
                 TextColumn::make('expires_at')
                     ->dateTime()
                     ->sortable(),
@@ -44,7 +41,6 @@ class PhoneVerificationsTable
             ])
             ->recordActions([
                 ViewAction::make(),
-                DeleteAction::make(),
             ]);
     }
 }

app/Helpers/helpers.php

@@ -1,6 +1,8 @@
 <?php
 
+use Illuminate\Http\Client\ConnectionException;
 use Illuminate\Http\Client\PendingRequest;
+use Illuminate\Http\Client\RequestException;
 use Illuminate\Support\Facades\Http;
 use Illuminate\Support\Facades\Log;
 
@@ -8,27 +10,49 @@ if (! function_exists('sendSMS')) {
     /**
      * Send a sms
      */
-    function sendSMS(string|int $phone, string|int $message): mixed
+    function sendSMS(string|int $phone, string|int $message): bool
     {
-        $response = Http::retry(
+        try {
-            times: 3,
+            $response = Http::timeout(config('services.sms.timeout'))
-            sleepMilliseconds: 50,
+                ->connectTimeout(config('services.sms.connect_timeout'))
-            throw: false,
+                ->retry(
-            when: function (Exception $exception, PendingRequest $request) {
+                    times: 3,
-                Log::error('Exception: ', [
+                    sleepMilliseconds: 50,
-                        'message' => $exception->getMessage(),
+                    throw: false,
-                        'line' => $exception->getLine(),
+                    when: function (Throwable $exception, PendingRequest $request): bool {
-                    ]);
+                        if ($exception instanceof ConnectionException) {
+                            return true;
+                        }
 
-                return true;
+                        if ($exception instanceof RequestException) {
+                            return $exception->response->serverError();
+                        }
+
+                        return false;
+                    }
+                )
+                ->post(config('services.sms.url'), [
+                    'phone' => '+993'.$phone,
+                    'code' => $message,
+                ]);
+
+            if (! $response->successful()) {
+                Log::error('SMS API request failed', [
+                    'status' => $response->status(),
+                    'body' => $response->body(),
+                ]);
+
+                return false;
             }
-        )
+
-            ->post('http://216.250.14.144:3000/api/data', [
+            return true;
-                'phone' => '+993' . $phone,
+        } catch (Throwable $exception) {
-                'code' => $message,
+            Log::error('SMS API exception', [
+                'message' => $exception->getMessage(),
             ]);
 
-        return $response->body();
+            return false;
+        }
     }
 }
 
@@ -38,15 +62,12 @@ if (! function_exists('unmask_phone')) {
      */
     function unmask_phone(string $phone): string
     {
-        // Keep digits only
         $digits = preg_replace('/\D+/', '', $phone);
 
-        // Remove Turkmenistan country code if present
         if (str_starts_with($digits, '993')) {
             $digits = substr($digits, 3);
         }
 
-        // Return only valid 8-digit TM mobile number
         if (preg_match('/^6\d{7}$/', $digits)) {
             return $digits;
         }
@@ -54,3 +75,23 @@ if (! function_exists('unmask_phone')) {
         return '';
     }
 }
+
+if (! function_exists('format_phone')) {
+    /**
+     * Format an 8-digit TM mobile number for display (+993 6X XX XX XX).
+     */
+    function format_phone(string $phone): string
+    {
+        if (! preg_match('/^6\d{7}$/', $phone)) {
+            return $phone;
+        }
+
+        return sprintf(
+            '+993 %s %s %s %s',
+            substr($phone, 0, 2),
+            substr($phone, 2, 2),
+            substr($phone, 4, 2),
+            substr($phone, 6, 2),
+        );
+    }
+}

app/Http/Controllers/VerificationController.php

@@ -2,75 +2,61 @@
 
 namespace App\Http\Controllers;
 
-use Illuminate\Http\Request;
+use App\Enums\OtpVerificationResult;
-use App\Models\PhoneVerification;
+use App\Http\Requests\SendOtpRequest;
+use App\Http\Requests\VerifyOtpRequest;
 use App\Models\Coupon;
-use Illuminate\Support\Str;
+use App\Services\CouponService;
-use Illuminate\Support\Facades\Log;
+use App\Services\OtpService;
+use Illuminate\Contracts\View\View;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Cookie;
 
 class VerificationController extends Controller
 {
-    public function index()
+    private const DEVICE_COOKIE_NAME = 'device_registered';
-    {
-        if (request()->cookie('device_registered')) {
-            return redirect()->route('verification.congratulations');
-        }
 
