Update: 2026-05-03 17:32:57

app/Core/Application.php

@@ -1,87 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-use Dotenv\Dotenv;
-use App\Core\{Request, Response, Router, Container};
-
-final class Application
-{
-    private Container $container;
-    private Router $router;
-    public static ?array $config = null;
-
-    public function __construct(string $basePath)
-    {
-        // 1. Load Environment Variables
-        // In local dev, .env is in the project root. In production, it might be moved.
-        $dotenv = Dotenv::createImmutable($basePath);
-        $dotenv->load();
-
-        // 2. Set Timezone
-        date_default_timezone_set($_ENV['APP_TIMEZONE'] ?? 'Asia/Amman');
-
-        // 3. Initialize Core Components
-        $this->container = new Container();
-        
-        // 4. Load Configurations
-        $this->loadConfigs($basePath);
-
-        $this->router = new Router($this->container);
-
-        // Register core services in container
-        $this->container->set(Container::class, $this->container);
-        $this->container->set(Router::class, $this->router);
-    }
-
-    private function loadConfigs(string $basePath): void
-    {
-        $configPath = $basePath . '/config';
-        $configs = [];
-
-        foreach (glob($configPath . '/*.php') as $file) {
-            $key = basename($file, '.php');
-            $configs[$key] = require $file;
-        }
-
-        self::$config = $configs;
-        $this->container->set('config', $configs);
-    }
-
-    public function getRouter(): Router
-    {
-        return $this->router;
-    }
-
-    public function run(): void
-    {
-        // 1. Security Headers
-        header('X-Content-Type-Options: nosniff');
-        header('X-Frame-Options: DENY');
-        header('X-XSS-Protection: 1; mode=block');
-        header('Strict-Transport-Security: max-age=31536000; includeSubDomains; preload');
-        header('Referrer-Policy: strict-origin-when-cross-origin');
-        header('Permissions-Policy: camera=(), microphone=(), geolocation=()');
-        header('Content-Security-Policy: default-src \'self\'; script-src \'self\' cdn.tailwindcss.com unpkg.com; style-src \'self\' \'unsafe-inline\' fonts.googleapis.com; font-src fonts.gstatic.com');
-        header_remove('X-Powered-By');
-
-        try {
-            $request = new Request();
-            $this->router->dispatch($request, $this->container);
-        } catch (\Throwable $e) {
-            // Global Exception Handler
-            Response::error(
-                'حدث خطأ غير متوقع في النظام',
-                'INTERNAL_SERVER_ERROR',
-                500,
-                [
-                    'message' => $e->getMessage(),
-                    'file' => $e->getFile(),
-                    'line' => $e->getLine()
-                ]
-            );
-        }
-    }
-}

app/Core/Container.php

@@ -1,72 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-use Exception;
-use ReflectionClass;
-use ReflectionNamedType;
-
-final class Container
-{
-    private array $instances = [];
-
-    public function set(string $id, mixed $concrete): void
-    {
-        $this->instances[$id] = $concrete;
-    }
-
-    public function get(string $id): mixed
-    {
-        if (isset($this->instances[$id])) {
-            if ($this->instances[$id] instanceof \Closure) {
-                $this->instances[$id] = ($this->instances[$id])($this);
-            }
-            return $this->instances[$id];
-        }
-
-        return $this->resolve($id);
-    }
-
-    public function resolve(string $id): mixed
-    {
-        if (!class_exists($id)) {
-            throw new Exception("Class {$id} cannot be resolved.");
-        }
-
-        $reflection = new ReflectionClass($id);
-
-        if (!$reflection->isInstantiable()) {
-            throw new Exception("Class {$id} is not instantiable.");
-        }
-
-        $constructor = $reflection->getConstructor();
-
-        if (is_null($constructor)) {
-            return new $id();
-        }
-
-        $parameters = $constructor->getParameters();
-        $dependencies = [];
-
-        foreach ($parameters as $parameter) {
-            $type = $parameter->getType();
-
-            if (!$type instanceof ReflectionNamedType || $type->isBuiltin()) {
-                if ($parameter->isDefaultValueAvailable()) {
-                    $dependencies[] = $parameter->getDefaultValue();
-                    continue;
-                }
-                throw new Exception("Unable to resolve parameter '{$parameter->getName()}' in class {$id}");
-            }
-
-            $dependencies[] = $this->get($type->getName());
-        }
-
-        $instance = $reflection->newInstanceArgs($dependencies);
-        $this->instances[$id] = $instance;
-
-        return $instance;
-    }
-}

app/Core/Database.php

@@ -1,4 +1,7 @@
 <?php
+/**
+ * Simple PDO Database Wrapper
+ */
 
 declare(strict_types=1);
 
@@ -6,7 +9,6 @@ namespace App\Core;
 
 use PDO;
 use PDOException;
-use Exception;
 
 final class Database
 {
@@ -15,24 +17,27 @@ final class Database
     public static function getInstance(): PDO
     {
         if (self::$instance === null) {
-            $host = $_ENV['DB_HOST'];
-            $db   = $_ENV['DB_DATABASE'];
-            $user = $_ENV['DB_USERNAME'];
-            $pass = $_ENV['DB_PASSWORD'];
-            $port = $_ENV['DB_PORT'];
-            $charset = $_ENV['DB_CHARSET'] ?? 'utf8mb4';
-
-            $dsn = "mysql:host=$host;dbname=$db;port=$port;charset=$charset";
-            $options = [
-                PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
-                PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
-                PDO::ATTR_EMULATE_PREPARES   => false,
-            ];
+            $config = require APP_PATH . '/config/database.php';
+            
+            $dsn = sprintf(
+                "mysql:host=%s;port=%s;dbname=%s;charset=%s",
+                $config['host'],
+                $config['port'],
+                $config['database'],
+                $config['charset']
+            );
 
             try {
-                self::$instance = new PDO($dsn, $user, $pass, $options);
+                self::$instance = new PDO($dsn, $config['username'], $config['password'], [
+                    PDO::ATTR_ERRMODE            => PDO::ERRMODE_EXCEPTION,
+                    PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
+                    PDO::ATTR_EMULATE_PREPARES   => false,
+                ]);
             } catch (PDOException $e) {
-                throw new Exception("Database Connection Error: " . $e->getMessage());
+                http_response_code(500);
+                header('Content-Type: application/json');
+                echo json_encode(['success' => false, 'message' => 'Database connection failed']);
+                exit;
             }
         }
 

