Add blind-index search layer; fix captain detail 200-with-empty-body

Searching encrypted columns currently works only because encryptData() is
AES-CBC with a fixed IV, i.e. deterministic. That determinism is what leaks
equality and shared prefixes, and it is why moving storage to AES-GCM would
break every lookup. This separates the two concerns.

- core/Security/BlindIndex.php: HMAC-SHA256 over a normalised value, keyed by
  a secret pepper. Phone numbers have a small keyspace, so a bare SHA-256
  would be reversible by enumeration; the pepper lives in the environment, not
  the database. The scope string includes table and field so the same number
  does not produce a matching index across tables.
  Normalisation unifies local/international phone forms, lowercases emails and
  folds Arabic alef/ya/ta-marbuta and diacritics for names.
- migrations/: nullable *_bidx columns plus indexes, and the missing
  adminUser.status/approved_by/approved_at columns that admin approvals need.
- scripts/backfill_blind_index.php: restartable, batched, --dry-run capable,
  touches only index columns.
- Admin lookups by phone/email now match the index, keeping the old ciphertext
  comparison in the same query so search keeps working until the backfill runs.
  bootstrap exposes $blindIndex as null when no pepper is configured.

Also: AdminCaptain/getCaptainDetailsById.php selected driver.education, a
column absent from this schema. The PDOException was uncaught, so the client
received an empty body with HTTP 200 — the "non-JSON response" seen when
opening a captain. It now omits the column, catches the error, reports it as
JSON, and requires an admin role.

Console: opening any sidebar section refetches its data instead of showing
what was loaded when the console started.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/Admin/AdminCaptain/getCaptainDetailsByEmailOrIDOrPhone.php

@@ -5,6 +5,15 @@ $driver_id = filterRequest("driver_id");
 $driverEmail = $encryptionHelper->encryptData(filterRequest("driverEmail"));
 $driverPhone = $encryptionHelper->encryptData(filterRequest("driverPhone"));
 
+
+/**
+ * الفهرس الأعمى: يسمح بالبحث بعد نقل التخزين إلى AES-GCM العشوائي.
+ * تُبقى المقارنة القديمة في نفس الاستعلام كاحتياط حتى تنتهي تعبئة الفهارس.
+ */
+global $blindIndex;
+$emailBidx = $blindIndex ? $blindIndex->index('driver.email', filterRequest("driverEmail")) : null;
+$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', filterRequest("driverPhone")) : null;
+
 $sql = "SELECT
     `driver`.`id`,
     `driver`.`phone`,
@@ -53,6 +62,8 @@ $sql = "SELECT
     ) AS passengerToken
 FROM `driver`
 WHERE `driver`.`email` = :email OR `driver`.`phone` = :phone OR `driver`.`id` = :id
+    OR (:email_bidx IS NOT NULL AND `driver`.`email_bidx` = :email_bidx)
+    OR (:phone_bidx IS NOT NULL AND `driver`.`phone_bidx` = :phone_bidx)
 ORDER BY passengerAverageRating DESC
 LIMIT 10
 ";
@@ -61,6 +72,8 @@ $stmt = $con->prepare($sql);
 $stmt->bindParam(":email", $driverEmail);
 $stmt->bindParam(":phone", $driverPhone);
 $stmt->bindParam(":id", $driver_id);
+$stmt->bindParam(":email_bidx", $emailBidx);
+$stmt->bindParam(":phone_bidx", $phoneBidx);
 $stmt->execute();
 $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
 

backend/Admin/AdminCaptain/getCaptainDetailsById.php

@@ -1,9 +1,18 @@
 <?php
 require_once __DIR__ . '/../../connect.php';
 
-// تشفير driver_id قبل استخدامه في SQL
+if ($role !== 'admin' && $role !== 'super_admin') {
+    http_response_code(403);
+    echo json_encode(['error' => 'Unauthorized: Admin access required']);
+    exit;
+}
+
 $driver_id = filterRequest("driver_id");
 
+if (empty($driver_id)) {
+    jsonError("driver_id is required", 400);
+}
+
 $sql = "SELECT
     `driver`.`id`,
     `driver`.`phone`,
@@ -14,7 +23,6 @@ $sql = "SELECT
     `driver`.`site`,
     `driver`.`first_name`,
     `driver`.`last_name`,
-    `driver`.`education`,
     `driver`.`employmentType`,
     `driver`.`maritalStatus`,
     `driver`.`created_at`,
@@ -59,14 +67,23 @@ WHERE `driver`.`id` = :driver_id
 ORDER BY passengerAverageRating DESC
 LIMIT 10";
 
-$stmt = $con->prepare($sql);
-$stmt->bindParam(':driver_id', $driver_id);
-$stmt->execute();
-
-$result = $stmt->fetchAll(PDO::FETCH_ASSOC);
+try {
+    $stmt = $con->prepare($sql);
+    $stmt->bindParam(':driver_id', $driver_id);
+    $stmt->execute();
+    $result = $stmt->fetchAll(PDO::FETCH_ASSOC);
+} catch (PDOException $e) {
+    // بلا هذا الالتقاط كان الاستثناء يُنهي السكربت فيصل للعميل جسم فارغ
+    // بحالة HTTP 200، فيظهر كـ "رد غير JSON".
+    error_log("[getCaptainDetailsById] " . $e->getMessage());
+    jsonError("Could not read the captain record: " . $e->getMessage(), 500);
+}
 
