Authentification WhatsApp OTP pour l'Afrique

Nouvel utilisateur :
1. Entrer le numéro de téléphone -> Envoyer OTP via WhatsApp
2. Entrer le code OTP -> Vérifier le code
3. Compléter le profil (nom, e-mail, avatar)
4. Créer le compte -> Tableau de bord

Utilisateur de retour :
1. Entrer le numéro de téléphone -> Envoyer OTP via WhatsApp
2. Entrer le code OTP -> Vérifier le code -> Tableau de bord (étape 3 sautée)

flin// app/auth/send-whatsapp-otp.flin

layout = "auth"

waPhone = session.waPhone || ""
otpSent = false

fn processSendWhatsappOtp() {
    if waPhone != "" {
        code = otp_generate(6)
        result = whatsapp_send_otp(waPhone, code)

        if result.success {
            session.waOtpCode = code
            session.waOtpPhone = waPhone
            otpSent = true
        }
    }
}
processSendWhatsappOtp()

{if otpSent}
    <h2>Entrez le code envoyé sur votre WhatsApp</h2>
    <p>Nous avons envoyé un code à 6 chiffres au {waPhone}</p>

    <input class="otp-input" type="text" bind={codeInput}
        maxlength="6" autocomplete="one-time-code" inputmode="numeric">

    <button click={
        session.waOtpInput = codeInput;
        location.href = "/auth/verify-whatsapp-otp"
    }>
        Vérifier le code
    </button>
{else}
    <p>Une erreur s'est produite. Veuillez réessayer.</p>
    <a href="/login">Retour à la connexion</a>
{/if}

flin// app/auth/verify-whatsapp-otp.flin

layout = "auth"

otpInput = session.waOtpInput || ""
otpCode = session.waOtpCode || ""
otpPhone = session.waOtpPhone || ""

// Effacer les données sensibles immédiatement
session.waOtpInput = none
session.waOtpCode = none

verifyOk = false
isNewUser = false

fn processVerifyWhatsappOtp() {
    if otpInput != "" && otpCode != "" && otpPhone != "" {
        if otpInput == otpCode {
            existing = User.where(phone == otpPhone && role == "User").first

            if existing != none {
                // Utilisateur de retour -- connecter directement
                session.user = existing.email
                session.userName = existing.name || existing.firstName || existing.email
                session.userId = to_text(existing.id)
                session.waOtpPhone = none
                verifyOk = true
            } else {
                // Nouvel utilisateur -- complétion de profil nécessaire
                session.waVerifiedPhone = otpPhone
                session.waOtpPhone = none
                isNewUser = true
                verifyOk = true
            }
        }
    }
}
processVerifyWhatsappOtp()

{if verifyOk && !isNewUser}
    <h2>Bon retour !</h2>
    <script>setTimeout(function() { window.location.href = "/tasks"; }, 1000);</script>
{else if verifyOk && isNewUser}
    <h2>Téléphone vérifié ! Configurons votre profil.</h2>
    <script>setTimeout(function() { window.location.href = "/auth/whatsapp-complete-profile"; }, 1200);</script>
{else}
    <h2>Code invalide</h2>
    <p>Le code que vous avez saisi est incorrect ou a expiré.</p>
    <a href="/login">Réessayer</a>
{/if}

flin// app/auth/whatsapp-complete-profile.flin

layout = "auth"

waPhone = session.waVerifiedPhone || ""
errorKey = session.waCreateError || ""
session.waCreateError = none

{if waPhone == ""}
    <script>window.location.href = "/login";</script>
{else}
    <h2>Complétez votre profil</h2>

    <form method="POST" action="/auth/whatsapp-create-account" enctype="multipart/form-data">
        <input type="text" name="firstName" placeholder="Prénom" required>
        <input type="text" name="lastName" placeholder="Nom de famille">
        <input type="email" name="email" placeholder="Adresse e-mail" required>
        <input type="file" name="avatar" accept="image/*">
        <input type="text" name="occupation" placeholder="Profession">
        <input type="text" name="country" placeholder="Pays">

        {if errorKey != ""}
            <p class="error">{t(errorKey)}</p>
        {/if}

        <button type="submit">Créer le compte</button>
    </form>
{/if}

flin// app/auth/whatsapp-create-account.flin

route POST {
    validate {
        firstName: text @required @minLength(1)
        email: text @required @email
        lastName: text
        occupation: text
        country: text
        avatar: file @max_size("5MB")
    }

    waPhone = session.waVerifiedPhone || ""
    if waPhone == "" { redirect("/login") }

    // Vérifier l'unicité de l'e-mail
    existingEmail = User.where(email == body.email && role == "User").first
    if existingEmail != none {
        session.waCreateError = "error.email_taken"
        redirect("/auth/whatsapp-complete-profile")
    }

    // Vérifier l'unicité du téléphone
    existingPhone = User.where(phone == waPhone && role == "User").first
    if existingPhone != none {
        session.user = existingPhone.email
        session.userName = existingPhone.name
        session.userId = to_text(existingPhone.id)
        session.waVerifiedPhone = none
        redirect("/tasks")
    }

    avatarPath = ""
    if body.avatar != none {
        avatarPath = save_file(body.avatar, ".flindb/avatars/")
    }

    fullName = to_text(body.firstName) + " " + to_text(body.lastName || "")
    newUser = User {
        email: body.email,
        name: fullName,
        firstName: body.firstName,
        lastName: body.lastName || "",
        phone: waPhone,
        provider: "WhatsApp",
        avatar: avatarPath,
        occupation: body.occupation || "",
        country: body.country || "",
        emailVerified: false
    }
    save newUser

    session.waVerifiedPhone = none
    session.user = newUser.email
    session.userName = fullName
    session.userId = to_text(newUser.id)

    redirect("/tasks")
}

flinresult = whatsapp_send_otp(phone_number, code)
// result.success -> true/false
// result.error -> message d'erreur en cas d'échec

rustpub async fn send_whatsapp_otp(
    phone: &str,
    code: &str,
) -> Result<SendResult, WhatsAppError> {
    let api_url = env::var("WHATSAPP_API_URL")?;
    let token = env::var("WHATSAPP_TOKEN")?;
    let template_name = env::var("WHATSAPP_OTP_TEMPLATE")
        .unwrap_or_else(|_| "otp_verification".to_string());

    let payload = json!({
        "messaging_product": "whatsapp",
        "to": normalize_phone(phone),
        "type": "template",
        "template": {
            "name": template_name,
            "language": { "code": "en" },
            "components": [{
                "type": "body",
                "parameters": [{
                    "type": "text",
                    "text": code
                }]
            }]
        }
    });

    let response = reqwest::Client::new()
        .post(&api_url)
        .bearer_auth(&token)
        .json(&payload)
        .send()
        .await?;

    if response.status().is_success() {
        Ok(SendResult { success: true, error: None })
    } else {
        let error = response.text().await.unwrap_or_default();
        Ok(SendResult { success: false, error: Some(error) })
    }
}

rustfn normalize_phone(phone: &str) -> String {
    // Supprimer les espaces, tirets, parenthèses
    let digits: String = phone.chars()
        .filter(|c| c.is_ascii_digit() || *c == '+')
        .collect();

    if digits.starts_with('+') {
        digits
    } else if digits.starts_with("00") {
        format!("+{}", &digits[2..])
    } else if digits.len() == 10 {
        // Supposer un format local -- indicatif pays nécessaire depuis la config
        let country_code = env::var("DEFAULT_PHONE_COUNTRY").unwrap_or("225".into());
        format!("+{}{}", country_code, digits)
    } else {
        format!("+{}", digits)
    }
}