app/Core/JWT.php

@@ -0,0 +1,52 @@
+<?php
+/**
+ * Simple JWT (HMAC SHA256)
+ */
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class JWT
+{
+    private static function base64UrlEncode(string $data): string
+    {
+        return str_replace(['+', '/', '='], ['-', '_', ''], base64_encode($data));
+    }
+
+    private static function base64UrlDecode(string $data): string
+    {
+        return base64_decode(str_replace(['-', '_'], ['+', '/'], $data));
+    }
+
+    public static function encode(array $payload, string $secret): string
+    {
+        $header = json_encode(['typ' => 'JWT', 'alg' => 'HS256']);
+        $base64UrlHeader = self::base64UrlEncode($header);
+        $base64UrlPayload = self::base64UrlEncode(json_encode($payload));
+        
+        $signature = hash_hmac('sha256', $base64UrlHeader . "." . $base64UrlPayload, $secret, true);
+        $base64UrlSignature = self::base64UrlEncode($signature);
+
+        return $base64UrlHeader . "." . $base64UrlPayload . "." . $base64UrlSignature;
+    }
+
+    public static function decode(string $token, string $secret): ?array
+    {
+        $parts = explode('.', $token);
+        if (count($parts) !== 3) return null;
+
+        [$header, $payload, $signature] = $parts;
+        
+        $expectedSignature = self::base64UrlEncode(hash_hmac('sha256', $header . "." . $payload, $secret, true));
+        
+        if (!hash_equals($expectedSignature, $signature)) return null;
+
+        $decodedPayload = json_decode(self::base64UrlDecode($payload), true);
+        
+        // Check expiry
+        if (isset($decodedPayload['exp']) && $decodedPayload['exp'] < time()) return null;
+
+        return $decodedPayload;
+    }
+}

app/Core/Redis.php

@@ -1,33 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-use Predis\Client;
-use Exception;
-
-final class Redis
-{
-    private static ?Client $instance = null;
-
-    public static function getInstance(): Client
-    {
-        if (self::$instance === null) {
-            try {
-                self::$instance = new Client([
-                    'scheme' => 'tcp',
-                    'host'   => $_ENV['REDIS_HOST'] ?? '127.0.0.1',
-                    'port'   => $_ENV['REDIS_PORT'] ?? 6379,
-                    'password' => $_ENV['REDIS_PASSWORD'] ?: null,
-                ]);
-            } catch (Exception $e) {
-                // If Redis fails, we might want to log it or handle gracefully
-                // depending on how critical it is.
-                throw new Exception("Redis Connection Error: " . $e->getMessage());
-            }
-        }
-
-        return self::$instance;
-    }
-}

app/Core/Request.php

@@ -1,58 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-final class Request
-{
-    private string $method;
-    private string $path;
-    private array $headers;
-    private array $queryParams;
-    private array $body;
-    private array $files;
-    public ?object $user = null; // Populated by AuthMiddleware
-    public ?string $tenantId = null; // Populated by TenantMiddleware
-
-    public function __construct()
-    {
-        $this->method = $_SERVER['REQUEST_METHOD'];
-        
-        // Read API path from query string: index.php?route=/api/v1/auth/login
-        $this->path = $_GET['route'] ?? parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);
-        $this->headers = getallheaders();
-        $this->queryParams = $_GET;
-        $this->files = $_FILES;
-        
-        $contentType = $this->getHeader('Content-Type') ?? $_SERVER['CONTENT_TYPE'] ?? '';
-        if ($contentType && str_contains(strtolower($contentType), 'application/json')) {
-            $this->body = json_decode(file_get_contents('php://input'), true) ?? [];
-        } else {
-            $this->body = $_POST;
-        }
-    }
-
-    public function getMethod(): string { return $this->method; }
-    public function getPath(): string { return $this->path; }
-    public function getHeaders(): array { return $this->headers; }
-    public function getQueryParams(): array { return $this->queryParams; }
-    public function getBody(): array { return $this->body; }
-    public function getFiles(): array { return $this->files; }
-
-    public function getHeader(string $name): ?string
-    {
-        $name = strtolower($name);
-        foreach ($this->headers as $key => $value) {
-            if (strtolower($key) === $name) {
-                return $value;
-            }
-        }
-        return null;
-    }
-
-    public function input(string $key, mixed $default = null): mixed
-    {
-        return $this->body[$key] ?? $this->queryParams[$key] ?? $default;
-    }
-}

app/Core/Response.php

@@ -1,45 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-final class Response
-{
-    public static function json(array $data, int $status = 200, array $headers = []): void
-    {
-        self::send($data, $status, array_merge(['Content-Type' => 'application/json; charset=utf-8'], $headers));
-    }
-
-    public static function error(string $messageAr, string $code, int $status = 400, ?array $details = null): void
-    {
-        $data = [
-            'success' => false,
-            'error' => [
-                'message_ar' => $messageAr,
-                'code' => $code,
-                'details' => $details
-            ]
-        ];
-        self::json($data, $status);
-    }
-
-    private static function send(mixed $data, int $status, array $headers): void
-    {
-        http_response_code($status);
-
-        foreach ($headers as $name => $value) {
-            header("$name: $value");
-        }
-
-        // Apply Security Headers
-        header('X-Content-Type-Options: nosniff');
-        header('X-Frame-Options: DENY');
-        header('X-XSS-Protection: 1; mode=block');
-        header('Referrer-Policy: strict-origin-when-cross-origin');
-        header_remove('X-Powered-By');
-
-        echo json_encode($data, JSON_UNESCAPED_UNICODE | JSON_PRETTY_PRINT);
-        exit;
-    }
-}

app/Core/Router.php

@@ -1,94 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Core;
-
-use FastRoute\RouteCollector;
-use function FastRoute\simpleDispatcher;
-
-final class Router
-{
-    private array $routes = [];
-    public Container $container;
-
-    public function __construct(Container $container)
-    {
-        $this->container = $container;
-    }
-
-    public function addRoute(string $method, string $path, array|callable $handler): void
-    {
-        $this->routes[] = [$method, $path, $handler];
-    }
-
-    public function dispatch(Request $request): void
-    {
-        $dispatcher = simpleDispatcher(function (RouteCollector $r) {
-            foreach ($this->routes as $route) {
-                $r->addRoute($route[0], $route[1], $route[2]);
-            }
-        });
-
-        $routeInfo = $dispatcher->dispatch($request->getMethod(), $request->getPath());
-
-        switch ($routeInfo[0]) {
-            case \FastRoute\Dispatcher::NOT_FOUND:
-                Response::error('المسار غير موجود', 'NOT_FOUND', 404);
-                break;
-            case \FastRoute\Dispatcher::METHOD_NOT_ALLOWED:
-                Response::error('الطريقة غير مسموح بها', 'METHOD_NOT_ALLOWED', 405);
-                break;
-            case \FastRoute\Dispatcher::FOUND:
-                $handler = $routeInfo[1];
-                $vars = $routeInfo[2];
-
-                $this->executeHandler($handler, $request, $this->container, $vars);
-                break;
-        }
-    }
-
-    private function executeHandler(mixed $handler, Request $request, Container $container, array $vars): void
-    {
-        if (is_array($handler) && isset($handler['middleware'])) {
-            $middlewares = (array) $handler['middleware'];
-            $finalHandler = $handler['handler'];
-
-            $pipeline = $this->createPipeline($middlewares, $finalHandler, $container, $vars);
-            $pipeline($request);
-        } else {
-            $this->callHandler($handler, $request, $container, $vars);
-        }
-    }
-
-    private function createPipeline(array $middlewares, mixed $handler, Container $container, array $vars): callable
-    {
-        return array_reduce(
-            array_reverse($middlewares),
-            function ($next, $middleware) use ($container) {
-                return function ($request) use ($next, $middleware, $container) {
-                    $parts = explode(':', $middleware);
-                    $className = $parts[0];
-                    $args = isset($parts[1]) ? explode(',', $parts[1]) : [];
-
-                    $instance = $container->get($className);
-                    return $instance->handle($request, $next, ...$args);
-                };
-            },
-            function ($request) use ($handler, $container, $vars) {
-                $this->callHandler($handler, $request, $container, $vars);
-            }
-        );
-    }
-
-    private function callHandler(mixed $handler, Request $request, Container $container, array $vars): void
-    {
-        if (is_array($handler)) {
-            [$controllerClass, $method] = $handler;
-            $controller = $container->get($controllerClass);
-            $controller->$method($request, ...array_values($vars));
-        } else {
-            $handler($request, ...array_values($vars));
-        }
-    }
-}

