feat: harden backend security with HMAC verification, SSL validation, and documentation updates while removing legacy scripts.

backend/ride/driverWallet/transfer.php

@@ -12,6 +12,13 @@ if (empty($user_id) || $role !== 'driver') {
     exit;
 }
 
+// 1.1 HMAC إلزامي على تحويلات المحفظة (عملية حساسة تحرّك أموالاً حقيقية)
+if (empty($_SERVER['HTTP_X_HMAC_AUTH'] ?? null)) {
+    http_response_code(403);
+    echo json_encode(['status' => 'error', 'message' => 'Request verification required']);
+    exit;
+}
+
 $senderID = $user_id;                       // ✅ من JWT
 $receiverPhone = filterRequest('receiverPhone');
 $amount = filterRequest('amount');
@@ -74,7 +81,7 @@ $paymentServerUrl = "$walletServer/v2/main/ride/driverWallet/transfer.php";
 $postData = [
     'senderID' => $senderID,
     'receiverID' => $receiverID,
-    'amount' => $amount,
+    'amount' => $amountInt,
     'country' => $country
 ];
 
@@ -108,15 +115,15 @@ if ($httpCode === 200 && isset($paymentResponse['status']) && $paymentResponse['
     if (!empty($receiver['fcm_token'])) {
         $senderName = $decodedToken->name ?? 'A driver'; // Optional: Fetch sender name
         
-        $fcmBody = "You have received a transfer of " . $amount . " from " . $senderName;
+        $fcmBody = "You have received a transfer of " . $amountInt . " from " . $senderName;
         // Arabic fallback if name available
-        $fcmBodyAr = "لقد تلقيت حوالة بقيمة " . $amount . " من " . $senderName;
+        $fcmBodyAr = "لقد تلقيت حوالة بقيمة " . $amountInt . " من " . $senderName;
 
         sendFCM_Internal(
             $receiver['fcm_token'],
             "Transfer Received",
             $fcmBodyAr,
-            ['type' => 'transfer', 'amount' => $amount],
+            ['type' => 'transfer', 'amount' => $amountInt],
             'Transfer',
             false,
             'ding'