Hamza/fitness
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Connect Flutter phone auth and Android platform

Browse Source
This commit is contained in:
Hamza-Ayed
2026-10-04 01:44:07 +03:00
parent 5b90da6b18
commit 98490a17e6
44 changed files with 1271 additions and 168 deletions
Download Patch File Download Diff File Expand all files Collapse all files
public/api/v1/auth/verify-otp.php
+17 -7
View File
@@ -16,7 +16,8 @@ $platform = is_array($body) ? ($body['platform'] ?? null) : null;
if (!is_string($challengeId) || !preg_match('/^[0-9a-f-]{36}$/i', $challengeId) || !is_string($code) || !preg_match('/^[0-9]{6}$/', $code)) {
api_json(['error' => 'invalid_verification_payload'], 400);
}
if ($displayName !== null && (!is_string($displayName) || mb_strlen($displayName) > 100)) {
$displayNameLength = is_string($displayName) ? preg_match_all('/./us', $displayName) : 0;
if ($displayName !== null && (!is_string($displayName) || $displayNameLength === false || $displayNameLength > 100)) {
api_json(['error' => 'invalid_display_name'], 400);
}
if ($deviceUuid !== null && (!is_string($deviceUuid) || !preg_match('/^[0-9a-f-]{36}$/i', $deviceUuid))) {
@@ -39,6 +40,7 @@ try {
$db = Database::getInstance();
$connection = $db->getConnection();
$connection->begin_transaction();
$transactionOpen = true;
$challengeQuery = $db->prepare('SELECT challenge_uuid, phone_e164, purpose, code_digest, attempt_count, max_attempts, device_uuid FROM otp_challenges WHERE challenge_uuid = ? AND consumed_at IS NULL AND expires_at > UTC_TIMESTAMP() FOR UPDATE');
$challengeQuery->bind_param('s', $challengeId);
$challengeQuery->execute();
@@ -46,10 +48,12 @@ try {
$challengeQuery->close();
if (!$challenge || (int) $challenge['attempt_count'] >= (int) $challenge['max_attempts']) {
$connection->rollback();
$transactionOpen = false;
api_json(['error' => 'invalid_or_expired_challenge'], 400);
}
if ($deviceUuid !== null && $challenge['device_uuid'] !== null && !hash_equals($challenge['device_uuid'], $deviceUuid)) {
$connection->rollback();
$transactionOpen = false;
api_json(['error' => 'invalid_verification_payload'], 400);
}
@@ -60,6 +64,7 @@ try {
$fail->execute();
$fail->close();
$connection->commit();
$transactionOpen = false;
api_json(['error' => 'invalid_code'], 400);
}
@@ -69,6 +74,7 @@ try {
if ($consume->affected_rows !== 1) {
$consume->close();
$connection->rollback();
$transactionOpen = false;
api_json(['error' => 'invalid_or_expired_challenge'], 400);
}
$consume->close();
@@ -79,11 +85,13 @@ try {
$user = $userQuery->get_result()->fetch_assoc();
$userQuery->close();
if (!$user && $challenge['purpose'] === 'login') {
$connection->rollback();
$connection->commit();
$transactionOpen = false;
api_json(['error' => 'verification_failed'], 400);
}
if ($user && !(bool) $user['is_active']) {
$connection->rollback();
$connection->commit();
$transactionOpen = false;
api_json(['error' => 'account_inactive'], 403);
}
if (!$user) {
@@ -122,19 +130,21 @@ try {
$sessionInsert->bind_param('ssissi', $sessionId, $familyId, $userId, $resolvedDevice, $refreshDigest, $refreshDays);
$sessionInsert->execute();
$sessionInsert->close();
$connection->commit();
$accessTtl = max(60, min(3600, AppConfig::integer('JWT_ACCESS_TTL_SECONDS', 900)));
$accessToken = JwtToken::issue($userId, $sessionId, $accessTtl);
$connection->commit();
$transactionOpen = false;
api_json([
'user' => ['id' => $userId, 'uuid' => $user['uuid'], 'phone_e164' => $challenge['phone_e164'], 'account_role' => $user['account_role']],
'access_token' => JwtToken::issue($userId, $sessionId, $accessTtl),
'access_token' => $accessToken,
'token_type' => 'Bearer',
'expires_in_seconds' => $accessTtl,
'refresh_token' => $refreshToken,
'refresh_expires_in_days' => $refreshDays,
]);
} catch (Throwable $exception) {
if (isset($connection) && $connection instanceof mysqli) {
if (!empty($transactionOpen) && isset($connection) && $connection instanceof mysqli) {
try { $connection->rollback(); } catch (Throwable $ignored) {}
}
error_log('OTP verification failed: ' . $exception->getMessage());