app/Core/Security.php

@@ -0,0 +1,21 @@
+<?php
+/**
+ * Simple Security Helpers
+ */
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class Security
+{
+    public static function sanitize(string $data): string
+    {
+        return htmlspecialchars(strip_tags(trim($data)));
+    }
+
+    public static function generateRandomString(int $length = 32): string
+    {
+        return bin2hex(random_bytes($length / 2));
+    }
+}

app/Core/Validator.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Simple Data Validator
+ */
+
+declare(strict_types=1);
+
+namespace App\Core;
+
+final class Validator
+{
+    public static function validate(array $data, array $rules): array
+    {
+        $errors = [];
+        foreach ($rules as $field => $rule) {
+            if (str_contains($rule, 'required') && (empty($data[$field]) && $data[$field] !== '0')) {
+                $errors[$field] = "The {$field} field is required.";
+            }
+            if (str_contains($rule, 'email') && !empty($data[$field]) && !filter_var($data[$field], FILTER_VALIDATE_EMAIL)) {
+                $errors[$field] = "The {$field} must be a valid email address.";
+            }
+        }
+        return $errors;
+    }
+}

app/Core/helpers.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-if (!function_exists('config')) {
-    /**
-     * Get a configuration value using dot notation.
-     * Example: config('app.name')
-     */
-    function config(string $key, mixed $default = null): mixed
-    {
-        $configs = \App\Core\Application::$config;
-        
-        if ($configs === null) {
-            return $default;
-        }
-
-        $parts = explode('.', $key);
-        $value = $configs;
-
-        foreach ($parts as $part) {
-            if (!isset($value[$part])) {
-                return $default;
-            }
-            $value = $value[$part];
-        }
-
-        return $value;
-    }
-}
-
-if (!function_exists('env')) {
-    function env(string $key, mixed $default = null): mixed
-    {
-        return $_ENV[$key] ?? $default;
-    }
-}

app/Middleware/AuthMiddleware.php

@@ -1,53 +1,34 @@
 <?php
+/**
+ * Simple Authentication Middleware
+ */
 
 declare(strict_types=1);
 
 namespace App\Middleware;
 
-use App\Core\{Request, Response};
-use App\Services\Security\JwtService;
-use Exception;
+use App\Core\JWT;
 
 final class AuthMiddleware
 {
-    public function __construct(private readonly JwtService $jwtService) {}
-
-    public function handle(Request $request, callable $next): mixed
+    public static function check(): array
     {
-        $authHeader = $request->getHeader('Authorization');
-
-        if (!$authHeader || !str_starts_with($authHeader, 'Bearer ')) {
-            Response::error('يجب تسجيل الدخول للوصول إلى هذا المورد', 'UNAUTHORIZED', 401);
-            return null;
+        $headers = getallheaders();
+        $authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? '';
+        
+        if (!str_starts_with($authHeader, 'Bearer ')) {
+            json_error('Unauthorized: Missing or invalid token', 401);
         }
 
         $token = substr($authHeader, 7);
-
-        try {
-            $decoded = $this->jwtService->verifyToken($token);
-
-            // Check if JTI is blacklisted
-            $jti = $decoded['jti'] ?? null;
-            if ($jti) {
-                try {
-                    $redis = \App\Core\Redis::getInstance();
-                    if ($redis->exists('jwt_blacklist:' . $jti)) {
-                        Response::error('الجلسة منتهية، يرجى تسجيل الدخول من جديد', 'TOKEN_REVOKED', 401);
-                        return null;
-                    }
-                } catch (\Throwable $e) {
-                    // Redis down — allow (fail open, log security event)
-                    error_log('[AUTH] JWT blacklist check failed: ' . $e->getMessage());
-                }
-            }
-
-            $request->user = (object) $decoded;
-            $request->tenantId = $decoded['tenant_id'] ?? null;
-        } catch (Exception $e) {
-            Response::error('جلسة العمل منتهية أو غير صالحة', 'UNAUTHORIZED', 401);
-            return null;
+        $secret = env('JWT_SECRET');
+        
+        $decoded = JWT::decode($token, $secret);
+        
+        if (!$decoded) {
+            json_error('Unauthorized: Invalid or expired token', 401);
         }
 
-        return $next($request);
+        return $decoded;
     }
 }

app/Middleware/CsrfMiddleware.php

@@ -1,43 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Middleware;
-
-use App\Core\{Request, Response};
-
-final class CsrfMiddleware
-{
-    public function handle(Request $request, callable $next): mixed
-    {
-        // Skip CSRF check for safe methods
-        if (in_array($request->getMethod(), ['GET', 'HEAD', 'OPTIONS'])) {
-            return $next($request);
-        }
-
-        // For APIs, we often use a custom header or check origin
-        // If we use sessions for tokens:
-        if (session_status() === PHP_SESSION_NONE) {
-            session_start();
-        }
-
-        $token = $request->getHeader('X-CSRF-TOKEN') ?: ($request->getBody()['_csrf'] ?? null);
-        $sessionToken = $_SESSION['csrf_token'] ?? null;
-
-        if (!$token || !$sessionToken || !hash_equals($sessionToken, $token)) {
-            // For now, if we are purely API with Bearer token, we might skip this.
-            // But if the request has a session or cookie, it's mandatory.
-            
-            // If the Authorization header is present, we might assume it's an API call
-            // that is naturally protected against CSRF if not using cookies for Auth.
-            if ($request->getHeader('Authorization')) {
-                return $next($request);
-            }
-
-            Response::error('رمز الحماية (CSRF) غير صالح أو مفقود', 'CSRF_INVALID', 403);
-            return null;
-        }
-
-        return $next($request);
-    }
-}

