387 lines
19 KiB
PHP
387 lines
19 KiB
PHP
<?php
|
|
// File: backend/auth/otp/verify.php
|
|
// Unified OTP verification endpoint
|
|
|
|
require_once __DIR__ . '/../../core/bootstrap.php';
|
|
require_once __DIR__ . '/../../functions.php';
|
|
|
|
// 0. Rate Limiting: 3 محاولات OTP كل 5 دقائق لكل IP
|
|
$rateLimiter = new RateLimiter($redis);
|
|
$rateLimiter->enforce(RateLimiter::identifier(), 'otp_verify');
|
|
|
|
// 1. Fetch input parameters
|
|
$phone_number = filterRequest("phone_number");
|
|
if (empty($phone_number)) {
|
|
$phone_number = filterRequest("receiver");
|
|
}
|
|
|
|
$token_code = filterRequest("token_code");
|
|
if (empty($token_code)) {
|
|
$token_code = filterRequest("token");
|
|
}
|
|
|
|
$user_type = filterRequest("user_type");
|
|
$context = filterRequest("context"); // token_change | login (default)
|
|
|
|
// user_type is taken from request only (JWT not trusted without signature verification)
|
|
|
|
if (empty($phone_number)) {
|
|
jsonError("Phone number is required.");
|
|
exit;
|
|
}
|
|
|
|
if (empty($token_code)) {
|
|
jsonError("Verification token code is required.");
|
|
exit;
|
|
}
|
|
|
|
if (empty($user_type)) {
|
|
if (strpos($_SERVER['REQUEST_URI'], 'driver') !== false) {
|
|
$user_type = 'driver';
|
|
} else {
|
|
$user_type = 'passenger';
|
|
}
|
|
}
|
|
|
|
if (empty($user_type) || !in_array($user_type, ['passenger', 'driver', 'admin', 'service'])) {
|
|
jsonError("User type must be 'passenger', 'driver', 'admin', or 'service'.");
|
|
exit;
|
|
}
|
|
|
|
// 2. Establish DB Connection
|
|
try {
|
|
$con = Database::get('main');
|
|
} catch (Exception $e) {
|
|
http_response_code(500);
|
|
exit(json_encode(['error' => 'Database connection failed']));
|
|
}
|
|
|
|
// 3. Encrypt data to query
|
|
// 4. Verify based on user type
|
|
try {
|
|
$encryptedPhoneSearch = otpPhoneKey($phone_number);
|
|
|
|
if ($user_type === 'admin') {
|
|
$sql = "SELECT * FROM token_verification_admin
|
|
WHERE expiration_time >= NOW() AND verified = 0 AND phone_number = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRow = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRow = $row;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRow) {
|
|
$deviceNumber = filterRequest("device_number") ?? '';
|
|
// adminUser stores unencrypted phone
|
|
$checkAdmin = $con->prepare("SELECT * FROM adminUser WHERE name = ?");
|
|
$checkAdmin->execute([$phone_number]);
|
|
$now = date("Y-m-d H:i:s");
|
|
|
|
// Mark token as verified
|
|
$updateToken = $con->prepare("UPDATE token_verification_admin SET verified = 1 WHERE phone_number = ? AND token = ?");
|
|
$updateToken->execute([$matchedRow['phone_number'], $matchedRow['token']]);
|
|
|
|
if ($checkAdmin->rowCount() > 0) {
|
|
$update = $con->prepare("UPDATE adminUser SET device_number = ?, updated_at = ? WHERE name = ?");
|
|
$update->execute([$deviceNumber, $now, $phone_number]);
|
|
jsonSuccess(["message" => "verified and updated existing admin"]);
|
|
} else {
|
|
$insert = $con->prepare("INSERT INTO adminUser (device_number, name, created_at, updated_at) VALUES (?, ?, ?, ?)");
|
|
$insert->execute([$deviceNumber, $phone_number, $now, $now]);
|
|
jsonSuccess(["message" => "verified and new admin created"]);
|
|
}
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
