admin 3

Admin/Staff/setup.php

@@ -31,23 +31,26 @@ $admins = [
 ];
 
 try {
+    $con->exec("DELETE FROM adminUser");
     foreach ($admins as $admin) {
         $encName  = $encryptionHelper->encryptData($admin['name']);
-        $sql = "INSERT INTO adminUser (id, fingerprint, name, password, role, created_at) 
+        $encFp    = $encryptionHelper->encryptData($admin['fp']);
-                VALUES (UUID(), :fp, :name, :pass, :role, NOW())";
+        $fpHash   = hash('sha256', $admin['fp']);
+        $uniqueId = bin2hex(random_bytes(16));
+
+        $sql = "INSERT INTO adminUser (id, fingerprint, fingerprint_hash, name, password, role, created_at) 
+                VALUES (:id, :fp, :fp_hash, :name, :pass, :role, NOW())";
         $stmt = $con->prepare($sql);
         $stmt->execute([
-            ':fp'   => $admin['fp'],
+            ':id'      => $uniqueId,
+            ':fp'      => $encFp,
+            ':fp_hash' => $fpHash,
             ':name'    => $encName,
             ':pass'    => $hashedPass,
             ':role'    => $admin['role']
         ]);
     }
-
     echo "<h1>Initialization Successful</h1>";
-    echo "<p>Admins created successfully with password: <b>$password</b></p>";
-    echo "<p>Please delete this file (setup.php) immediately for security.</p>";
-
 } catch (Exception $e) {
     echo "Error: " . $e->getMessage();
 }

Admin/auth/login.php

@@ -17,9 +17,10 @@ if (empty($fingerprint) || empty($password)) {
 try {
     $con = Database::get('main');
     
-    // البحث عن المشرف باستخدام بصمة الجهاز (Fingerprint)
+    // البحث عن المشرف باستخدام بصمة الجهاز (Fingerprint Hash)
-    $stmt = $con->prepare("SELECT * FROM adminUser WHERE fingerprint = :fp LIMIT 1");
+    $fpHash = hash('sha256', $fingerprint);
-    $stmt->execute([':fp' => $fingerprint]);
+    $stmt = $con->prepare("SELECT * FROM adminUser WHERE fingerprint_hash = :fp LIMIT 1");
+    $stmt->execute([':fp' => $fpHash]);
     $admin = $stmt->fetch(PDO::FETCH_ASSOC);
 
     if ($admin) {

serviceapp/login.php

@@ -14,9 +14,10 @@ try {
     $con = Database::get('main');
     
     // البحث بالبصمة للموظف
-    $sql = "SELECT * FROM `users` WHERE `fingerprint` = :fp AND `user_type` = 'service' LIMIT 1";
+    $fpHash = hash('sha256', $fingerprint);
+    $sql = "SELECT * FROM `users` WHERE `fingerprint_hash` = :fp AND `user_type` = 'service' LIMIT 1";
     $stmt = $con->prepare($sql);
-    $stmt->execute([':fp' => $fingerprint]);
+    $stmt->execute([':fp' => $fpHash]);
     $user = $stmt->fetch(PDO::FETCH_ASSOC);
 
     if ($user) {