app/Middleware/HmacMiddleware.php

@@ -1,60 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Middleware;
-
-use App\Core\{Request, Response, Redis};
-use App\Services\Security\HmacService;
-use App\Core\Database;
-
-final class HmacMiddleware
-{
-    public function __construct(private readonly HmacService $hmac) {}
-
-    public function handle(Request $request, callable $next): mixed
-    {
-        $publicKey = $request->getHeader('X-Api-Key');
-        $signature = $request->getHeader('X-Signature');
-        $timestamp = $request->getHeader('X-Timestamp');
-        $nonce     = $request->getHeader('X-Nonce');
-
-        if (!$publicKey || !$signature || !$timestamp || !$nonce) {
-            Response::error('بيانات التوقيع (HMAC) ناقصة', 'HMAC_MISSING', 401);
-            return null;
-        }
-
-        // 1. Lookup Secret by Public Key
-        $db = Database::getInstance();
-        $stmt = $db->prepare("SELECT secret_hash, tenant_id FROM api_keys WHERE public_key = ? AND is_active = 1 LIMIT 1");
-        $stmt->execute([$publicKey]);
-        $apiKey = $stmt->fetch();
-
-        if (!$apiKey) {
-            Response::error('مفتاح API غير صالح', 'HMAC_INVALID_KEY', 401);
-            return null;
-        }
-
-        // 2. Verify Signature
-        // Note: secret_hash in DB is the actual secret for signing
-        $isValid = $this->hmac->verify(
-            $apiKey['secret_hash'],
-            $request->getMethod(),
-            $request->getPath(),
-            $timestamp,
-            $nonce,
-            json_encode($request->getBody()),
-            $signature
-        );
-
-        if (!$isValid) {
-            Response::error('توقيع الطلب غير صحيح', 'HMAC_INVALID_SIGNATURE', 401);
-            return null;
-        }
-
-        // 3. Set context
-        $request->tenantId = $apiKey['tenant_id'];
-
-        return $next($request);
-    }
-}

app/Middleware/RateLimitMiddleware.php

@@ -1,36 +1,53 @@
 <?php
+/**
+ * Simple Rate Limiting Middleware
+ */
 
 declare(strict_types=1);
 
 namespace App\Middleware;
 
-use App\Core\{Request, Response, Redis};
-
 final class RateLimitMiddleware
 {
     /**
-     * @param int $limit Requests allowed
-     * @param int $window Seconds window
+     * Basic file-based rate limiter to keep dependencies zero.
+     * In a production multi-server setup, switch this to Redis/DB.
      */
-    public function handle(Request $request, callable $next, int $limit = 60, int $window = 60): mixed
+    public static function check(int $maxRequests = 60, int $timeWindow = 60): void
     {
-        $redis = Redis::getInstance();
-        $ip = $_SERVER['REMOTE_ADDR'];
-        $key = "ratelimit:" . md5($request->getPath() . "|" . $ip);
-
-        $current = $redis->get($key);
-
-        if ($current && (int)$current >= $limit) {
-            Response::error('لقد تجاوزت الحد المسموح من الطلبات، يرجى المحاولة لاحقاً', 'RATE_LIMIT_EXCEEDED', 429);
-            return null;
+        $ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+        $cacheDir = STORAGE_PATH . '/cache';
+        $cacheFile = $cacheDir . '/rate_limit_' . md5($ip) . '.json';
+        
+        // Ensure cache directory exists
+        if (!is_dir($cacheDir)) {
+            mkdir($cacheDir, 0755, true);
         }
-
-        if (!$current) {
-            $redis->setex($key, $window, 1);
-        } else {
-            $redis->incr($key);
+        
+        $now = time();
+        $requests = [];
+        
+        // Read existing requests if file exists and is writable
+        if (file_exists($cacheFile)) {
+            $content = file_get_contents($cacheFile);
+            if ($content !== false) {
+                $data = json_decode($content, true);
+                if (is_array($data)) {
+                    // Filter out requests older than the time window
+                    $requests = array_filter($data, fn($timestamp) => $timestamp > ($now - $timeWindow));
+                }
+            }
         }
-
-        return $next($request);
+        
+        // Check limit
+        if (count($requests) >= $maxRequests) {
+            json_error('Too Many Requests. Please try again later.', 429);
+        }
+        
+        // Add current request
+        $requests[] = $now;
+        
+        // Save back to file
+        file_put_contents($cacheFile, json_encode(array_values($requests)));
     }
 }

app/Middleware/RoleMiddleware.php

@@ -1,37 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Middleware;
-
-use App\Core\{Request, Response};
-
-final class RoleMiddleware
-{
-    /**
-     * Handle the request.
-     * 
-     * @param Request $request
-     * @param callable $next
-     * @param string ...$roles
-     * @return mixed
-     */
-    public function handle(Request $request, callable $next, string ...$roles): mixed
-    {
-        $user = $request->user ?? null;
-
-        if (!$user) {
-            Response::error('يجب تسجيل الدخول للوصول إلى هذا المورد', 'UNAUTHORIZED', 401);
-            return null;
-        }
-
-        // Check if user role is in the allowed roles
-        // $user->role is an object property since we cast it in AuthMiddleware
-        if (!in_array($user->role, $roles)) {
-            Response::error('غير مسموح لك بالقيام بهذا الإجراء', 'FORBIDDEN', 403);
-            return null;
-        }
-
-        return $next($request);
-    }
-}

app/Middleware/TenantMiddleware.php

@@ -1,43 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Middleware;
-
-use App\Core\{Request, Response, Database};
-
-final class TenantMiddleware
-{
-    public function handle(Request $request, callable $next): mixed
-    {
-        $tenantId = $request->tenantId ?? null;
-
-        if (!$tenantId) {
-            Response::error('المستأجر غير معروف', 'TENANT_NOT_FOUND', 400);
-            return null;
-        }
-
-        // Check if tenant exists and is active
-        try {
-            $db = Database::getInstance();
-            $stmt = $db->prepare("SELECT status FROM tenants WHERE id = ? AND deleted_at IS NULL");
-            $stmt->execute([$tenantId]);
-            $tenant = $stmt->fetch();
-
-            if (!$tenant) {
-                Response::error('المستأجر غير موجود', 'TENANT_NOT_FOUND', 404);
-                return null;
-            }
-
-            if ($tenant['status'] === 'suspended') {
-                Response::error('تم إيقاف حساب المستأجر', 'TENANT_SUSPENDED', 403);
-                return null;
-            }
-        } catch (\Exception $e) {
-            Response::error('خطأ في الاتصال بقاعدة البيانات', 'DATABASE_ERROR', 500);
-            return null;
-        }
-
-        return $next($request);
-    }
-}

app/Models/BaseModel.php

@@ -1,66 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Models;
-
-use App\Core\Database;
-use PDO;
-
-abstract class BaseModel
-{
-    protected string $table;
-    protected string $primaryKey = 'id';
-    protected array $fillable = [];
-
-    protected function db(): PDO
-    {
-        return Database::getInstance();
-    }
-
-    public function find(string $id): ?array
-    {
-        $stmt = $this->db()->prepare("SELECT * FROM {$this->table} WHERE {$this->primaryKey} = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$id]);
-        return $stmt->fetch() ?: null;
-    }
-
-    public function create(array $data): string|bool
-    {
-        $columns = implode(', ', array_keys($data));
-        $placeholders = implode(', ', array_fill(0, count($data), '?'));
-
-        $sql = "INSERT INTO {$this->table} ({$columns}) VALUES ({$placeholders})";
-        $stmt = $this->db()->prepare($sql);
-        
-        if ($stmt->execute(array_values($data))) {
-            return $data[$this->primaryKey] ?? $this->db()->lastInsertId();
-        }
-
-        return false;
-    }
-
-    public function update(string $id, array $data): bool
-    {
-        $sets = [];
-        foreach (array_keys($data) as $column) {
-            $sets[] = "{$column} = ?";
-        }
-        $setString = implode(', ', $sets);
-
-        $sql = "UPDATE {$this->table} SET {$setString} WHERE {$this->primaryKey} = ?";
-        $stmt = $this->db()->prepare($sql);
-        
-        $params = array_values($data);
-        $params[] = $id;
-
-        return $stmt->execute($params);
-    }
-
-    public function delete(string $id): bool
-    {
-        $sql = "UPDATE {$this->table} SET deleted_at = NOW() WHERE {$this->primaryKey} = ?";
-        $stmt = $this->db()->prepare($sql);
-        return $stmt->execute([$id]);
-    }
-}