-        if (session()->has('coupon_code')) {
+    public function __construct(
-            return redirect()->route('verification.congratulations');
+        private OtpService $otpService,
+        private CouponService $couponService,
+    ) {}
+
+    public function index(): View|RedirectResponse
+    {
+        if ($redirect = $this->redirectIfAlreadyRegistered()) {
+            return $redirect;
         }
 
         return view('verification.index');
     }
 
-    public function sendOtp(Request $request)
+    public function sendOtp(SendOtpRequest $request): RedirectResponse
     {
-        if ($request->cookie('device_registered')) {
+        if ($request->cookie(self::DEVICE_COOKIE_NAME)) {
             return back()->withErrors(['phone' => 'Siz eýýäm agza bolduňyz.']);
         }
 
-        $request->validate([
+        $phone = $request->unmaskedPhone();
-            'phone' => ['required', 'regex:/^\+993 [67]\d \d{2} \d{2} \d{2}$/']
-        ], [
-            'phone.regex' => 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).'
-        ]);
-
-        $phone = unmask_phone($request->phone);
 
         $existingCoupon = Coupon::query()->where('phone', $phone)->first();
         if ($existingCoupon) {
             return back()->withErrors(['phone' => 'Bu telefon belgisi eýýäm ulanyldy.'])->withInput();
         }
 
-        // Generate a 4-digit OTP
+        if (! $this->otpService->issue($phone)) {
-        $otp = (string) rand(1000, 9999);
+            return back()->withErrors(['phone' => 'SMS iberilmedi. Soňrak synanyşyň.'])->withInput();
+        }
 
-        // Store in DB
-        PhoneVerification::updateOrCreate(
-            ['phone' => $phone],
-            [
-                'otp' => $otp,
-                'expires_at' => now()->addMinutes(10),
-                'verified' => false
-            ]
-        );
-
-        sendSMS($phone, 'Tassyklaýyş belgi: ' . $otp);
-
-        // Store phone in session for the next step
         session()->put('verify_phone', $phone);
 
         return redirect()->route('verification.verify.form');
     }
 
-    public function verifyForm()
+    public function verifyForm(): View|RedirectResponse
     {
-        if (request()->cookie('device_registered')) {
+        if ($redirect = $this->redirectIfAlreadyRegistered()) {
-            return redirect()->route('verification.congratulations');
+            return $redirect;
-        }
-
-        if (session()->has('coupon_code')) {
-            return redirect()->route('verification.congratulations');
         }
 
         if (! session()->has('verify_phone')) {
@@ -78,105 +64,137 @@ class VerificationController extends Controller
         }
 
         return view('verification.verify', [
-            'phone' => session()->get('verify_phone')
+            'phone' => session()->get('verify_phone'),
         ]);
     }
 
-    public function resendOtp()
+    public function resendOtp(Request $request): RedirectResponse
     {
+        if ($request->cookie(self::DEVICE_COOKIE_NAME)) {
+            return redirect()->route('verification.congratulations');
+        }
+
         $phone = session()->get('verify_phone');
 
-        if (!$phone) {
+        if (! $phone) {
             return redirect()->route('verification.index');
         }
 
-        // Generate a 4-digit OTP
+        if (Coupon::query()->where('phone', $phone)->exists()) {
-        $otp = (string) rand(1000, 9999);
+            return redirect()->route('verification.congratulations');
+        }
 
-        // Store in DB
+        if (! $this->otpService->issue($phone)) {
-        PhoneVerification::updateOrCreate(
+            return back()->withErrors(['otp' => 'SMS iberilmedi. Soňrak synanyşyň.']);
-            ['phone' => $phone],
+        }
-            [
-                'otp' => $otp,
-                'expires_at' => now()->addMinutes(10),
-                'verified' => false
-            ]
-        );
-
-        sendSMS($phone, $otp);
 
         return back()->with('status', 'Täze kod iberildi!');
     }
 
-    public function verifyOtp(Request $request)
+    public function verifyOtp(VerifyOtpRequest $request): RedirectResponse
     {
-        $request->validate([
+        $phone = session()->get('verify_phone');
-            'phone' => 'required',
-            'otp' => 'required|digits:4'
-        ]);
 
