<?php
session_start();

$otp = $_POST['otp'] ?? '';

if (!isset($_SESSION['otp'])) {
  echo json_encode(['status' => 'error', 'message' => 'OTP not found or expired.']);
  exit;
}

if ($_SESSION['otp'] == $otp) {
  unset($_SESSION['otp']); // invalidate OTP
  echo json_encode(['status' => 'success']);
} else {
  echo json_encode(['status' => 'error', 'message' => 'Invalid OTP.']);
}
?>