app/Modules/AI/AIController.php

@@ -1,83 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\AI;
-
-use App\Core\{Request, Response, Database};
-use GuzzleHttp\Client;
-use Throwable;
-
-final class AIController
-{
-    private Client $httpClient;
-    private string $apiKey;
-    private string $model;
-
-    public function __construct()
-    {
-        $this->httpClient = new Client();
-        $this->apiKey = $_ENV['GEMINI_API_KEY'] ?? '';
-        $this->model = $_ENV['GEMINI_MODEL'] ?? 'gemini-2.0-flash';
-    }
-
-    public function query(Request $request): void
-    {
-        $userQuery = $request->input('query');
-        if (!$userQuery) {
-            Response::error('يرجى تقديم استفسار', 'MISSING_QUERY', 422);
-            return;
-        }
-
-        try {
-            // 1. Fetch current context data (Summary of stats)
-            $stats = $this->getQuickStats($request->tenantId);
-
-            // 2. Ask Gemini to interpret and answer
-            $prompt = "You are Musadaq AI Assistant for a Jordanian E-Invoicing SaaS. " .
-                     "The user is asking: \"{$userQuery}\". " .
-                     "Current User Context: Tenant ID {$request->tenantId}. " .
-                     "Current Data Summary: " . json_encode($stats) . ". " .
-                     "Answer the user in a friendly Arabic tone (Jordanian dialect is okay). " .
-                     "Keep it professional and concise. If you don't have the specific data, say so politely.";
-
-            $response = $this->httpClient->post("https://generativelanguage.googleapis.com/v1beta/models/{$this->model}:generateContent?key={$this->apiKey}", [
-                'json' => [
-                    'contents' => [['parts' => [['text' => $prompt]]]]
-                ]
-            ]);
-
-            $data = json_decode($response->getBody()->getContents(), true);
-            $answer = $data['candidates'][0]['content']['parts'][0]['text'] ?? 'عذراً، لم أستطع فهم الاستفسار حالياً.';
-
-            Response::json([
-                'success' => true,
-                'data' => [
-                    'answer' => $answer
-                ]
-            ]);
-
-        } catch (Throwable $e) {
-            Response::error('فشل معالجة الاستعلام الذكي', 'AI_QUERY_FAILED', 500, [
-                'error' => $e->getMessage()
-            ]);
-        }
-    }
-
-    private function getQuickStats(string $tenantId): array
-    {
-        $db = Database::getInstance();
-        
-        $totalInvoices = $db->prepare("SELECT COUNT(*) as total FROM invoices WHERE tenant_id = ?");
-        $totalInvoices->execute([$tenantId]);
-        
-        $approvedCount = $db->prepare("SELECT COUNT(*) as total FROM invoices WHERE tenant_id = ? AND status = 'approved'");
-        $approvedCount->execute([$tenantId]);
-
-        return [
-            'total_invoices' => $totalInvoices->fetch()['total'],
-            'approved_invoices' => $approvedCount->fetch()['total'],
-            'current_month' => date('F Y')
-        ];
-    }
-}

app/Modules/Admin/AdminController.php

@@ -1,76 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Admin;
-
-use App\Core\{Request, Response, Database};
-
-final class AdminController
-{
-    public function listTenants(Request $request): void
-    {
-        if ($request->user->role !== 'super_admin') {
-            Response::error('غير مصرح لك بالوصول لهذه البيانات', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $db = Database::getInstance();
-        $stmt = $db->prepare("SELECT t.*, (SELECT COUNT(*) FROM invoices WHERE tenant_id = t.id) as invoice_count FROM tenants t");
-        $stmt->execute();
-        $tenants = $stmt->fetchAll();
-
-        Response::json(['success' => true, 'data' => $tenants]);
-    }
-
-    public function getSystemStats(Request $request): void
-    {
-        if ($request->user->role !== 'super_admin') {
-            Response::error('Forbidden', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $db = Database::getInstance();
-        
-        $stats = [
-            'total_tenants' => (int)$db->query("SELECT COUNT(*) FROM tenants")->fetchColumn(),
-            'total_invoices' => (int)$db->query("SELECT COUNT(*) FROM invoices")->fetchColumn(),
-            'total_users' => (int)$db->query("SELECT COUNT(*) FROM users")->fetchColumn(),
-            'active_subscriptions' => (int)$db->query("SELECT COUNT(*) FROM subscriptions WHERE status = 'active'")->fetchColumn()
-        ];
-
-        Response::json(['success' => true, 'data' => $stats]);
-    }
-
-    public function getQueueStatus(Request $request): void
-    {
-        if ($request->user->role !== 'super_admin') {
-            Response::error('Forbidden', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $db = Database::getInstance();
-        $stmt = $db->prepare("SELECT status, COUNT(*) as count FROM queue_jobs GROUP BY status");
-        $stmt->execute();
-        $counts = $stmt->fetchAll();
-
-        Response::json(['success' => true, 'data' => $counts]);
-    }
-
-    public function health(Request $request): void
-    {
-        $dbStatus = 'ok';
-        try { Database::getInstance()->query("SELECT 1"); } catch (\Throwable $e) { $dbStatus = 'error'; }
-
-        $redisStatus = 'ok';
-        try { \App\Core\Redis::getInstance()->ping(); } catch (\Throwable $e) { $redisStatus = 'error'; }
-
-        Response::json([
-            'success' => true,
-            'data' => [
-                'database' => $dbStatus,
-                'redis' => $redisStatus,
-                'php_version' => PHP_VERSION,
-                'server_time' => date('Y-m-d H:i:s')
-            ]
-        ]);
-    }
-}