-        $verification = PhoneVerification::query()->where('phone', $request->phone)->first();
+        if (! $phone) {
-
+            return redirect()->route('verification.index');
-        if (!$verification || $verification->otp !== $request->otp) {
-            return back()->withErrors(['otp' => 'Nädogry kod.']);
         }
 
-        if ($verification->expires_at < now()) {
+        $result = $this->otpService->verify($phone, $request->string('otp')->toString());
+
+        if ($result === OtpVerificationResult::Expired) {
             return back()->withErrors(['otp' => 'Kodyň möhleti gutardy.']);
         }
 
-        // Mark as verified
+        if ($result === OtpVerificationResult::Invalid) {
-        $verification->update(['verified' => true]);
+            return back()->withErrors(['otp' => 'Nädogry kod.']);
+        }
 
-        // Generate or get Coupon
+        $coupon = $this->couponService->findOrCreateForPhone($phone);
-        $coupon = Coupon::firstOrCreate(
-            ['phone' => $request->phone],
-            ['code' => $this->generateCouponCode()]
-        );
 
-        // Put coupon code in session for the congratulations page
         session()->put('coupon_code', $coupon->code);
 
-        // We set a long-lived cookie to mark this device as registered (e.g. 5 years)
+        return redirect()
-        return redirect()->route('verification.congratulations')
+            ->route('verification.congratulations')
-            ->cookie('device_registered', 'true', 60 * 24 * 365 * 5);
+            ->withCookie($this->makeDeviceCookie($phone));
     }
 
-    public function congratulations()
+    public function congratulations(): View|RedirectResponse
     {
-        // If they have the cookie but lost the session, we don't know their code unless we query
+        if (! session()->has('coupon_code') && ! request()->cookie(self::DEVICE_COOKIE_NAME)) {
-        // But for simplicity based on the flow, we'll try to find it by phone if available
-        if (!session()->has('coupon_code') && !request()->cookie('device_registered')) {
             return redirect()->route('verification.index');
         }
 
         $code = session()->get('coupon_code');
 
-        if (!$code && session()->has('verify_phone')) {
+        if (! $code) {
-             $coupon = Coupon::query()->where('phone', session()->get('verify_phone'))->first();
+            $phone = $this->phoneFromDeviceCookie();
-             if ($coupon) {
+
-                 $code = $coupon->code;
+            if ($phone) {
-                 session()->put('coupon_code', $code);
+                $coupon = Coupon::query()->where('phone', $phone)->first();
-             }
+                if ($coupon) {
+                    $code = $coupon->code;
+                    session()->put('coupon_code', $code);
+                }
+            }
         }
 
-        // If for some reason code is completely lost (e.g. cookie exists but session cleared and no phone),
+        if (! $code && session()->has('verify_phone')) {
-        // we can't show a specific code. In this specific scenario, we'll default to redirecting back.
+            $coupon = Coupon::query()->where('phone', session()->get('verify_phone'))->first();
-        if (!$code) {
+            if ($coupon) {
-             return redirect()->route('verification.index')->withoutCookie('device_registered');
+                $code = $coupon->code;
+                session()->put('coupon_code', $code);
+            }
+        }
+
+        if (! $code) {
+            return redirect()
+                ->route('verification.index')
+                ->withoutCookie(self::DEVICE_COOKIE_NAME);
         }
 
         return view('verification.congratulations', [
-            'code' => $code
+            'code' => $code,
         ]);
     }
 
-    private function generateCouponCode()
+    private function redirectIfAlreadyRegistered(): ?RedirectResponse
     {
-        // Format X_YYYY (X is integer, Y is capital char)
+        if (request()->cookie(self::DEVICE_COOKIE_NAME) || session()->has('coupon_code')) {
-        $x = rand(1, 9);
+            return redirect()->route('verification.congratulations');
-        $yyyy = substr(str_shuffle("ABCDEFGHIJKLMNOPQRSTUVWXYZ"), 0, 4);
+        }
 
