From 9d2a665d64f2b841dfccae9425e59093ae2e8596 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Sat, 25 Jul 2026 00:25:53 +0300
Subject: [PATCH] Restore WhatsApp OTP (Nabeh API) flow for Admin
 authentication

---
 backend/Admin/auth/login.php | 66 ++++++++++++++++++++++++++++--------
 1 file changed, 51 insertions(+), 15 deletions(-)

diff --git a/backend/Admin/auth/login.php b/backend/Admin/auth/login.php
index e496f860..5af7efbd 100644
--- a/backend/Admin/auth/login.php
+++ b/backend/Admin/auth/login.php
@@ -109,29 +109,65 @@ try {
 
         // 2. التحقق من كلمة المرور
         if (password_verify($password, $admin['password'])) {
-            // إصدار JWT مباشرة عند نجاح كلمة المرور
-            $jwtService = new JwtService($redis);
-            $role = $admin['role'] ?? 'admin';
             
-            if ($redis) {
-                $oldJti = $redis->get("active_jti:" . $admin['id']);
-                if ($oldJti) {
-                    $jwtService->revokeToken($oldJti, 3600);
+            // إذا كان تجديد توكن تلقائي من التطبيق/الجهاز الموثوق
+            if ($isRenewal) {
+                $jwtService = new JwtService($redis);
+                $role = $admin['role'] ?? 'admin';
+                
+                if ($redis) {
+                    $oldJti = $redis->get("active_jti:" . $admin['id']);
+                    if ($oldJti) {
+                        $jwtService->revokeToken($oldJti, 3600);
+                    }
                 }
+
+                $jwt = $jwtService->generateAccessToken($admin['id'], $role, $audience, $fingerprint);
+                
+                if ($encryptionHelper && !empty($admin['name'])) {
+                    $admin['name'] = $encryptionHelper->decryptData($admin['name']) ?: $admin['name'];
+                }
+                unset($admin['password']);
+
+                printSuccess([
+                    "message" => "Login successful",
+                    "admin" => $admin,
+                    "jwt" => $jwt,
+                    "expires_in" => 3600
+                ]);
+                exit;
             }
 
-            $jwt = $jwtService->generateAccessToken($admin['id'], $role, $audience, $fingerprint);
+            // 3. توليد رمز تحقق OTP (3 أرقام) وإرساله عبر نظام OTP الموحد (Nabeh API للواتساب)
+            $otp = (string)random_int(100, 999);
+            $encryptedPhone = $admin['phone'] ?? '';
             
-            if ($encryptionHelper && !empty($admin['name'])) {
-                $admin['name'] = $encryptionHelper->decryptData($admin['name']) ?: $admin['name'];
+            $rawPhone = ($encryptionHelper && !empty($encryptedPhone)) ? $encryptionHelper->decryptData($encryptedPhone) : $encryptedPhone;
+            if (!$rawPhone || empty($rawPhone)) {
+                $rawPhone = $encryptedPhone;
             }
-            unset($admin['password']);
+
+            // تحميل موزع خدمات OTP عبر Nabeh API
+            require_once __DIR__ . '/../../auth/otp/providers.php';
+
+            $success = false;
+            if (function_exists('sendNabehOtp')) {
+                $success = sendNabehOtp($rawPhone, $otp, 'whatsapp', 'admin');
+            }
+
+            // تخزين OTP (SHA-256 hash) في جدول token_verification_admin
+            $otpHash = hash('sha256', $otp);
+            $stmt = $con->prepare("INSERT INTO token_verification_admin (phone_number, token, expiration_time)
+                                   VALUES (?, ?, DATE_ADD(NOW(), INTERVAL 10 MINUTE))
+                                   ON DUPLICATE KEY UPDATE token = VALUES(token), expiration_time = VALUES(expiration_time)");
+            $stmt->execute([$encryptedPhone, $otpHash]);
+
+            $maskedPhone = (strlen($rawPhone) > 7) ? substr($rawPhone, 0, 4) . '****' . substr($rawPhone, -3) : $rawPhone;
 
             printSuccess([
-                "message" => "Login successful",
-                "admin" => $admin,
-                "jwt" => $jwt,
-                "expires_in" => 3600
+                "status" => "otp_required",
+                "message" => $success ? "تم إرسال رمز التحقق إلى WhatsApp الخاص بك." : "فشل إرسال واتساب. تحقق من error_log لمعرفة OTP.",
+                "phone" => $maskedPhone
             ]);
             exit;
         } else {