app/Modules/ApiKeys/ApiKeyController.php

@@ -1,63 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\ApiKeys;
-
-use App\Core\{Request, Response, Database};
-
-final class ApiKeyController
-{
-    public function index(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $db = Database::getInstance();
-        
-        $stmt = $db->prepare("SELECT id, public_key, name, is_active, created_at FROM api_keys WHERE tenant_id = ? AND is_active = 1");
-        $stmt->execute([$tenantId]);
-        $keys = $stmt->fetchAll();
-
-        Response::json(['success' => true, 'data' => $keys]);
-    }
-
-    public function create(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $data = $request->getBody();
-        $name = $data['name'] ?? 'Default Key';
-        
-        $publicKey = bin2hex(random_bytes(16)); // 32 chars
-        $secret = bin2hex(random_bytes(32));    // 64 chars
-        
-        $db = Database::getInstance();
-        $stmt = $db->prepare("INSERT INTO api_keys (id, tenant_id, name, public_key, secret_hash, is_active, created_at) VALUES (?, ?, ?, ?, ?, 1, NOW())");
-        
-        $id = \Ramsey\Uuid\Uuid::uuid4()->toString();
-        $stmt->execute([
-            $id,
-            $tenantId,
-            $name,
-            $publicKey,
-            password_hash($secret, PASSWORD_BCRYPT)
-        ]);
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم إنشاء مفتاح API بنجاح. يرجى حفظ السر (Secret) الآن لأنه لن يظهر مرة أخرى.',
-            'data' => [
-                'id' => $id,
-                'public_key' => $publicKey,
-                'secret' => $secret
-            ]
-        ], 201);
-    }
-
-    public function revoke(Request $request, string $id): void
-    {
-        $tenantId = $request->tenantId;
-        $db = Database::getInstance();
-        
-        $stmt = $db->prepare("UPDATE api_keys SET is_active = 0 WHERE id = ? AND tenant_id = ?");
-        $stmt->execute([$id, $tenantId]);
-
-        Response::json(['success' => true, 'message' => 'تم إيقاف مفتاح API بنجاح']);
-    }
-}

app/Modules/ApiKeys/ApiKeyModel.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\ApiKeys;
-
-use App\Models\BaseModel;
-
-final class ApiKeyModel extends BaseModel
-{
-    protected string $table = 'api_keys';
-
-    public function findAllByTenant(string $tenantId): array
-    {
-        $stmt = $this->db()->prepare("SELECT id, name, prefix, expires_at, last_used_at, is_active, created_at FROM {$this->table} WHERE tenant_id = ? AND deleted_at IS NULL");
-        $stmt->execute([$tenantId]);
-        return $stmt->fetchAll();
-    }
-}

app/Modules/Auth/AuthController.php

@@ -1,189 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Auth;
-
-use App\Core\{Request, Response};
-use App\Modules\Auth\AuthService;
-use Throwable;
-
-final class AuthController
-{
-    public function __construct(private readonly AuthService $authService) {}
-
-    public function login(Request $request): void
-    {
-        $email = $request->input('email');
-        $password = $request->input('password');
-
-        if (!$email || !$password) {
-            Response::error('يرجى إدخال البريد الإلكتروني وكلمة المرور', 'VALIDATION_ERROR', 422);
-            return;
-        }
-
-        try {
-            $result = $this->authService->login($email, $password);
-            
-            // 2FA Check
-            if ($result['user']->totp_enabled) {
-                Response::json([
-                    'success' => true,
-                    'requires_2fa' => true,
-                    'temp_token' => $result['access_token']
-                ]);
-                return;
-            }
-
-            // Set refresh token in HttpOnly cookie
-            setcookie('refresh_token', $result['refresh_token'], [
-                'expires' => time() + (60 * 60 * 24 * 7),
-                'path' => '/api/v1/auth/refresh',
-                'httponly' => true,
-                'samesite' => 'Strict',
-                'secure' => true
-            ]);
-
-            unset($result['refresh_token']);
-
-            Response::json([
-                'success' => true,
-                'data' => $result,
-                'message' => 'تم تسجيل الدخول بنجاح'
-            ]);
-        } catch (Throwable $e) {
-            Response::error($e->getMessage(), 'AUTH_FAILED', 401);
-        }
-    }
-
-    public function me(Request $request): void
-    {
-        $db = \App\Core\Database::getInstance();
-        $stmt = $db->prepare("SELECT id, tenant_id, name, email, role, totp_enabled FROM users WHERE id = ?");
-        $stmt->execute([$request->user->user_id]);
-        $user = $stmt->fetch();
-
-        Response::json([
-            'success' => true,
-            'data' => $user
-        ]);
-    }
-
-    public function logout(Request $request): void
-    {
-        // Clear refresh token cookie
-        setcookie('refresh_token', '', [
-            'expires' => time() - 3600,
-            'path' => '/api/v1/auth/refresh',
-            'httponly' => true,
-            'samesite' => 'Strict',
-            'secure' => true
-        ]);
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم تسجيل الخروج بنجاح'
-        ]);
-    }
-
-    public function refresh(Request $request): void
-    {
-        $refreshToken = $_COOKIE['refresh_token'] ?? null;
-
-        if (!$refreshToken) {
-            Response::error('رمز التجديد مفقود', 'UNAUTHORIZED', 401);
-            return;
-        }
-
-        try {
-            $result = $this->authService->refresh($refreshToken);
-            
-            // Set new refresh token in HttpOnly cookie
-            setcookie('refresh_token', $result['refresh_token'], [
-                'expires' => time() + (60 * 60 * 24 * 7),
-                'path' => '/api/v1/auth/refresh',
-                'httponly' => true,
-                'samesite' => 'Strict',
-                'secure' => true
-            ]);
-
-            unset($result['refresh_token']);
-
-            Response::json([
-                'success' => true,
-                'data' => $result,
-                'message' => 'تم تجديد الجلسة بنجاح'
-            ]);
-        } catch (Throwable $e) {
-            Response::error($e->getMessage(), 'REFRESH_FAILED', 401);
-        }
-    }
-    public function register(Request $request): void
-    {
-        try {
-            $result = $this->authService->register($request->getBody());
-            
-            // Set refresh token in HttpOnly cookie
-            setcookie('refresh_token', $result['refresh_token'], [
-                'expires' => time() + (60 * 60 * 24 * 7),
-                'path' => '/api/v1/auth/refresh',
-                'httponly' => true,
-                'samesite' => 'Strict',
-                'secure' => true
-            ]);
-
-            unset($result['refresh_token']);
-
-            Response::json([
-                'success' => true,
-                'data' => $result,
-                'message' => 'تم إنشاء الحساب وتسجيل الدخول بنجاح'
-            ]);
-        } catch (Throwable $e) {
-            Response::error($e->getMessage(), 'REGISTRATION_FAILED', 400);
-        }
-    }
-
-    public function enable2FA(Request $request): void
-    {
-        $user = $request->user;
-        $totpService = new \App\Services\TotpService();
-        $secret = $totpService->generateSecret();
-        $qrUrl = $totpService->getQrCodeUrl($user->email, $secret);
-
-        Response::json([
-            'success' => true,
-            'data' => [
-                'secret' => $secret,
-                'qr_url' => $qrUrl
-            ]
-        ]);
-    }
-
-    public function verify2FA(Request $request): void
-    {
-        $data = $request->getBody();
-        $code = $data['code'] ?? '';
-        $secret = $data['secret'] ?? '';
-        
-        $totpService = new \App\Services\TotpService();
-        if ($totpService->verify($secret, $code)) {
-            $db = \App\Core\Database::getInstance();
-            $stmt = $db->prepare("UPDATE users SET totp_secret = ?, totp_enabled = 1 WHERE id = ?");
-            $stmt->execute([$secret, $request->user->user_id]);
-
-            Response::json(['success' => true, 'message' => 'تم تفعيل التحقق الثنائي بنجاح']);
-        } else {
-            Response::error('رمز التحقق غير صحيح', 'INVALID_CODE', 400);
-        }
-    }
-
-    public function disable2FA(Request $request): void
-    {
-        $db = \App\Core\Database::getInstance();
-        $stmt = $db->prepare("UPDATE users SET totp_secret = NULL, totp_enabled = 0 WHERE id = ?");
-        $stmt->execute([$request->user->user_id]);
-
-        Response::json(['success' => true, 'message' => 'تم تعطيل التحقق الثنائي']);
-    }
-}

