<?php
require_once __DIR__ . '/config.php';
$me = must_auth();

if ($_SERVER['REQUEST_METHOD'] !== 'POST') fail('POST required', 405);

$b = json_decode(file_get_contents('php://input'), true);
if (!is_array($b)) fail('Invalid JSON');
$pw = isset($b['password']) ? (string)$b['password'] : '';
if ($pw === '') fail('Password is required');

$st = db()->prepare('SELECT password FROM users WHERE username=? LIMIT 1');
$st->execute(array($me));
$row = $st->fetch();
if (!$row || !password_verify($pw, $row['password'])) fail('Incorrect password', 401);

ok(array('verified' => true));
