Hamza/intaleq_v2
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix driver JWT handshake password checking logic

Browse Source
This commit is contained in:
Hamza-Ayed
2026-04-25 11:57:41 +03:00
parent d78da5de88
commit 761254ab3c
1 changed files with 14 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
app/Http/Controllers/AuthController.php
View File

@@ -549,15 +549,20 @@ class AuthController extends Controller
$driver = Driver::where('id', $request->input('id'))->first(); $driver = Driver::where('id', $request->input('id'))->first();
if (!$driver) return $this->failure('User not found'); if (!$driver) return $this->failure('User not found');
// Verify the email (sent as password from Flutter) matches // The Flutter app sends the app-level secret (passnpassenger) in the 'password' field
$decryptedEmail = $this->encryption->decrypt($driver->email); $appSecret = config('intaleq.wallet_app_password', '');
if (!$decryptedEmail) { if ($appSecret !== '') {
// Fallback if decryption fails (e.g. invalid IV) if ($request->input('password') !== $appSecret) {
if ($driver->email !== $request->input('password')) { // Try email as fallback for old app versions
return $this->failure('Security mismatch: Invalid email verification (Decryption Failed)', 403); if ($request->input('password') !== $this->encryption->decrypt($driver->email)) {
return $this->failure('Security mismatch: Invalid app verification', 403);
}
}
} else {
// If app secret is not configured, fallback strictly to email
if ($request->input('password') !== $this->encryption->decrypt($driver->email)) {
return $this->failure('Security mismatch: Invalid email verification (Secret missing)', 403);
} }
} elseif ($decryptedEmail !== $request->input('password') && $driver->email !== $request->input('password')) {
return $this->failure('Security mismatch: Invalid email verification', 403);
} }
// Security Check: Verify fingerprint matches stored token // Security Check: Verify fingerprint matches stored token