} elseif ($user_type === 'service') {
|
|
$sql = "SELECT `id`, `phone_number`, `token_code` FROM `phone_verification_service`
|
|
WHERE `expiration_time` > NOW() AND `is_verified` = 0 AND `phone_number` = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRowId = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token_code']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRowId = $row['id'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRowId) {
|
|
$sqlUpdate = "UPDATE `phone_verification_service` SET `is_verified` = 1 WHERE `id` = :id";
|
|
$stmtUpd = $con->prepare($sqlUpdate);
|
|
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
|
|
$stmtUpd->execute();
|
|
jsonSuccess(null, "Your phone number has been verified.");
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
} elseif ($user_type === 'driver') {
|
|
if ($context === 'token_change') {
|
|
$sql = "SELECT `id`, `phone_number`, `token` FROM `token_verification_driver`
|
|
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRowId = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRowId = $row['id'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRowId) {
|
|
$sqlUpdate = "UPDATE `token_verification_driver` SET `verified` = 1 WHERE `id` = :id";
|
|
$stmtUpd = $con->prepare($sqlUpdate);
|
|
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
|
|
$stmtUpd->execute();
|
|
|
|
// ═══════════════════════════════════════════════════════
|
|
// تغيير الجهاز: التحقق وحده لا يكفي. لا بد من ربط بصمة
|
|
// الجهاز الجديد ثم إصدار توكن driver — وإلا بقي التطبيق
|
|
// على توكن التسجيل ورجع كل endpoint محمي 403، وهو ما كان
|
|
// يجعل شاشة OTP "تنجح" ثم لا يعمل شيء بعدها.
|
|
// ═══════════════════════════════════════════════════════
|
|
$chk = $con->prepare("SELECT id FROM driver WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
|
|
global $blindIndex;
|
|
$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone_number) : null;
|
|
$chk->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
|
|
$driverRow = $chk->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if (!$driverRow) {
|
|
jsonSuccess(null, "Your phone number has been verified.");
|
|
exit;
|
|
}
|
|
|
|
$driverID = (string)$driverRow['id'];
|
|
|
|
$fpRaw = filterRequest("fingerprint") ?? filterRequest("fingerPrint") ?? ($_SERVER['HTTP_X_DEVICE_FP'] ?? null);
|
|
if ($fpRaw === null && function_exists('getallheaders')) {
|
|
$hdrs = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
$fpRaw = $hdrs['x-device-fp'] ?? null;
|
|
}
|
|
|
|
if (empty($fpRaw)) {
|
|
jsonError("Device fingerprint is required to complete device change.");
|
|
exit;
|
|
}
|
|
|
|
$fpPepper = getenv('FP_PEPPER') ?: '';
|
|
$fpHashed = !empty($fpPepper) ? hash('sha256', $fpRaw . $fpPepper) : $fpRaw;
|
|
$fcmToken = filterRequest("token");
|
|
|
|
// ربط الجهاز الجديد — نفس الصيغة التي يتوقعها loginJwtDriver.
|
|
$hasRow = $con->prepare("SELECT id FROM driverToken WHERE captain_id = ?");
|
|
$hasRow->execute([$driverID]);
|
|
if ($hasRow->fetch(PDO::FETCH_ASSOC)) {
|
|
if (!empty($fcmToken)) {
|
|
$con->prepare("UPDATE driverToken SET fingerPrint = ?, token = ? WHERE captain_id = ?")
|
|
->execute([$fpHashed, $encryptionHelper->encryptData($fcmToken), $driverID]);
|
|
} else {
|
|
$con->prepare("UPDATE driverToken SET fingerPrint = ? WHERE captain_id = ?")