-        return "{$x}_{$yyyy}";
+        return null;
+    }
+
+    private function makeDeviceCookie(string $phone): Cookie
+    {
+        return cookie(
+            self::DEVICE_COOKIE_NAME,
+            encrypt($phone),
+            60 * 24 * 365 * 5,
+            '/',
+            null,
+            null,
+            true,
+            false,
+            'lax',
+        );
+    }
+
+    private function phoneFromDeviceCookie(): ?string
+    {
+        $value = request()->cookie(self::DEVICE_COOKIE_NAME);
+
+        if (! $value) {
+            return null;
+        }
+
+        try {
+            $phone = decrypt($value);
+
+            return is_string($phone) && preg_match('/^6\d{7}$/', $phone) ? $phone : null;
+        } catch (\Throwable) {
+            return null;
+        }
     }
 }

app/Http/Requests/SendOtpRequest.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Validator;
+
+class SendOtpRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, array<int, string>>
+     */
+    public function rules(): array
+    {
+        return [
+            'phone' => ['required', 'regex:/^\+993 [67]\d \d{2} \d{2} \d{2}$/'],
+        ];
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'phone.regex' => 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).',
+        ];
+    }
+
+    public function withValidator(Validator $validator): void
+    {
+        $validator->after(function (Validator $validator): void {
+            if ($validator->errors()->isNotEmpty()) {
+                return;
+            }
+
+            if (unmask_phone($this->string('phone')->toString()) === '') {
+                $validator->errors()->add('phone', 'Telefon belgiňiz şu formatda bolmaly: +993 KX XX XX XX (bu ýerde K 6 ýa-da 7).');
+            }
+        });
+    }
+
+    public function unmaskedPhone(): string
+    {
+        return unmask_phone($this->string('phone')->toString());
+    }
+}

app/Http/Requests/VerifyOtpRequest.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class VerifyOtpRequest extends FormRequest
+{
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array<string, array<int, string>>
+     */
+    public function rules(): array
+    {
+        return [
+            'otp' => ['required', 'digits:4'],
+        ];
+    }
+}

app/Models/Coupon.php

@@ -2,9 +2,20 @@
 
 namespace App\Models;
 
+use Database\Factories\CouponFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasOne;
 
 class Coupon extends Model
 {
+    /** @use HasFactory<CouponFactory> */
+    use HasFactory;
+
     protected $fillable = ['phone', 'code'];
+
+    public function phoneVerification(): HasOne
+    {
+        return $this->hasOne(PhoneVerification::class, 'phone', 'phone');
+    }
 }

app/Models/PhoneVerification.php

@@ -2,13 +2,28 @@
 
 namespace App\Models;
 
+use Database\Factories\PhoneVerificationFactory;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\HasOne;
 
 class PhoneVerification extends Model
 {
+    /** @use HasFactory<PhoneVerificationFactory> */
+    use HasFactory;
+
     protected $fillable = ['phone', 'otp', 'expires_at', 'verified'];
-    protected $casts = [
+
-        'expires_at' => 'datetime',
+    protected function casts(): array
-        'verified' => 'boolean'
+    {
-    ];
+        return [
+            'expires_at' => 'datetime',
+            'verified' => 'boolean',
+        ];
+    }
+
+    public function coupon(): HasOne
+    {
+        return $this->hasOne(Coupon::class, 'phone', 'phone');
+    }
 }

app/Services/CouponService.php

@@ -0,0 +1,45 @@
+<?php
+
+namespace App\Services;
+
+use App\Models\Coupon;
+use Illuminate\Database\UniqueConstraintViolationException;
+use Illuminate\Support\Str;
+
+class CouponService
+{
+    public function findOrCreateForPhone(string $phone): Coupon
+    {
+        $existing = Coupon::query()->where('phone', $phone)->first();
+
+        if ($existing) {
+            return $existing;
+        }
+
+        return $this->createWithUniqueCode($phone);
+    }
+
+    private function createWithUniqueCode(string $phone): Coupon
+    {
+        for ($attempt = 0; $attempt < 10; $attempt++) {
+            try {
+                return Coupon::query()->create([
+                    'phone' => $phone,
+                    'code' => $this->generateCouponCode(),
+                ]);
+            } catch (UniqueConstraintViolationException) {
+                continue;
+            }
+        }
+
+        throw new \RuntimeException('Unable to generate a unique coupon code.');
+    }
+
+    private function generateCouponCode(): string
+    {
+        $x = random_int(1, 9);
+        $yyyy = Str::upper(Str::random(4));
+
+        return "{$x}_{$yyyy}";
+    }
+}

