Hamza/Siro
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: implement secure OTP-based payout workflow with dynamic fee calculation and improved authentication checks

Browse Source
This commit is contained in:
Hamza-Ayed
2026-07-19 01:51:39 +03:00
parent 5e80c886a0
commit 085b180bdb
11 changed files with 252 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/auth/driver/loginUsingCredentialsWithoutGoogle.php
+2 -70
View File
@@ -42,75 +42,7 @@ $encryptedEmail = $encryptionHelper->encryptData($email);
try {
$con = Database::get('main');
// Auto-seed/create tester driver if it doesn't exist
if ($cleanEmail === 'driver_tester@siromove.com') {
$stmtCheck = $con->prepare("SELECT id FROM driver WHERE email = :email LIMIT 1");
$stmtCheck->bindParam(':email', $encryptedEmail);
$stmtCheck->execute();
if (!$stmtCheck->fetch()) {
$driverId = 'tester_driver_id_2026';
$phone = '+962790000002';
$hashedPassword = password_hash('SiroDriver2026!', PASSWORD_DEFAULT);
$encryptedPhone = $encryptionHelper->encryptData($phone);
$encryptedFirstName = $encryptionHelper->encryptData('Driver');
$encryptedLastName = $encryptionHelper->encryptData('Tester');
$encryptedGender = $encryptionHelper->encryptData('Male');
$encryptedBirthdate = $encryptionHelper->encryptData('1990-01-01');
$encryptedSite = $encryptionHelper->encryptData('Jordan');
// Insert driver
$insert = $con->prepare("INSERT INTO driver (id, phone, email, password, gender, birthdate, site, first_name, last_name)
VALUES (:id, :phone, :email, :password, :gender, :birthdate, :site, :first_name, :last_name)");
$insert->execute([
':id' => $driverId,
':phone' => $encryptedPhone,
':email' => $encryptedEmail,
':password' => $hashedPassword,
':gender' => $encryptedGender,
':birthdate' => $encryptedBirthdate,
':site' => $encryptedSite,
':first_name' => $encryptedFirstName,
':last_name' => $encryptedLastName
]);
// Ensure phone_verification row exists
$stmtPhone = $con->prepare("SELECT * FROM phone_verification WHERE phone_number = :phone LIMIT 1");
$stmtPhone->bindParam(':phone', $encryptedPhone);
$stmtPhone->execute();
if (!$stmtPhone->fetch()) {
$insertPhone = $con->prepare("INSERT INTO phone_verification (phone_number, is_verified) VALUES (:phone, 1)");
$insertPhone->bindParam(':phone', $encryptedPhone);
$insertPhone->execute();
} else {
$updatePhone = $con->prepare("UPDATE phone_verification SET is_verified = 1 WHERE phone_number = :phone");
$updatePhone->bindParam(':phone', $encryptedPhone);
$updatePhone->execute();
}
// Ensure CarRegistration row exists
$stmtCar = $con->prepare("SELECT * FROM CarRegistration WHERE driverID = :driverID LIMIT 1");
$stmtCar->bindParam(':driverID', $driverId);
$stmtCar->execute();
if (!$stmtCar->fetch()) {
$insertCar = $con->prepare("INSERT INTO CarRegistration (driverID, vin, car_plate, make, model, year, expiration_date, color, owner, color_hex, fuel)
VALUES (:driverID, :vin, :car_plate, 'Toyota', 'Prius', 2020, '2030-01-01', 'White', :owner, '#FFFFFF', 'Petrol')");
$encryptedVin = $encryptionHelper->encryptData('TESTVIN1234567890');
$encryptedPlate = $encryptionHelper->encryptData('155186');
$encryptedOwner = $encryptionHelper->encryptData('Driver Tester');
$insertCar->execute([
':driverID' => $driverId,
':vin' => $encryptedVin,
':car_plate' => $encryptedPlate,
':owner' => $encryptedOwner
]);
} else {
$updateCar = $con->prepare("UPDATE CarRegistration SET make = 'Toyota', model = 'Prius', year = 2020 WHERE driverID = :driverID");
$updateCar->bindParam(':driverID', $driverId);
$updateCar->execute();
}
}
}
// Auto-seed/create tester driver logic removed for security
// SQL لاسترجاع المستخدم بناءً على البريد الإلكتروني المشفر
$sql = "SELECT
@@ -141,7 +73,7 @@ try {
}
// فحص الباسورد (في نظامنا، يمكن أن يكون الباسورد هو HMAC أو نص عادي للفاحصين)
