Siro/backend/nabeh/resolve_user.php

<?php
/**
 * Nabeh Integration — Resolve Phone → User ID
 *
 * Called by the payment server (server-to-server) to resolve
 * a phone number to a driverID or passengerID.
 *
 * Why: The wallet's invoice tables (invoices_shamcash, cliq_invoices, etc.)
 * store driverID/passengerID, NOT phone numbers. Only the Siro main DB
 * has the phone→userID mapping (with encryption).
 *
 * This endpoint bridges that gap:
 *   Payment Server (phone) → Siro Backend (resolve_user.php) → driverID
 *   Payment Server (driverID) → Wallet DB → pending invoices → AI verify
 *
 * Auth: X-API-Key header → NABEH_API_KEY
 */

require_once __DIR__ . '/../core/bootstrap.php';

header('Access-Control-Allow-Origin: *');
header('Access-Control-Allow-Methods: POST, OPTIONS');
header('Access-Control-Allow-Headers: Content-Type, X-API-Key');

if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') {
    http_response_code(200);
    exit;
}

if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
    http_response_code(405);
    echo json_encode(['status' => 'failure', 'message' => 'Method not allowed']);
    exit;
}

$apiKey = $_SERVER['HTTP_X_API_KEY'] ?? '';
$expectedKey = getenv('NABEH_API_KEY') ?: '';

if (empty($apiKey) || $apiKey !== $expectedKey) {
    http_response_code(401);
    echo json_encode(['status' => 'failure', 'message' => 'Unauthorized']);
    exit;
}

$input = json_decode(file_get_contents('php://input'), true);
$rawPhone = preg_replace('/\D+/', '', $input['phone'] ?? '');

if (empty($rawPhone)) {
    http_response_code(400);
    echo json_encode(['status' => 'failure', 'message' => 'Phone number is required']);
    exit;
}

// التطبيع عبر normalizePhone() الموحّدة في core/helpers.php (نفس المنطق سابقاً)
$phone = normalizePhone($rawPhone);

try {
    $db = Database::get('main');
    global $encryptionHelper;

    $encryptedPhone = $encryptionHelper->encryptData($phone);
    global $blindIndex;
    $dBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone) : null;
    $pBidx = $blindIndex ? $blindIndex->index('passengers.phone', $phone) : null;

    // Look for driver first
    $stmt = $db->prepare(
        "SELECT id, phone, first_name, last_name FROM driver WHERE phone = :phone OR (:bidx IS NOT NULL AND phone_bidx = :bidx) LIMIT 1"
    );
    $stmt->execute([':phone' => $encryptedPhone, ':bidx' => $dBidx]);
    $driver = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($driver) {
        echo json_encode([
            'status' => 'success',
            'data' => [
                'user_id' => $driver['id'],
                'phone'   => $encryptionHelper->decryptData($driver['phone']),
                'name'    => trim(
                    $encryptionHelper->decryptData($driver['first_name'])
                    . ' ' .
                    $encryptionHelper->decryptData($driver['last_name'])
                ),
                'type'    => 'driver',
            ],
        ], JSON_UNESCAPED_UNICODE);
        exit;
    }

    // Fallback: look for passenger
    $stmt = $db->prepare(
        "SELECT id, phone, first_name, last_name FROM passengers WHERE phone = :phone OR (:bidx IS NOT NULL AND phone_bidx = :bidx) LIMIT 1"
    );
    $stmt->execute([':phone' => $encryptedPhone, ':bidx' => $pBidx]);
    $passenger = $stmt->fetch(PDO::FETCH_ASSOC);

    if ($passenger) {
        echo json_encode([
            'status' => 'success',
            'data' => [
                'user_id' => $passenger['id'],
                'phone'   => $encryptionHelper->decryptData($passenger['phone']),
                'name'    => trim(
                    $encryptionHelper->decryptData($passenger['first_name'])
                    . ' ' .
                    $encryptionHelper->decryptData($passenger['last_name'])
                ),
                'type'    => 'passenger',
            ],
        ], JSON_UNESCAPED_UNICODE);
        exit;
    }

    echo json_encode([
        'status'  => 'success',
        'data'    => null,
        'message' => 'User not found',
    ]);

} catch (\Exception $e) {
    error_log("[ResolveUser Error] " . $e->getMessage());
    http_response_code(500);
    echo json_encode(['status' => 'failure', 'message' => 'Internal server error']);
}