Mobile OTP + Email + OAuth for pfSense Captive Portal

<?php
# Send a 6-digit OTP to the user's phone via MSG91
# Called when user submits their mobile number from the portal page

$phone = preg_replace('/[^0-9]/', '', $_POST['phone']);
if (strlen($phone) < 10) { die('Invalid mobile'); }

$otp       = rand(100000, 999999);
$apiKey    = 'YOUR_MSG91_AUTHKEY';         # from MSG91 dashboard
$templId   = 'YOUR_DLT_TEMPLATE_ID';       # DLT-approved template
$senderId  = 'KHOJIN';                    # DLT-approved 6-char sender
$zone      = $_POST['zone']      ?? 'cpzone';
$redirurl  = $_POST['redirurl']  ?? '/';

# Store OTP in /tmp with 5-min TTL
file_put_contents("/tmp/otp_{$phone}", $otp);
touch("/tmp/otp_{$phone}", time() + 300);

# Send via MSG91 Flow API
$payload = [
  'template_id' => $templId,
  'short_url'   => '0',
  'recipients'  => [[
    'mobiles' => '91' . $phone,
    'OTP'     => (string)$otp,
  ]]
];

$ch = curl_init('https://api.msg91.com/api/v5/flow/');
curl_setopt_array($ch, [
  CURLOPT_POST           => true,
  CURLOPT_POSTFIELDS     => json_encode($payload),
  CURLOPT_HTTPHEADER     => [
    'Content-Type: application/json',
    "authkey: {$apiKey}",
  ],
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_TIMEOUT        => 10,
]);
$resp = curl_exec($ch);
curl_close($ch);

# Show the OTP-entry page (include verify form + pass session vars)
include 'otp_entry_page.php';

<?php
# Verify OTP + log user in via pfSense captive portal

require_once('/etc/inc/captiveportal.inc');

$phone    = preg_replace('/[^0-9]/', '', $_POST['phone']);
$entered  = preg_replace('/[^0-9]/', '', $_POST['otp']);
$stored   = @file_get_contents("/tmp/otp_{$phone}");
$expired  = filemtime("/tmp/otp_{$phone}") < time();

if (!$stored || $expired || $entered !== trim($stored)) {
    die('Invalid or expired OTP');
}

# Delete used OTP (single-use)
@unlink("/tmp/otp_{$phone}");

# Authenticate via pfSense's captive portal
$cpzone   = $_POST['zone'] ?? 'cpzone';
$clientIP = $_SERVER['REMOTE_ADDR'];
$clientMAC = arp_get_mac_by_ip($clientIP);
$sessId   = portal_allow($clientIP, $clientMAC, "+91{$phone}", null, null, null, null);

if ($sessId) {
    header('Location: ' . ($_POST['redirurl'] ?? 'https://www.google.com'));
    exit;
}
die('Login failed. Contact staff.');

E-Mail server address     : smtp.sendgrid.net
SMTP Port of E-Mail server: 587
Connection timeout        : 20 seconds
Secure SMTP Connection    : STARTTLS
From e-mail address       : [email protected]
Notification E-Mail address: [email protected]
Authentication Mechanism  : PLAIN
Username                  : apikey                # literal string for SendGrid
Password                  : SG.xxxxxxxxxxxxxxxxxxxx # your SendGrid API key

<?php
# Sends a welcome email via SendGrid when a user connects

$to    = $_POST['email'];
$name  = $_POST['name'] ?? 'Guest';
$venue = 'Cafe Khoji';

$apiKey  = 'SG.xxxxxxxxxxxxxxxxxxxx';
$payload = [
    'personalizations' => [['to' => [['email' => $to, 'name' => $name]]]],
    'from'             => ['email' => '[email protected]', 'name' => $venue],
    'subject'          => "Welcome to {$venue} WiFi, {$name}",
    'content'          => [[
        'type'  => 'text/html',
        'value' => "<h2>You're connected.</h2><p>Enjoy 500 Mbps free WiFi. Show this email to redeem a free beverage.</p>",
    ]],
];

$ch = curl_init('https://api.sendgrid.com/v3/mail/send');
curl_setopt_array($ch, [
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => json_encode($payload),
    CURLOPT_HTTPHEADER     => [
        'Content-Type: application/json',
        "Authorization: Bearer {$apiKey}",
    ],
    CURLOPT_RETURNTRANSFER => true,
]);
curl_exec($ch);
curl_close($ch);

<?php
# Google OAuth callback — verify the JWT id_token, then grant access

require_once('/etc/inc/captiveportal.inc');

$idToken = $_POST['id_token'];                     # from Google Sign-In JS SDK
$allowedDomain = 'yourcompany.com';                   # restrict to corp email

# Verify with Google's tokeninfo endpoint
$resp = file_get_contents("https://oauth2.googleapis.com/tokeninfo?id_token={$idToken}");
$info = json_decode($resp, true);

if (!isset($info['email']) ||
    !$info['email_verified'] ||
    $info['aud'] !== 'YOUR_GOOGLE_CLIENT_ID' ||
    $info['hd'] !== $allowedDomain) {
    http_response_code(403);
    die('Domain not allowed');
}

# Grant portal access
$clientIP = $_SERVER['REMOTE_ADDR'];
$clientMAC = arp_get_mac_by_ip($clientIP);
portal_allow($clientIP, $clientMAC, $info['email'], null, null, null, null);

header('Location: ' . $_POST['redirurl']);