שירות 2FA חיצוני - מדריך שימוש

curl -X POST https://yotaro.tech/api/v1/external-2fa/send \
  -H "X-API-Key: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"phone": "972501234567"}'

{
  "success": true,
  "message": "Verification code sent",
  "data": {
    "request_id": "req_abc123...",
    "expires_at": "2024-12-01 14:35:00",
    "phone_masked": "972***567"
  }
}

{
  "success": false,
  "message": "Invalid verification code",
  "data": {
    "verified": false,
    "attempts_remaining": 2
  }
}

$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_WEBHOOK_SIGNATURE'];
$expected = hash_hmac('sha256', $payload, $webhookSecret);

if (hash_equals($expected, $signature)) {
    // Webhook is valid
}

<?php
class Yotaro2FA {
    private $apiKey;
    private $baseUrl = 'https://yotaro.tech/api/v1/external-2fa';

    public function __construct($apiKey) {
        $this->apiKey = $apiKey;
    }

    /**
     * שליחת קוד אימות
     */
    public function sendCode($phone, $context = null) {
        return $this->request('POST', '/send', [
            'phone' => $phone,
            'context' => $context
        ]);
    }

    /**
     * אימות קוד
     */
    public function verifyCode($requestId, $code) {
        return $this->request('POST', '/verify', [
            'request_id' => $requestId,
            'code' => $code
        ]);
    }

    /**
     * בדיקת סטטוס
     */
    public function checkStatus($requestId) {
        return $this->request('GET', '/status?request_id=' . $requestId);
    }

    private function request($method, $endpoint, $data = null) {
        $ch = curl_init($this->baseUrl . $endpoint);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        curl_setopt($ch, CURLOPT_HTTPHEADER, [
            'X-API-Key: ' . $this->apiKey,
            'Content-Type: application/json'
        ]);

        if ($method === 'POST') {
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
        }

        $response = curl_exec($ch);
        curl_close($ch);

        return json_decode($response, true);
    }
}

// ===== שימוש =====

$twoFA = new Yotaro2FA('YOUR_API_TOKEN');

// שלב 1: שליחת קוד
$result = $twoFA->sendCode('972501234567', ['user_id' => '123']);

if ($result['success']) {
    $requestId = $result['data']['request_id'];
    // שמור את ה-request_id ב-session
    $_SESSION['2fa_request_id'] = $requestId;
}

// שלב 2: אימות קוד (אחרי שהמשתמש הזין את הקוד)
$code = $_POST['verification_code'];
$requestId = $_SESSION['2fa_request_id'];

$verify = $twoFA->verifyCode($requestId, $code);

if ($verify['success'] && $verify['data']['verified']) {
    // הצלחה! אפשר להתחבר את המשתמש
    echo "אומת בהצלחה!";
} else {
    echo "קוד שגוי. נסיונות שנותרו: " . $verify['data']['attempts_remaining'];
}