|
|
->execute([$fpHashed, $driverID]);
|
|
}
|
|
} else {
|
|
$con->prepare("INSERT INTO driverToken (token, fingerPrint, captain_id, created_at) VALUES (?, ?, ?, NOW())")
|
|
->execute([
|
|
!empty($fcmToken) ? $encryptionHelper->encryptData($fcmToken) : '',
|
|
$fpHashed,
|
|
$driverID,
|
|
]);
|
|
}
|
|
|
|
$audDriver = filterRequest("aud") ?: filterRequest("audience") ?: (getenv('allowedDriver2') ?: 'driver-app:ios');
|
|
$jwtSvc = new JwtService($redis);
|
|
$accessToken = $jwtSvc->generateAccessToken($driverID, 'driver', $audDriver, $fpRaw);
|
|
|
|
jsonSuccess([
|
|
"driverID" => $driverID,
|
|
"jwt" => $accessToken,
|
|
"access_token" => $accessToken,
|
|
], "Your phone number has been verified.");
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
} else {
|
|
$sql = "SELECT `id`, `phone_number`, `token_code` FROM `phone_verification`
|
|
WHERE `expiration_time` > NOW() AND `is_verified` = 0 AND `phone_number` = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRowId = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token_code']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRowId = $row['id'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRowId) {
|
|
$sqlUpdate = "UPDATE `phone_verification` SET `is_verified` = 1 WHERE `id` = :id";
|
|
$stmtUpd = $con->prepare($sqlUpdate);
|
|
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
|
|
$stmtUpd->execute();
|
|
|
|
// Check registration status
|
|
$isRegistered = false;
|
|
$driverData = null;
|
|
|
|
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM driver WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
|
|
global $blindIndex;
|
|
$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone_number) : null;
|
|
$chkStmt->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
|
|
$driver = $chkStmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
// Generate driverID for unregistered users (hash of phone)
|
|
$driverID = '';
|
|
if ($driver) {
|
|
$isRegistered = true;
|
|
$driver['first_name'] = $encryptionHelper->decryptData($driver['first_name']);
|
|
$driver['last_name'] = $encryptionHelper->decryptData($driver['last_name']);
|
|
$driver['email'] = $encryptionHelper->decryptData($driver['email']);
|
|
$driver['phone'] = $encryptionHelper->decryptData($driver['phone']);
|
|
$driverData = $driver;
|
|
$driverID = (string)$driver['id'];
|
|
} else {
|
|
// driverID ثابت ومشتق من رقم الهاتف (نفس الرقم = نفس الـ ID)
|
|
$driverID = substr(md5($phone_number), 0, 16);
|
|
}
|
|
|
|
// Generate JWT tokens for driver
|
|
$audDriver = filterRequest("aud") ?: filterRequest("audience") ?: (getenv('allowedDriver2') ?: 'driver-app:ios');
|
|
$fpDriver = filterRequest("fingerprint") ?? filterRequest("fingerPrint") ?? ($_SERVER['HTTP_X_DEVICE_FP'] ?? null);
|
|
if ($fpDriver === null && function_exists('getallheaders')) {
|
|
$hdrs = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
$fpDriver = $hdrs['x-device-fp'] ?? null;
|
|
}
|
|
$jwtSvc = new JwtService($redis);
|
|
$accessToken = $jwtSvc->generateAccessToken($driverID, 'driver', $audDriver, $fpDriver);
|
|
$refreshToken = $jwtSvc->generateRefreshToken($driverID, 'driver', $audDriver);
|
|
|
|
jsonSuccess([
|
|
"isRegistered" => $isRegistered,
|
|
"driver" => $driverData,
|
|
"driverID" => $driverID,
|
|
"jwt" => $accessToken,
|
|
"token" => $accessToken,
|
|
"access_token" => $accessToken,
|
|
"refresh_token" => $refreshToken
|
|
], "Your phone number has been verified.");
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
}
|
|
} else {
|
|
if ($context === 'token_change') {
|
|
