first commit

2026-06-09 08:40:31 +03:00
commit d8901e1a87
3161 changed files with 536187 additions and 0 deletions
--- a/backend/loginAdmin.php
+++ b/backend/loginAdmin.php
@@ -0,0 +1,81 @@
+<?php
+// ============================================================
+// loginAdmin.php — تسجيل دخول الإدارة
+// ============================================================
+
+require_once __DIR__ . '/core/bootstrap.php';
+
+header('Content-Type: application/json');
+header("Access-Control-Allow-Origin: " . (getenv('ALLOWED_ORIGIN') ?: '*'));
+header("Access-Control-Allow-Methods: POST, OPTIONS");
+header("Access-Control-Allow-Headers: Content-Type, Authorization");
+
+if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
+    http_response_code(200);
+    exit;
+}
+
+// ── Rate Limiting ───────────────────────────────────────────
+$limiter = new RateLimiter($redis);
+$limiter->enforce(RateLimiter::identifier(), 'login');
+
+try {
+    $id       = filterRequest('id') ?? '';
+    $password = filterRequest('password') ?? '';
+    $audience = filterRequest('aud') ?? '';
+
+    $allowed1 = getenv('allowedDriver1');
+    $allowed2 = getenv('allowedDriver2');
+    $allowedAudiences = array_values(array_filter([$allowed1, $allowed2]));
+
+    if (empty($id) || empty($password) || empty($audience)) {
+        jsonError('ID and password are required.', 400);
+    }
+
+    if (!in_array($audience, $allowedAudiences, true)) {
+        jsonError('Invalid audience.', 400);
+    }
+
+    $con = Database::get('main');
+
+    // ── جلب بيانات المشرف ────────────────────────────────────
+    // ملاحظة: جدول admin_users سيتم إنشاؤه في Phase 4 (db_improvements.sql)
+    $stmt = $con->prepare("SELECT id, password, email, role FROM admin_users WHERE username = :id OR email = :id LIMIT 1");
+    $stmt->execute([':id' => $id]);
+    $admin = $stmt->fetch();
+
+    $startTime = microtime(true);
+
+    if ($admin && password_verify($password, $admin['password'])) {
+        
+        $limiter->reset(RateLimiter::identifier(), 'login');
+        
+        $jwtService = new JwtService($redis);
+        
+        // استخدام Role المخصص أو 'admin'
+        $role = $admin['role'] ?? 'admin';
+        
+        $jwt = $jwtService->generateAccessToken($admin['id'], $role, $audience);
+        $refresh = $jwtService->generateRefreshToken($admin['id']);
+
+        jsonSuccess([
+            'jwt' => $jwt,
+            'refresh_token' => $refresh['token'],
+            'expires_in' => 900
+        ]);
+
+    } else {
+        // حماية من Timing Attack
+        $elapsed = microtime(true) - $startTime;
+        if ($elapsed < 0.1) usleep((int)((0.1 - $elapsed) * 1000000));
+        
+        jsonError('Invalid ID or password.', 401);
+    }
+
+} catch (PDOException $e) {
+    securityLog("Admin Login PDO Error", ['msg' => $e->getMessage()]);
+    jsonError('Login failed: Database error', 500);
+} catch (Exception $e) {
+    securityLog("Admin Login Error", ['msg' => $e->getMessage()]);
+    jsonError('Login failed: Server error', 500);
+}