Sending API guide

<?php
// mailer.php — PHP 7.4+ with the curl extension.
// Put your key in the server environment (never in code): MAIL_API_KEY=your_api_key
function send_email(string $to, string $subject, string $html, string $text): array
{
    $ch = curl_init('https://mailions.com/api/v1/emails');
    curl_setopt_array($ch, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_TIMEOUT => 15,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . getenv('MAIL_API_KEY'),
            'Content-Type: application/json',
        ],
        CURLOPT_POSTFIELDS => json_encode([
            'from'    => 'Your App <[email protected]>',
            'to'      => $to,
            'subject' => $subject,
            'html'    => $html,
            'text'    => $text,
        ]),
    ]);
    $body   = curl_exec($ch);
    $status = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $error  = curl_error($ch);
    curl_close($ch);

    if ($body === false) {
        throw new RuntimeException("Mail API unreachable: $error");
    }
    $data = json_decode($body, true) ?: [];
    if ($status !== 200) {
        $code = $data['error']['code'] ?? $status;
        $msg  = $data['error']['message'] ?? 'send failed';
        throw new RuntimeException("$code: $msg");
    }
    return $data; // ['id' => ..., 'message_id' => ...]
}

// Usage:
// send_email('[email protected]', 'Hello', '<p>Hi!</p>', 'Hi!');

# mailer.py — Python 3.8+.  pip install requests
# Put your key in the environment (never in code): MAIL_API_KEY=your_api_key
import os
import requests


def send_email(to, subject, html, text):
    r = requests.post(
        "https://mailions.com/api/v1/emails",
        headers={"Authorization": f"Bearer {os.environ['MAIL_API_KEY']}"},
        json={
            "from": "Your App <[email protected]>",
            "to": to,
            "subject": subject,
            "html": html,
            "text": text,
        },
        timeout=15,
    )
    data = r.json() if r.content else {}
    if not r.ok:
        err = data.get("error", {})
        raise RuntimeError(f"{err.get('code', r.status_code)}: {err.get('message', 'send failed')}")
    return data  # {"id": ..., "message_id": ...}


# Usage:
# send_email("[email protected]", "Hello", "<p>Hi!</p>", "Hi!")

<?php
// otp.php — POST action=send&email=...   then   POST action=verify&code=...
// Needs mailer.php from step 1. Stores the code in the PHP session.
session_start();
require __DIR__ . '/mailer.php';
header('Content-Type: application/json');

function reply(int $status, array $body): void
{
    http_response_code($status);
    echo json_encode($body);
    exit;
}

$action = $_POST['action'] ?? '';

// 1) Send a code
if ($action === 'send') {
    $email = strtolower(trim($_POST['email'] ?? ''));
    if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
        reply(400, ['error' => 'Enter a valid email address']);
    }
    if (isset($_SESSION['otp']) && time() - $_SESSION['otp']['sent_at'] < 60) {
        reply(429, ['error' => 'Please wait a minute before requesting a new code']);
    }

    $code = str_pad((string) random_int(0, 999999), 6, '0', STR_PAD_LEFT); // secure random
    $_SESSION['otp'] = [
        'email'    => $email,
        'hash'     => password_hash($code, PASSWORD_DEFAULT),
        'expires'  => time() + 600, // 10 minutes
        'attempts' => 0,
        'sent_at'  => time(),
    ];

    try {
        send_email(
            $email,
            "Your verification code: $code",
            "<p>Your verification code is</p>"
                . "<p style=\"font-size:28px;font-weight:bold;letter-spacing:6px\">$code</p>"
                . "<p>It expires in 10 minutes. If you didn't request this, you can ignore this email.</p>",
            "Your verification code is $code. It expires in 10 minutes."
        );
        reply(200, ['ok' => true]);
    } catch (Throwable $e) {
        unset($_SESSION['otp']);
        error_log('OTP email failed: ' . $e->getMessage());
        reply(502, ['error' => 'Could not send the code. Please try again.']);
    }
}

// 2) Verify the code
if ($action === 'verify') {
    $otp = $_SESSION['otp'] ?? null;
    if (!$otp || time() > $otp['expires']) {
        reply(400, ['error' => 'This code has expired or was already used. Request a new one.']);
    }
    if ($otp['attempts'] >= 5) {
        reply(429, ['error' => 'Too many wrong attempts. Request a new code.']);
    }
    $_SESSION['otp']['attempts']++;

    if (!password_verify(trim($_POST['code'] ?? ''), $otp['hash'])) {
        reply(400, ['error' => 'Wrong code. Please try again.']);
    }

    unset($_SESSION['otp']); // a code works only once
    // ✅ Verified: mark $otp['email'] as verified or log the user in here.
    reply(200, ['verified' => true, 'email' => $otp['email']]);
}

reply(400, ['error' => 'Unknown action']);

# otp.py — Flask routes: email a 6-digit code, then check it.
# pip install flask requests.  Needs mailer.py from step 1.
import hashlib
import hmac
import secrets
import time

from flask import Blueprint, jsonify, request

from mailer import send_email

otp = Blueprint("otp", __name__)  # app.register_blueprint(otp)

# Demo storage. In production save these fields on the user row in your database.
codes = {}  # email -> {"hash", "expires_at", "attempts", "sent_at"}

OTP_TTL = 10 * 60      # a code is valid for 10 minutes
RESEND_AFTER = 60      # at most one email per minute
MAX_ATTEMPTS = 5       # then a new code is needed


def _hash(code):
    return hashlib.sha256(code.encode()).hexdigest()


# 1) POST /otp/send   {"email": "[email protected]"}
@otp.post("/otp/send")
def send_code():
    email = str((request.get_json(silent=True) or {}).get("email", "")).strip().lower()
    if "@" not in email or "." not in email.split("@")[-1]:
        return jsonify(error="Enter a valid email address"), 400

    previous = codes.get(email)
    if previous and time.time() - previous["sent_at"] < RESEND_AFTER:
        return jsonify(error="Please wait a minute before requesting a new code"), 429

    code = f"{secrets.randbelow(1_000_000):06d}"  # secure random
    codes[email] = {"hash": _hash(code), "expires_at": time.time() + OTP_TTL, "attempts": 0, "sent_at": time.time()}

    try:
        send_email(
            email,
            f"Your verification code: {code}",
            "<p>Your verification code is</p>"
            f'<p style="font-size:28px;font-weight:bold;letter-spacing:6px">{code}</p>'
            "<p>It expires in 10 minutes. If you didn't request this, you can ignore this email.</p>",
            f"Your verification code is {code}. It expires in 10 minutes.",
        )
        return jsonify(ok=True)
    except Exception as e:
        codes.pop(email, None)
        print("OTP email failed:", e)
        return jsonify(error="Could not send the code. Please try again."), 502


# 2) POST /otp/verify   {"email": "[email protected]", "code": "123456"}
@otp.post("/otp/verify")
def verify_code():
    body = request.get_json(silent=True) or {}
    email = str(body.get("email", "")).strip().lower()
    code = str(body.get("code", "")).strip()
    entry = codes.get(email)

    if not entry or time.time() > entry["expires_at"]:
        return jsonify(error="This code has expired or was already used. Request a new one."), 400
    if entry["attempts"] >= MAX_ATTEMPTS:
        return jsonify(error="Too many wrong attempts. Request a new code."), 429
    entry["attempts"] += 1

    if not hmac.compare_digest(_hash(code), entry["hash"]):
        return jsonify(error="Wrong code. Please try again."), 400

    codes.pop(email, None)  # a code works only once
    # ✅ Verified: mark the user's email as verified or log them in here.
    return jsonify(verified=True)