 // فك تشفير الحقول الحساسة بعد الجلب
 foreach ($result as &$row) {
+    foreach (['phone','email','gender','birthdate','site','first_name','last_name','employmentType','maritalStatus'] as $f) {
+        if (!array_key_exists($f, $row)) $row[$f] = null;
+    }
     $row['phone'] = $encryptionHelper->decryptData($row['phone']);
     $row['email'] = $encryptionHelper->decryptData($row['email']);
     $row['gender'] = $encryptionHelper->decryptData($row['gender']);
@@ -74,7 +91,6 @@ foreach ($result as &$row) {
     $row['site'] = $encryptionHelper->decryptData($row['site']);
     $row['first_name'] = $encryptionHelper->decryptData($row['first_name']);
     $row['last_name'] = $encryptionHelper->decryptData($row['last_name']);
-    $row['education'] = $encryptionHelper->decryptData($row['education']);
     $row['employmentType'] = $encryptionHelper->decryptData($row['employmentType']);
     $row['maritalStatus'] = $encryptionHelper->decryptData($row['maritalStatus']);
 }

backend/Admin/driver/find_driver_by_phone.php

@@ -9,18 +9,34 @@ if (empty($phone)) {
 }
 
 try {
-    // تشفير الرقم المدخل للبحث
-    $encPhone = $encryptionHelper->encryptData($phone);
+    /**
+     * البحث عبر الفهرس الأعمى أولاً (phone_bidx): مطابقة تامة عبر فهرس مُهيأ
+     * ولا تعتمد على كون التشفير حتمياً، فتظل تعمل بعد النقل إلى AES-GCM.
+     *
+     * يُبقى المسار القديم (مقارنة النص المشفّر) كاحتياط حتى ينتهي تشغيل
+     * scripts/backfill_blind_index.php، وإلا لتوقّف البحث بين الترحيل والتعبئة.
+     */
+    global $blindIndex;
+    $driver = null;
 
-    // احضار كل الأعمدة باستثناء كلمة المرور
-    $sql = "SELECT * 
-            FROM driver 
-            WHERE phone = :phone 
-            LIMIT 1";
-    $stmt = $con->prepare($sql);
-    $stmt->execute([':phone' => $encPhone]);
+    if ($blindIndex) {
+        $bidx = $blindIndex->index('driver.phone', $phone);
+        if ($bidx) {
+            $stmt = $con->prepare("SELECT * FROM driver WHERE phone_bidx = :bidx LIMIT 1");
+            $stmt->execute([':bidx' => $bidx]);
+            $driver = $stmt->fetch(PDO::FETCH_ASSOC) ?: null;
+        }
+    }
 
-    $driver = $stmt->fetch(PDO::FETCH_ASSOC);
+    if (!$driver) {
+        $encPhone = $encryptionHelper->encryptData($phone);
+        $stmt = $con->prepare("SELECT * FROM driver WHERE phone = :phone LIMIT 1");
+        $stmt->execute([':phone' => $encPhone]);
+    }
+
+    if (!$driver) {
+        $driver = $stmt->fetch(PDO::FETCH_ASSOC);
+    }
 
     if ($driver) {
         // ✅ الحقول المشفرة اللي لازم تنفك:

backend/Admin/getPassengerbyEmail.php

@@ -5,6 +5,15 @@ $passengerEmail = $encryptionHelper->encryptData(filterRequest("passengerEmail")
 $passengerId = filterRequest("passengerId");
 $passengerphone = $encryptionHelper->encryptData(filterRequest("passengerphone"));
 
+
+/**
+ * الفهرس الأعمى: يسمح بالبحث بعد نقل التخزين إلى AES-GCM العشوائي.
+ * تُبقى المقارنة القديمة في نفس الاستعلام كاحتياط حتى تنتهي تعبئة الفهارس.
+ */
+global $blindIndex;
+$emailBidx = $blindIndex ? $blindIndex->index('passengers.email', filterRequest("passengerEmail")) : null;
+$phoneBidx = $blindIndex ? $blindIndex->index('passengers.phone', filterRequest("passengerphone")) : null;
+
 $sql = "SELECT
     `passengers`.`id`,
     `passengers`.`phone`,
@@ -59,12 +68,16 @@ FROM
     `passengers`
 WHERE
     passengers.email = :email OR passengers.phone = :phone OR passengers.id = :id
+    OR (:email_bidx IS NOT NULL AND passengers.email_bidx = :email_bidx)
+    OR (:phone_bidx IS NOT NULL AND passengers.phone_bidx = :phone_bidx)
 ";
 
 $stmt = $con->prepare($sql);
 $stmt->bindParam(":email", $passengerEmail);
 $stmt->bindParam(":phone", $passengerphone);
 $stmt->bindParam(":id", $passengerId);
+$stmt->bindParam(":email_bidx", $emailBidx);
+$stmt->bindParam(":phone_bidx", $phoneBidx);
 $stmt->execute();
 $result = $stmt->fetchAll(PDO::FETCH_ASSOC);