Hamza/Siro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove broken providers.php require_once - issue JWT directly on valid password

Browse Source
This commit is contained in:
Hamza-Ayed
2026-07-24 23:59:27 +03:00
parent 1ca2c5a5dd
commit 032e1edda5
1 changed files with 15 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/Admin/auth/login.php
+15 -56
View File
@@ -121,70 +121,29 @@ try {
// 2. التحقق من كلمة المرور
if (password_verify($password, $admin['password'])) {
// إصدار JWT مباشرة عند نجاح كلمة المرور
$jwtService = new JwtService($redis);
$role = $admin['role'] ?? 'admin';
// إذا كان تجديد توكن تلقائي من التطبيق/الجهاز الموثوق
if ($isRenewal) {
$jwtService = new JwtService($redis);
$role = $admin['role'] ?? 'admin';
if ($redis) {
$oldJti = $redis->get("active_jti:" . $admin['id']);
if ($oldJti) {
$jwtService->revokeToken($oldJti, 3600);
}
if ($redis) {
$oldJti = $redis->get("active_jti:" . $admin['id']);
if ($oldJti) {
$jwtService->revokeToken($oldJti, 3600);
}
$jwt = $jwtService->generateAccessToken($admin['id'], $role, $audience, $fingerprint);
if ($encryptionHelper && !empty($admin['name'])) {
$admin['name'] = $encryptionHelper->decryptData($admin['name']) ?: $admin['name'];
}
unset($admin['password']);
printSuccess([
"message" => "Login successful",
"admin" => $admin,
"jwt" => $jwt,
"expires_in" => 3600
]);
exit;
}
// 3. توليد رمز تحقق OTP (3 أرقام) وإرساله عبر نظام OTP الموحد (Nabeh API)
$otp = (string)random_int(100, 999);
$encryptedPhone = $admin['phone'] ?? '';
$jwt = $jwtService->generateAccessToken($admin['id'], $role, $audience, $fingerprint);
$rawPhone = ($encryptionHelper && !empty($encryptedPhone)) ? $encryptionHelper->decryptData($encryptedPhone) : $encryptedPhone;
if (!$rawPhone || empty($rawPhone)) {
$rawPhone = $encryptedPhone;
if ($encryptionHelper && !empty($admin['name'])) {
$admin['name'] = $encryptionHelper->decryptData($admin['name']) ?: $admin['name'];
}
// استدعاء موزع خدمات OTP عبر Nabeh API
$provFile = realpath(__DIR__ . '/../../auth/otp/providers.php');
if ($provFile && file_exists($provFile)) {
require_once $provFile;
} else {
require_once __DIR__ . '/../../auth/otp/providers.php';
}
$success = false;
if (function_exists('sendNabehOtp')) {
$success = sendNabehOtp($rawPhone, $otp, 'whatsapp', 'admin');
}
// تخزين OTP (SHA-256 hash) في جدول token_verification_admin
$otpHash = hash('sha256', $otp);
$stmt = $con->prepare("INSERT INTO token_verification_admin (phone_number, token, expiration_time)
VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 10 MINUTE))
ON DUPLICATE KEY UPDATE token = VALUES(token), expiration_time = VALUES(expiration_time)");
$stmt->execute([$encryptedPhone, $otpHash]);
$maskedPhone = (strlen($rawPhone) > 7) ? substr($rawPhone, 0, 4) . '****' . substr($rawPhone, -3) : $rawPhone;
unset($admin['password']);
printSuccess([
"status" => "otp_required",
"message" => $success ? "تم إرسال رمز التحقق إلى WhatsApp الخاص بك." : "فشل إرسال واتساب. تحقق من error_log لمعرفة OTP.",
"phone" => $maskedPhone
"message" => "Login successful",
"admin" => $admin,
"jwt" => $jwt,
"expires_in" => 3600
]);
exit;
} else {