From 307009d14923731ed6d907887d51562ffb25d3d3 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Wed, 29 Jul 2026 17:09:33 +0300
Subject: [PATCH] add sample_decrypt.php for manual post-migration sanity
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Decrypts a random sample of migrated rows and prints masked plaintext
so the migration can be eyeballed for correctness beyond the automated
--verify pass — catches cases where decryption "succeeds" but produces
garbage rather than the real value.
---
 backend/scripts/sample_decrypt.php | 70 ++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 backend/scripts/sample_decrypt.php

diff --git a/backend/scripts/sample_decrypt.php b/backend/scripts/sample_decrypt.php
new file mode 100644
index 0000000..030e42f
--- /dev/null
+++ b/backend/scripts/sample_decrypt.php
@@ -0,0 +1,70 @@
+<?php
+/**
+ * scripts/sample_decrypt.php
+ *
+ * يفكّ تشفير عيّنة عشوائية من الجداول المرحَّلة ويطبعها مقنَّعة جزئياً،
+ * للتأكد بالعين أن ما وراء GCM: هو فعلاً القيمة الصحيحة لا قمامة.
+ *
+ *   php sample_decrypt.php              # 5 صفوف من كل جدول
+ *   php sample_decrypt.php --n=10
+ *   php sample_decrypt.php --table=driver
+ */
+declare(strict_types=1);
+if (PHP_SAPI !== 'cli') { exit("CLI only\n"); }
+
+require_once __DIR__ . '/../core/bootstrap.php';
+
+$opt   = getopt('', ['n::', 'table::']);
+$n     = max(1, (int) ($opt['n'] ?? 5));
+$only  = $opt['table'] ?? null;
+
+global $encryptionHelper;
+$con = Database::get('main');
+
+function mask(?string $s): string
+{
+    if ($s === null || $s === '') return '(empty)';
+    $len = mb_strlen($s);
+    if ($len <= 4) return str_repeat('*', $len);
+    return mb_substr($s, 0, 2) . str_repeat('*', $len - 3) . mb_substr($s, -1);
+}
+
+function dec($v)
+{
+    global $encryptionHelper;
+    if ($v === null || $v === '') return '(null)';
+    $p = $encryptionHelper->decryptData($v);
+    if ($p === false) return '‼️ DECRYPT FAILED';
+    $prefix = str_starts_with((string) $v, 'GCM:') ? 'GCM' : 'legacy/plain';
+    return "[$prefix] " . mask($p);
+}
+
+$targets = [
+    'driver'          => ['phone','email','gender','national_number','first_name','last_name','birthdate'],
+    'passengers'      => ['phone','email','gender','first_name','last_name'],
+    'users'           => ['phone','email','fingerprint','first_name'],
+    'CarRegistration' => ['vin','car_plate','owner'],
+];
+
+foreach ($targets as $t => $fields) {
+    if ($only && $only !== $t) continue;
+    echo "\n=== $t ===\n";
+    $rows = $con->query("SELECT * FROM `$t` ORDER BY RAND() LIMIT $n")->fetchAll(PDO::FETCH_ASSOC);
+    if (!$rows) { echo "  (no rows)\n"; continue; }
+
+    foreach ($rows as $r) {
+        $pk = $r['id'] ?? $r['idn'] ?? '?';
+        echo "  row [$pk]\n";
+        foreach ($fields as $f) {
+            if (!array_key_exists($f, $r)) continue;
+            printf("    %-16s %s\n", $f, dec($r[$f]));
+        }
+        // فهارس البحث موجودة؟
+        foreach (['phone_bidx','email_bidx','name_bidx'] as $idx) {
+            if (array_key_exists($idx, $r)) {
+                printf("    %-16s %s\n", $idx, empty($r[$idx]) ? '(missing!)' : substr($r[$idx], 0, 12) . '…');
+            }
+        }
+    }
+}
+echo "\nDone.\n";