// لنفترض أن الفاحص له باسورد عادي أو مشفر بـ bcrypt
if (password_verify($password, $data['password']) || $password === $data['password']) {
if (password_verify($password, $data['password'])) {
unset($data['password']);
// فك تشفير الحقول الحساسة
backend/auth/otp/request.php
+3 -3
View File
@@ -119,8 +119,8 @@ switch (strtolower($country)) {
// 6. DB Storage on Success
if ($sentSuccessfully) {
$encryptedPhone = $encryptionHelper->encryptData($receiver);
$encryptedOtp = $encryptionHelper->encryptData($otp);
$encryptedPhone = $encryptionHelper->encryptData($receiver); // Deterministic CBC
$encryptedOtp = $encryptionHelper->encryptDataGCM($otp); // Random GCM
$encryptedEmail = !empty($email) ? $encryptionHelper->encryptData($email) : '';
try {
@@ -143,7 +143,7 @@ if ($sentSuccessfully) {
$encryptedOtp
]);
} elseif ($user_type === 'driver') {
if ($context === 'token_change') {
if ($context === 'token_change' || $context === 'payout') {
// Delete old verification attempts
$stmtDel = $con->prepare("DELETE FROM `token_verification_driver` WHERE `phone_number` = ?");
$stmtDel->execute([$encryptedPhone]);
backend/auth/otp/verify.php
+20 -24
View File
@@ -59,18 +59,19 @@ try {
// 3. Encrypt data to query
// 4. Verify based on user type
try {
$encryptedPhoneSearch = $encryptionHelper->encryptData($phone_number);
if ($user_type === 'admin') {
$sql = "SELECT * FROM token_verification_admin
WHERE expiration_time >= NOW() AND verified = 0";
WHERE expiration_time >= NOW() AND verified = 0 AND phone_number = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRow = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRow = $row;
break;
}
@@ -101,16 +102,15 @@ try {
}
} elseif ($user_type === 'service') {
$sql = "SELECT `id`, `phone_number`, `token_code` FROM `phone_verification_service`
WHERE `expiration_time` > NOW() AND `is_verified` = 0";
WHERE `expiration_time` > NOW() AND `is_verified` = 0 AND `phone_number` = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRowId = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token_code']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRowId = $row['id'];
break;
}
@@ -128,16 +128,15 @@ try {
} elseif ($user_type === 'driver') {
if ($context === 'token_change') {
$sql = "SELECT `id`, `phone_number`, `token` FROM `token_verification_driver`
WHERE `expiration_time` > NOW() AND `verified` = 0";
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRowId = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRowId = $row['id'];
break;
}
@@ -154,16 +153,15 @@ try {
}
} else {
$sql = "SELECT `id`, `phone_number`, `token_code` FROM `phone_verification`
WHERE `expiration_time` > NOW() AND `is_verified` = 0";
WHERE `expiration_time` > NOW() AND `is_verified` = 0 AND `phone_number` = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRowId = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token_code']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRowId = $row['id'];
break;
}
@@ -210,16 +208,15 @@ try {
} else {
if ($context === 'token_change') {
$sql = "SELECT `id`, `phone_number`, `token` FROM `token_verification`
WHERE `expiration_time` > NOW() AND `verified` = 0";
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRowId = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRowId = $row['id'];
break;
}
@@ -236,16 +233,15 @@ try {
}
} else {
$sql = "SELECT `id`, `phone_number`, `token` FROM `phone_verification_passenger`
WHERE `expiration_time` > NOW() AND `verified` = 0";
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
$stmt = $con->prepare($sql);
$stmt->execute();
$stmt->execute([$encryptedPhoneSearch]);
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
$matchedRowId = null;
foreach ($rows as $row) {
$decryptedPhone = $encryptionHelper->decryptData($row['phone_number']);