app/Services/OtpService.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace App\Services;
+
+use App\Enums\OtpVerificationResult;
+use App\Models\PhoneVerification;
+use Illuminate\Support\Facades\Hash;
+
+class OtpService
+{
+    public const OTP_EXPIRY_MINUTES = 10;
+
+    public function issue(string $phone): bool
+    {
+        $otp = $this->generateOtp();
+
+        PhoneVerification::query()->updateOrCreate(
+            ['phone' => $phone],
+            [
+                'otp' => Hash::make($otp),
+                'expires_at' => now()->addMinutes(self::OTP_EXPIRY_MINUTES),
+                'verified' => false,
+            ],
+        );
+
+        return sendSMS($phone, 'Tassyklaýyş belgi: '.$otp);
+    }
+
+    public function verify(string $phone, string $otp): OtpVerificationResult
+    {
+        $verification = PhoneVerification::query()->where('phone', $phone)->first();
+
+        if (! $verification) {
+            return OtpVerificationResult::Invalid;
+        }
+
+        if ($verification->expires_at->isPast()) {
+            return OtpVerificationResult::Expired;
+        }
+
+        if (! Hash::check($otp, $verification->otp)) {
+            return OtpVerificationResult::Invalid;
+        }
+
+        $verification->update(['verified' => true]);
+
+        return OtpVerificationResult::Verified;
+    }
+
+    private function generateOtp(): string
+    {
+        return (string) random_int(1000, 9999);
+    }
+}

config/services.php

@@ -35,4 +35,10 @@ return [
         ],
     ],
 
+    'sms' => [
+        'url' => env('SMS_API_URL', 'http://216.250.14.144:3000/api/data'),
+        'timeout' => (int) env('SMS_API_TIMEOUT', 10),
+        'connect_timeout' => (int) env('SMS_API_CONNECT_TIMEOUT', 5),
+    ],
+
 ];

database/factories/CouponFactory.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\Coupon;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Str;
+
+/**
+ * @extends Factory<Coupon>
+ */
+class CouponFactory extends Factory
+{
+    protected $model = Coupon::class;
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        return [
+            'phone' => '6'.fake()->unique()->numerify('#######'),
+            'code' => random_int(1, 9).'_'.Str::upper(Str::random(4)),
+        ];
+    }
+}

database/factories/PhoneVerificationFactory.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace Database\Factories;
+
+use App\Models\PhoneVerification;
+use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Support\Facades\Hash;
+
+/**
+ * @extends Factory<PhoneVerification>
+ */
+class PhoneVerificationFactory extends Factory
+{
+    protected $model = PhoneVerification::class;
+
+    /**
+     * @return array<string, mixed>
+     */
+    public function definition(): array
+    {
+        return [
+            'phone' => '6'.fake()->unique()->numerify('#######'),
+            'otp' => Hash::make('1234'),
+            'expires_at' => now()->addMinutes(10),
+            'verified' => false,
+        ];
+    }
+
+    public function expired(): static
+    {
+        return $this->state(fn (array $attributes) => [
+            'expires_at' => now()->subMinute(),
+        ]);
+    }
+
+    public function withOtp(string $otp): static
+    {
+        return $this->state(fn (array $attributes) => [
+            'otp' => Hash::make($otp),
+        ]);
+    }
+}

resources/views/verification/congratulations.blade.php

@@ -138,18 +138,26 @@
         }
     }
 
+    let animationFrameId;
+
     function animateConfetti() {
         ctx.clearRect(0, 0, canvas.width, canvas.height);
         particles.forEach(p => {
             p.update();
             p.draw();
         });
-        requestAnimationFrame(animateConfetti);
+        animationFrameId = requestAnimationFrame(animateConfetti);
     }
 
     initConfetti();
     animateConfetti();
 
+    setTimeout(() => {
+        cancelAnimationFrame(animationFrameId);
+        particles = [];
+        ctx.clearRect(0, 0, canvas.width, canvas.height);
+    }, 10000);
+
     // Copy Functionality
     function copyCode() {
         const code = document.getElementById('couponCode').innerText;

resources/views/verification/verify.blade.php

@@ -35,7 +35,7 @@
         <h2 class="font-headline-xl text-headline-xl text-on-surface mb-sm">Belgiňizi tassyklaň</h2>
 
         <p class="font-body-md text-body-md text-on-surface-variant max-w-[280px] mx-auto">
-            Şu belgä iberilen 4 sanly kody giriziň: <span class="font-semibold text-on-surface">+933 {{ $phone }}</span>
+            Şu belgä iberilen 4 sanly kody giriziň: <span class="font-semibold text-on-surface">{{ format_phone($phone) }}</span>
         </p>
     </div>
 