app/Modules/Auth/AuthService.php

@@ -1,157 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Auth;
-
-use App\Modules\Users\UserModel;
-use App\Modules\Tenants\TenantModel;
-use App\Modules\Subscriptions\SubscriptionModel;
-use App\Services\Security\JwtService;
-use Ramsey\Uuid\Uuid;
-use Exception;
-
-final class AuthService
-{
-    public function __construct(
-        private readonly UserModel $userModel,
-        private readonly JwtService $jwtService,
-        private readonly TenantModel $tenantModel,
-        private readonly SubscriptionModel $subscriptionModel
-    ) {}
-
-    public function login(string $email, string $password): array
-    {
-        $user = $this->userModel->findByEmail($email);
-
-        if (!$user || !password_verify($password, $user['password_hash'])) {
-            throw new Exception("البريد الإلكتروني أو كلمة المرور غير صحيحة");
-        }
-
-        if (!$user['is_active']) {
-            throw new Exception("هذا الحساب معطل حالياً");
-        }
-
-        $accessToken = $this->jwtService->issueAccessToken([
-            'user_id' => $user['id'],
-            'tenant_id' => $user['tenant_id'],
-            'role' => $user['role'],
-            'assigned_company_id' => $user['assigned_company_id']
-        ]);
-
-        $refreshToken = $this->jwtService->issueRefreshToken($user['id']);
-        
-        // Update refresh token hash in DB
-        $this->userModel->update($user['id'], [
-            'refresh_token_hash' => password_hash($refreshToken, PASSWORD_BCRYPT),
-            'last_login_at' => date('Y-m-d H:i:s'),
-            'last_login_ip' => $_SERVER['REMOTE_ADDR'] ?? null
-        ]);
-
-        return [
-            'access_token' => $accessToken,
-            'refresh_token' => $refreshToken,
-            'user' => [
-                'id' => $user['id'],
-                'name' => $user['name'],
-                'email' => $user['email'],
-                'role' => $user['role'],
-                'assigned_company_id' => $user['assigned_company_id']
-            ]
-        ];
-    }
-
-    public function refresh(string $refreshToken): array
-    {
-        $parts = explode('.', $refreshToken);
-        if (count($parts) !== 2) {
-            throw new Exception("رمز التجديد غير صالحة");
-        }
-
-        [$userId, $random] = $parts;
-        $user = $this->userModel->find($userId);
-
-        if (!$user || !$user['is_active']) {
-            throw new Exception("المستخدم غير موجود أو معطل");
-        }
-
-        if (!$user['refresh_token_hash'] || !password_verify($refreshToken, $user['refresh_token_hash'])) {
-            throw new Exception("جلسة العمل منتهية، يرجى تسجيل الدخول مرة أخرى");
-        }
-
-        $accessToken = $this->jwtService->issueAccessToken([
-            'user_id' => $user['id'],
-            'tenant_id' => $user['tenant_id'],
-            'role' => $user['role'],
-            'assigned_company_id' => $user['assigned_company_id']
-        ]);
-
-        $newRefreshToken = $this->jwtService->issueRefreshToken($user['id']);
-        
-        $this->userModel->update($user['id'], [
-            'refresh_token_hash' => password_hash($newRefreshToken, PASSWORD_BCRYPT)
-        ]);
-
-        return [
-            'access_token' => $accessToken,
-            'refresh_token' => $newRefreshToken,
-            'user' => [
-                'id' => $user['id'],
-                'name' => $user['name'],
-                'email' => $user['email'],
-                'role' => $user['role'],
-                'assigned_company_id' => $user['assigned_company_id']
-            ]
-        ];
-    }
-
-    public function register(array $data): array
-    {
-        // 1. Check if tenant already exists
-        if ($this->tenantModel->findByEmail($data['email'])) {
-            throw new Exception("هذا البريد الإلكتروني مسجل مسبقاً");
-        }
-
-        $tenantId = Uuid::uuid4()->toString();
-        $userId = Uuid::uuid4()->toString();
-
-        // 2. Create Tenant
-        $this->tenantModel->create([
-            'id' => $tenantId,
-            'name' => $data['tenant_name'],
-            'email' => $data['email'],
-            'status' => 'trial',
-            'trial_ends_at' => date('Y-m-d H:i:s', strtotime('+14 days'))
-        ]);
-
-        // 3. Create Subscription
-        $this->subscriptionModel->create([
-            'tenant_id' => $tenantId,
-            'plan' => 'basic',
-            'status' => 'trial'
-        ]);
-
-        // 4. Create User
-        $this->userModel->create([
-            'id' => $userId,
-            'tenant_id' => $tenantId,
-            'name' => $data['user_name'],
-            'email' => $data['email'],
-            'password_hash' => password_hash($data['password'], PASSWORD_ARGON2ID),
-            'role' => 'admin',
-            'is_active' => 1
-        ]);
-
-        return $this->login($data['email'], $data['password']);
-    }
-    public function logout(string $jti, int $remaining): void
-    {
-        // Blacklist the JTI for its remaining lifetime
-        try {
-            $redis = \App\Core\Redis::getInstance();
-            $redis->setex('jwt_blacklist:' . $jti, max($remaining, 1), '1');
-        } catch (\Throwable $e) {
-            error_log('[AUTH] Could not blacklist JTI: ' . $e->getMessage());
-        }
-    }
-}

