# OTP (Two-Factor Authentication) Feature

## Overview
A demo OTP verification page that appears after login for clickthrough demonstration purposes. This adds an extra layer of simulated security to the authentication flow.

## Flow

1. **Login** → User enters email and password on login page
2. **OTP Page** → User is redirected to OTP verification page
3. **Verify Code** → User enters 6-digit code (demo code: `123456`)
4. **Dashboard/Intake** → User is redirected to appropriate page based on role

## Demo Features

### OTP Input
- 6-digit numeric input fields
- Auto-advance to next field on input
- Backspace navigation between fields
- Paste support for full code
- Visual feedback when filled

### Demo Code
- **Fixed OTP**: `123456` (always works for demo)
- Auto-fill button available in demo info card
- Code "expires" after 5:00 countdown (timer only, still works)

### User Experience
- Clean, modern interface matching existing design
- Countdown timer display (5 minutes)
- Resend code button (resets timer)
- Back to login link
- Accessibility features (ARIA labels, keyboard navigation)

## Files Modified/Created

### New Files
- `resources/views/auth/otp.blade.php` - OTP verification page

### Modified Files
- `app/Http/Controllers/PrototypeController.php`
  - Added `showOTP()` method
  - Added `verifyOTP()` method
  - Modified `authenticate()` to redirect to OTP page
  
- `routes/web.php`
  - Added GET `/otp` route
  - Added POST `/otp` route

## Technical Details

### Session Variables
- `user_email` - Stored during login
- `user_type` - doctor/patient/user
- `otp_verified` - Boolean flag (true after successful OTP)

### Validation
- OTP must be exactly 6 digits
- Demo OTP is hardcoded as `123456`
- Invalid OTP returns error message

### Security Notes
This is a **DEMO ONLY** implementation:
- OTP is hardcoded (not secure)
- No actual SMS/email sending
- No rate limiting
- No expiration enforcement
- For clickthrough demonstrations only

## Usage

### For Doctors
1. Login with `doctor@rxnetworx.com`
2. Enter OTP: `123456`
3. Redirected to Dashboard

### For Patients
1. Login with `patient@rxnetworx.com`
2. Enter OTP: `123456`
3. Redirected to Intake Step 1

### Testing
- Click "Auto-fill" button in demo card to populate OTP
- Or manually enter `123456`
- Click "Verify Code"

## Future Enhancements (If Made Real)
- Generate random OTP codes
- Send codes via SMS/email
- Implement expiration logic
- Add rate limiting
- Store OTP attempts in database
- Add "Remember this device" option
- Support for backup codes