@@ -53,7 +53,6 @@
 
     <form action="{{ route('verification.verify') }}" method="POST" id="otp-form">
         @csrf
-        <input type="hidden" name="phone" value="{{ $phone }}">
         <input type="hidden" name="otp" id="otp-hidden">
 
         <!-- OTP Inputs -->
@@ -121,20 +120,20 @@
         });
     });
 
-    verifyBtn.addEventListener('click', () => {
+    form.addEventListener('submit', (e) => {
         let code = '';
         inputs.forEach(input => code += input.value);
-        if (code.length === 4) {
-            hiddenOtp.value = code;
 
-            verifyBtn.innerHTML = '<span class="flex items-center justify-center gap-sm"><svg class="animate-spin h-5 w-5 text-white" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path></svg> Tassyklanýar...</span>';
+        if (code.length !== 4) {
-            
+            e.preventDefault();
-            setTimeout(() => {
-                form.submit();
-            }, 500); // small delay to show animation
-        } else {
             alert('Haýyş, 4 sanly kody giriziň.');
+            return;
         }
+
+        hiddenOtp.value = code;
+
+        verifyBtn.disabled = true;
+        verifyBtn.innerHTML = '<span class="flex items-center justify-center gap-sm"><svg class="animate-spin h-5 w-5 text-white" xmlns="http://www.w3.org/2000/svg" fill="none" viewBox="0 0 24 24"><circle class="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" stroke-width="4"></circle><path class="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4zm2 5.291A7.962 7.962 0 014 12H0c0 3.042 1.135 5.824 3 7.938l3-2.647z"></path></svg> Tassyklanýar...</span>';
     });
 
     // Resend OTP Countdown Logic

routes/web.php

@@ -1,11 +1,17 @@
 <?php
 
-use Illuminate\Support\Facades\Route;
 use App\Http\Controllers\VerificationController;
+use Illuminate\Support\Facades\Route;
 
 Route::get('/', [VerificationController::class, 'index'])->name('verification.index');
-Route::post('/send-otp', [VerificationController::class, 'sendOtp'])->name('verification.send');
+Route::post('/send-otp', [VerificationController::class, 'sendOtp'])
+    ->middleware('throttle:3,1')
+    ->name('verification.send');
 Route::get('/verify', [VerificationController::class, 'verifyForm'])->name('verification.verify.form');
-Route::post('/verify', [VerificationController::class, 'verifyOtp'])->name('verification.verify');
+Route::post('/verify', [VerificationController::class, 'verifyOtp'])
-Route::post('/resend-otp', [VerificationController::class, 'resendOtp'])->name('verification.resend');
+    ->middleware('throttle:10,1')
+    ->name('verification.verify');
+Route::post('/resend-otp', [VerificationController::class, 'resendOtp'])
+    ->middleware('throttle:3,1')
+    ->name('verification.resend');
 Route::get('/congratulations', [VerificationController::class, 'congratulations'])->name('verification.congratulations');