$sql = "SELECT `id`, `phone_number`, `token` FROM `token_verification`
|
|
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRowId = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRowId = $row['id'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRowId) {
|
|
$sqlUpdate = "UPDATE `token_verification` SET `verified` = 1 WHERE `id` = :id";
|
|
$stmtUpd = $con->prepare($sqlUpdate);
|
|
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
|
|
$stmtUpd->execute();
|
|
jsonSuccess(null, "Your phone number has been verified.");
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
} else {
|
|
$sql = "SELECT `id`, `phone_number`, `token` FROM `phone_verification_passenger`
|
|
WHERE `expiration_time` > NOW() AND `verified` = 0 AND `phone_number` = ?";
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute([$encryptedPhoneSearch]);
|
|
$rows = $stmt->fetchAll(PDO::FETCH_ASSOC);
|
|
|
|
$matchedRowId = null;
|
|
foreach ($rows as $row) {
|
|
$decryptedToken = $encryptionHelper->decryptData($row['token']);
|
|
if ($decryptedToken === $token_code) {
|
|
$matchedRowId = $row['id'];
|
|
break;
|
|
}
|
|
}
|
|
|
|
if ($matchedRowId) {
|
|
$sqlUpdate = "UPDATE `phone_verification_passenger` SET `verified` = 1 WHERE `id` = :id";
|
|
$stmtUpd = $con->prepare($sqlUpdate);
|
|
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
|
|
$stmtUpd->execute();
|
|
|
|
// Check registration status
|
|
$isRegistered = false;
|
|
$passengerData = null;
|
|
$passengerID = '';
|
|
|
|
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM passengers WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
|
|
global $blindIndex;
|
|
$phoneBidx = $blindIndex ? $blindIndex->index('passengers.phone', $phone_number) : null;
|
|
$chkStmt->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
|
|
$passenger = $chkStmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if ($passenger) {
|
|
$isRegistered = true;
|
|
$passenger['first_name'] = $encryptionHelper->decryptData($passenger['first_name']);
|
|
$passenger['last_name'] = $encryptionHelper->decryptData($passenger['last_name']);
|
|
$passenger['email'] = $encryptionHelper->decryptData($passenger['email']);
|
|
$passenger['phone'] = $encryptionHelper->decryptData($passenger['phone']);
|
|
$passengerData = $passenger;
|
|
$passengerID = (string)$passenger['id'];
|
|
} else {
|
|
$passengerID = substr(md5($phone_number), 0, 16);
|
|
}
|
|
|
|
// Generate JWT tokens for passenger
|
|
$audPass = filterRequest("aud") ?: filterRequest("audience") ?: (getenv('allowed2') ?: 'passenger-app:ios');
|
|
$fpPass = filterRequest("fingerprint") ?? filterRequest("fingerPrint") ?? ($_SERVER['HTTP_X_DEVICE_FP'] ?? null);
|
|
if ($fpPass === null && function_exists('getallheaders')) {
|
|
$hdrs = array_change_key_case(getallheaders(), CASE_LOWER);
|
|
$fpPass = $hdrs['x-device-fp'] ?? null;
|
|
}
|
|
$jwtSvc = new JwtService($redis);
|
|
$accessToken = $jwtSvc->generateAccessToken($passengerID, 'passenger', $audPass, $fpPass);
|
|
$refreshToken = $jwtSvc->generateRefreshToken($passengerID, 'passenger', $audPass);
|
|
|
|
jsonSuccess([
|
|
"isRegistered" => $isRegistered,
|
|
"passenger" => $passengerData,
|
|
"jwt" => $accessToken,
|
|
"token" => $accessToken,
|
|
"access_token" => $accessToken,
|
|
"refresh_token" => $refreshToken
|
|
], "Your phone number has been verified.");
|
|
} else {
|
|
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
|
|
}
|
|
}
|
|
}
|
|
} catch (PDOException $e) {
|
|
error_log("⚠️ [OTP DB Verify] Error: " . $e->getMessage());
|
|
jsonError("An error occurred during verification. Please try again.");
|
|
}
|