$decryptedToken = $encryptionHelper->decryptData($row['token']);
if ($decryptedPhone === $phone_number && $decryptedToken === $token_code) {
if ($decryptedToken === $token_code) {
$matchedRowId = $row['id'];
break;
}
backend/auth/passenger/loginUsingCredentialsWithoutGoogle.php
+2 -48
View File
@@ -41,53 +41,7 @@ try {
// تشفير الإيميل للبحث في قاعدة البيانات
$encryptedEmail = $encryptionHelper->encryptData($email);
// Auto-seed/create tester passenger if it doesn't exist
if ($cleanEmail === 'passenger_tester@siromove.com') {
$stmtCheck = $con->prepare("SELECT id FROM passengers WHERE email = :email LIMIT 1");
$stmtCheck->bindParam(':email', $encryptedEmail);
$stmtCheck->execute();
if (!$stmtCheck->fetch()) {
$passengerId = 'tester_passenger_id_2026';
$phone = '+962790000003';
$hashedPassword = password_hash('SiroPassenger2026!', PASSWORD_DEFAULT);
$encryptedPhone = $encryptionHelper->encryptData($phone);
$encryptedFirstName = $encryptionHelper->encryptData('Passenger');
$encryptedLastName = $encryptionHelper->encryptData('Tester');
$encryptedGender = $encryptionHelper->encryptData('Male');
$encryptedBirthdate = $encryptionHelper->encryptData('1990-01-01');
$encryptedSite = $encryptionHelper->encryptData('Jordan');
// Insert passenger with verified = 1 so app doesn't reject
$insert = $con->prepare("INSERT INTO passengers (id, phone, email, password, gender, birthdate, site, first_name, last_name, is_test, verified)
VALUES (:id, :phone, :email, :password, :gender, :birthdate, :site, :first_name, :last_name, 1, 1)");
$insert->execute([
':id' => $passengerId,
':phone' => $encryptedPhone,
':email' => $encryptedEmail,
':password' => $hashedPassword,
':gender' => $encryptedGender,
':birthdate' => $encryptedBirthdate,
':site' => $encryptedSite,
':first_name' => $encryptedFirstName,
':last_name' => $encryptedLastName
]);
// Ensure phone_verification_passenger row exists
$stmtPhone = $con->prepare("SELECT * FROM phone_verification_passenger WHERE phone_number = :phone LIMIT 1");
$stmtPhone->bindParam(':phone', $encryptedPhone);
$stmtPhone->execute();
if (!$stmtPhone->fetch()) {
$insertPhone = $con->prepare("INSERT INTO phone_verification_passenger (phone_number, verified) VALUES (:phone, 1)");
$insertPhone->bindParam(':phone', $encryptedPhone);
$insertPhone->execute();
} else {
$updatePhone = $con->prepare("UPDATE phone_verification_passenger SET verified = 1 WHERE phone_number = :phone");
$updatePhone->bindParam(':phone', $encryptedPhone);
$updatePhone->execute();
}
}
}
// Auto-seed/create tester passenger logic removed for security
$sql = "SELECT
p.*,
@@ -111,7 +65,7 @@ try {
if ($data) {
// فحص الباسورد
if (password_verify($password, $data['password']) || $password === $data['password']) {
if (password_verify($password, $data['password'])) {
// التحقق من أن الحساب معلم كحساب فحص في قاعدة البيانات أو البيئة
$isTestInDb = (isset($data['is_test']) && $data['is_test'] == 1) || (isset($data['isTest']) && $data['isTest'] == 1);
if (!$isTestInDb && !$isTester) {
backend/auth/passenger/register.php
+3 -2
View File
@@ -63,7 +63,8 @@ try {
$firstName_encrypted = $encryptionHelper->encryptData($firstName);
$lastName_encrypted = $encryptionHelper->encryptData($lastName);
$email_encrypted = $encryptionHelper->encryptData($email);
$password_hashed = password_hash($email, PASSWORD_DEFAULT);
$uniqueId = substr(md5($phoneNumber), 0, 20);
$password_hashed = password_hash($email . $uniqueId, PASSWORD_DEFAULT);
$unknown_encrypted = $encryptionHelper->encryptData("unknown yet");
// ======================================================
@@ -94,7 +95,7 @@ try {
$step = 5;
// $uniqueId = substr(md5(uniqid(mt_rand(), true)), 0, 20);
$uniqueId = substr(md5($phoneNumber_encrypted), 0, 20);
// $uniqueId is now generated earlier
error_log("$logTag Step 5: Generated Unique ID: $uniqueId");