tests/Feature/VerificationFlowTest.php

@@ -0,0 +1,173 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\Coupon;
+use App\Models\PhoneVerification;
+use Illuminate\Foundation\Testing\LazilyRefreshDatabase;
+use Illuminate\Support\Facades\Http;
+use Tests\TestCase;
+
+class VerificationFlowTest extends TestCase
+{
+    use LazilyRefreshDatabase;
+
+    private const PHONE = '+993 61 92 92 48';
+
+    private const UNMASKED_PHONE = '61929248';
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        Http::fake([
+            config('services.sms.url') => Http::response('ok', 200),
+        ]);
+    }
+
+    public function test_index_page_loads_for_new_visitors(): void
+    {
+        $this->get(route('verification.index'))
+            ->assertOk()
+            ->assertViewIs('verification.index');
+    }
+
+    public function test_send_otp_starts_verification_flow(): void
+    {
+        $this->post(route('verification.send'), ['phone' => self::PHONE])
+            ->assertRedirect(route('verification.verify.form'));
+
+        $this->assertDatabaseHas(PhoneVerification::class, [
+            'phone' => self::UNMASKED_PHONE,
+            'verified' => false,
+        ]);
+
+        Http::assertSentCount(1);
+    }
+
+    public function test_send_otp_rejects_duplicate_phone(): void
+    {
+        Coupon::factory()->create(['phone' => self::UNMASKED_PHONE]);
+
+        $this->from(route('verification.index'))
+            ->post(route('verification.send'), ['phone' => self::PHONE])
+            ->assertRedirect(route('verification.index'))
+            ->assertSessionHasErrors('phone');
+    }
+
+    public function test_send_otp_rejects_invalid_phone_format(): void
+    {
+        $this->from(route('verification.index'))
+            ->post(route('verification.send'), ['phone' => '+993 81 23 45 67'])
+            ->assertRedirect(route('verification.index'))
+            ->assertSessionHasErrors('phone');
+    }
+
+    public function test_verify_form_requires_session_phone(): void
+    {
+        $this->get(route('verification.verify.form'))
+            ->assertRedirect(route('verification.index'));
+    }
+
+    public function test_full_verification_flow_issues_coupon(): void
+    {
+        $this->post(route('verification.send'), ['phone' => self::PHONE])
+            ->assertRedirect(route('verification.verify.form'));
+
+        $otp = $this->extractOtpFromLastSms();
+
+        $this->get(route('verification.verify.form'))->assertOk();
+
+        $this->post(route('verification.verify'), ['otp' => $otp])
+            ->assertRedirect(route('verification.congratulations'))
+            ->assertCookie('device_registered');
+
+        $this->assertDatabaseHas(Coupon::class, [
+            'phone' => self::UNMASKED_PHONE,
+        ]);
+
+        $this->get(route('verification.congratulations'))
+            ->assertOk()
+            ->assertViewHas('code');
+    }
+
+    public function test_verify_otp_rejects_wrong_code(): void
+    {
+        PhoneVerification::factory()
+            ->withOtp('1234')
+            ->create(['phone' => self::UNMASKED_PHONE]);
+
+        $this->withSession(['verify_phone' => self::UNMASKED_PHONE])
+            ->from(route('verification.verify.form'))
+            ->post(route('verification.verify'), ['otp' => '9999'])
+            ->assertRedirect(route('verification.verify.form'))
+            ->assertSessionHasErrors('otp');
+    }
+
+    public function test_verify_otp_rejects_expired_code(): void
+    {
+        PhoneVerification::factory()
+            ->withOtp('1234')
+            ->expired()
+            ->create(['phone' => self::UNMASKED_PHONE]);
+
+        $this->withSession(['verify_phone' => self::UNMASKED_PHONE])
+            ->from(route('verification.verify.form'))
+            ->post(route('verification.verify'), ['otp' => '1234'])
+            ->assertRedirect(route('verification.verify.form'))
+            ->assertSessionHasErrors(['otp' => 'Kodyň möhleti gutardy.']);
+    }
+
+    public function test_verify_otp_requires_session_phone(): void
+    {
+        $this->post(route('verification.verify'), ['otp' => '1234'])
+            ->assertRedirect(route('verification.index'));
+    }
+
+    public function test_resend_otp_sends_new_sms(): void
+    {
+        $this->withSession(['verify_phone' => self::UNMASKED_PHONE])
+            ->from(route('verification.verify.form'))
+            ->post(route('verification.resend'))
+            ->assertRedirect(route('verification.verify.form'))
+            ->assertSessionHas('status');
+
+        Http::assertSentCount(1);
+    }
+
+    public function test_congratulations_recovers_coupon_from_device_cookie(): void
+    {
+        $coupon = Coupon::factory()->create(['phone' => self::UNMASKED_PHONE]);
+
+        $this->withCookie('device_registered', encrypt(self::UNMASKED_PHONE))
+            ->get(route('verification.congratulations'))
+            ->assertOk()
+            ->assertViewIs('verification.congratulations')
+            ->assertSee($coupon->code);
+    }
+
+    public function test_send_otp_is_rate_limited(): void
+    {
+        for ($i = 0; $i < 3; $i++) {
+            $this->post(route('verification.send'), ['phone' => self::PHONE]);
+        }
+
+        $this->post(route('verification.send'), ['phone' => self::PHONE])
+            ->assertStatus(429);
+    }
+
+    private function extractOtpFromLastSms(): string
+    {
+        $recorded = Http::recorded()->all();
+
+        $this->assertNotEmpty($recorded);
+
+        [$request] = $recorded[array_key_last($recorded)];
+
+        preg_match('/(\d{4})/', (string) $request->data()['code'], $matches);
+
+        $this->assertNotEmpty($matches[1]);
+
+        return $matches[1];
+    }
+}