Update: 2026-07-30 12:31:26

backend/auth/passenger/loginUsingCredentialsWithoutGoogle.php

@@ -9,18 +9,16 @@ $password = filterRequest("password");
 $fingerprint = filterRequest('fingerPrint') ?? filterRequest('fingerprint');
 $audience = filterRequest('aud') ?: 'siro_passenger';
 
-// 1. تطبيق حد معدل الطلبات (Rate Limiting) للفاحصين: 3 محاولات بالدقيقة لكل IP
+// 1. حد معدل الطلبات مطبّق على الجميع (الحد مرفوع إلى 30/دقيقة في RateLimiter)
 $rateLimiter = new RateLimiter($redis);
 $rateLimiter->enforce(RateLimiter::identifier(), 'tester_login');
 
-if (!$email || !$password) {
-    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
-    exit();
-}
-
-// 2. التحقق من أن الحساب مخصص للفحص فقط (isTest check)
-$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: '';
-$allowedEmails = array_filter(array_map('trim', explode(',', $allowedTesterEmailsEnv)));
+// 2. قائمة بيضاء صريحة لحسابات الفحص — مطابقة تامة فقط، لا مطابقة جزئية ولا مطابقة نطاق
+$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: ($_ENV['ALLOWED_TESTER_EMAILS'] ?? '');
+$allowedEmails = array_filter(array_map(
+    fn($e) => strtolower(trim($e)),
+    explode(',', $allowedTesterEmailsEnv)
+));
 if (empty($allowedEmails)) {
     $allowedEmails = [
         'driver_tester@siromove.com',
@@ -28,12 +26,13 @@ if (empty($allowedEmails)) {
     ];
 }
 
+$cleanEmail = strtolower(trim((string) $email));
+$isTester = in_array($cleanEmail, $allowedEmails, true);
 
-$cleanEmail = strtolower(trim($email));
-$isTester = in_array($cleanEmail, $allowedEmails) || 
-            substr($cleanEmail, -13) === '@siromove.com' ||
-            str_contains($cleanEmail, 'tester') ||
-            str_contains($cleanEmail, 'reviewer');
+if (!$email || !$password) {
+    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
+    exit();
+}
 
 try {
     $con = Database::get('main');
@@ -121,7 +120,7 @@ try {
     http_response_code(500);
     echo json_encode([
         "status" => "failure",
-        "message" => "Server error: " . $e->getMessage() . " in " . basename($e->getFile()) . " on line " . $e->getLine()
+        "message" => "Server error. Please try again."
     ]);
 }
 exit();