<?php
if (!defined('ABSPATH')) {
    exit;
}
$verified = false;
// This endpoint uses a secure, single-use verification code stored in user meta
// and does not require a nonce because the request is initiated via a unique link
// sent to the user's email (similar to WordPress password reset links).
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Token-based validation is handled below.
$user_id = isset($_GET['uid']) ? absint($_GET['uid']) : 0;
// phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Token-based validation is handled below.
$code = isset($_GET['code']) ? sanitize_text_field(wp_unslash($_GET['code'])) : '';

$saved_code = get_user_meta($user_id, 'email_verification_code', true);

if ( $saved_code && hash_equals($saved_code, $code) ) {
    // Code is valid — verify email
    update_user_meta($user_id, 'is_email_verified', 1);
    delete_user_meta($user_id, 'email_verification_code');
    $verified = true;
} else {
    //invalid verification code
    chama_errors()->add('invalid_verification_code', __('Invalid or expired verification link', 'chama'));
}


?>
<div class="chama-account-page-wrapper">
    <div class="chama-form-wrapper">
    <div class="chama-form-header">&#x2709; Email verification</div>
    <div class="chama-form-content">

	<?php
// show any error messages
chama_show_error_messages();?>
<?php if($verified) { ?>
			<div class="chama-alert chama-alert-success">
				<span><?php esc_html_e('Your email has been successfully verified!', 'chama'); ?></span>
			</div>
		<?php } ?>


        </div>

</div>
</div>