app/Modules/Companies/CompanyController.php

@@ -1,75 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Companies;
-
-use App\Core\{Request, Response};
-use App\Modules\Companies\{CompanyModel, CompanyService};
-use Throwable;
-
-final class CompanyController
-{
-    public function __construct(
-        private readonly CompanyModel $companyModel,
-        private readonly CompanyService $companyService
-    ) {}
-
-    public function list(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $role = $request->user->role ?? 'viewer';
-        $assignedCompanyId = $request->user->assigned_company_id ?? null;
-
-        if ($role === 'super_admin') {
-            $companies = $this->companyModel->findByTenant($tenantId);
-        } else {
-            // Filter by assigned company
-            $db = \App\Core\Database::getInstance();
-            $stmt = $db->prepare("SELECT * FROM companies WHERE tenant_id = ? AND id = ? AND deleted_at IS NULL");
-            $stmt->execute([$tenantId, $assignedCompanyId]);
-            $companies = $stmt->fetchAll();
-        }
-
-        Response::json([
-            'success' => true,
-            'data' => $companies
-        ]);
-    }
-
-    public function create(Request $request): void
-    {
-        $data = $request->getBody();
-        $data['tenant_id'] = $request->tenantId;
-
-        try {
-            $companyId = $this->companyService->createCompany($data);
-            Response::json([
-                'success' => true,
-                'data' => ['id' => $companyId],
-                'message' => 'تم إضافة الشركة بنجاح'
-            ], 201);
-        } catch (Throwable $e) {
-            Response::error('فشل إضافة الشركة', 'CREATE_FAILED', 500);
-        }
-    }
-
-    public function updateJoFotara(Request $request, string $id): void
-    {
-        $data = [
-            'jofotara_client_id' => $request->input('client_id'),
-            'jofotara_secret_key' => $request->input('secret_key'),
-            'is_jofotara_linked' => 1
-        ];
-
-        try {
-            $this->companyService->updateJoFotara($id, $data);
-            Response::json([
-                'success' => true,
-                'message' => 'تم تحديث بيانات جو-فواتير بنجاح'
-            ]);
-        } catch (Throwable $e) {
-            Response::error('فشل تحديث البيانات', 'UPDATE_FAILED', 500);
-        }
-    }
-}

app/Modules/Companies/CompanyModel.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Companies;
-
-use App\Models\BaseModel;
-
-final class CompanyModel extends BaseModel
-{
-    protected string $table = 'companies';
-
-    public function findByTenant(string $tenantId): array
-    {
-        $stmt = $this->db()->prepare("SELECT * FROM {$this->table} WHERE tenant_id = ? AND deleted_at IS NULL");
-        $stmt->execute([$tenantId]);
-        return $stmt->fetchAll();
-    }
-}

app/Modules/Companies/CompanyService.php

@@ -1,62 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Companies;
-
-use App\Services\Security\EncryptionService;
-use App\Modules\Companies\CompanyModel;
-use Ramsey\Uuid\Uuid;
-
-final class CompanyService
-{
-    public function __construct(
-        private readonly CompanyModel $companyModel,
-        private readonly EncryptionService $encryption
-    ) {}
-
-    public function createCompany(array $data): string
-    {
-        if (!isset($data['id'])) {
-            $data['id'] = Uuid::uuid4()->toString();
-        }
-        // Encrypt sensitive JoFotara credentials
-        if (isset($data['jofotara_client_id'])) {
-            $data['jofotara_client_id_encrypted'] = $this->encryption->encrypt($data['jofotara_client_id']);
-            unset($data['jofotara_client_id']);
-        }
-
-        if (isset($data['jofotara_secret_key'])) {
-            $data['jofotara_secret_key_encrypted'] = $this->encryption->encrypt($data['jofotara_secret_key']);
-            unset($data['jofotara_secret_key']);
-        }
-
-        return (string)$this->companyModel->create($data);
-    }
-
-    public function updateJoFotara(string $id, array $data): bool
-    {
-        if (isset($data['jofotara_client_id'])) {
-            $data['jofotara_client_id_encrypted'] = $this->encryption->encrypt($data['jofotara_client_id']);
-            unset($data['jofotara_client_id']);
-        }
-
-        if (isset($data['jofotara_secret_key'])) {
-            $data['jofotara_secret_key_encrypted'] = $this->encryption->encrypt($data['jofotara_secret_key']);
-            unset($data['jofotara_secret_key']);
-        }
-
-        return $this->companyModel->update($id, $data);
-    }
-
-    public function getJoFotaraCredentials(string $companyId): array
-    {
-        $company = $this->companyModel->find($companyId);
-        if (!$company) return [];
-
-        return [
-            'clientId' => $company['jofotara_client_id_encrypted'] ? $this->encryption->decrypt($company['jofotara_client_id_encrypted']) : null,
-            'secretKey' => $company['jofotara_secret_key_encrypted'] ? $this->encryption->decrypt($company['jofotara_secret_key_encrypted']) : null,
-        ];
-    }
-}

app/Modules/Dashboard/DashboardController.php

@@ -1,89 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Dashboard;
-
-use App\Core\{Request, Response, Database};
-
-final class DashboardController
-{
-    public function getStats(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $role = $request->user->role ?? 'viewer';
-        $assignedCompanyId = $request->user->assigned_company_id ?? null;
-        $db = Database::getInstance();
-
-        // Build scope: accountants see only their company, admins see all tenant companies
-        $companyScope = '';
-        $params = [$tenantId];
-        if ($role === 'accountant' && $assignedCompanyId) {
-            $companyScope = ' AND i.company_id = ?';
-            $params[] = $assignedCompanyId;
-        }
-
-        // Invoices this month
-        $stmt = $db->prepare("SELECT COUNT(*) as c FROM invoices i 
-            WHERE i.tenant_id = ? {$companyScope} AND MONTH(i.created_at) = MONTH(CURDATE()) AND YEAR(i.created_at) = YEAR(CURDATE()) AND i.deleted_at IS NULL");
-        $stmt->execute($params);
-        $thisMonth = (int)$stmt->fetchColumn();
-
-        // Total invoices
-        $stmt = $db->prepare("SELECT COUNT(*) as c FROM invoices i WHERE i.tenant_id = ? {$companyScope} AND i.deleted_at IS NULL");
-        $stmt->execute($params);
-        $total = (int)$stmt->fetchColumn();
-
-        // Status distribution
-        $stmt = $db->prepare("SELECT status, COUNT(*) as count FROM invoices i 
-            WHERE i.tenant_id = ? {$companyScope} AND i.deleted_at IS NULL GROUP BY status");
-        $stmt->execute($params);
-        $statusDistribution = $stmt->fetchAll();
-
-        // Approved count
-        $stmt = $db->prepare("SELECT COUNT(*) FROM invoices i 
-            WHERE i.tenant_id = ? {$companyScope} AND i.status = 'approved' AND i.deleted_at IS NULL");
-        $stmt->execute($params);
-        $approved = (int)$stmt->fetchColumn();
-
-        // Companies count
-        $stmt = $db->prepare("SELECT COUNT(*) FROM companies WHERE tenant_id = ? AND is_active = 1 AND deleted_at IS NULL");
-        $stmt->execute([$tenantId]);
-        $companiesCount = (int)$stmt->fetchColumn();
-
-        // Subscription usage
-        $stmt = $db->prepare("SELECT max_invoices_per_month, invoices_used_this_month FROM subscriptions WHERE tenant_id = ?");
-        $stmt->execute([$tenantId]);
-        $sub = $stmt->fetch();
-        $usagePct = $sub && $sub['max_invoices_per_month'] > 0
-            ? round(($sub['invoices_used_this_month'] / $sub['max_invoices_per_month']) * 100)
-            : 0;
-
-        // Recent invoices with company name
-        $stmt = $db->prepare("SELECT i.id, i.invoice_number, i.invoice_date, i.grand_total, i.status, i.created_at, c.name as company_name
-            FROM invoices i 
-            JOIN companies c ON i.company_id = c.id
-            WHERE i.tenant_id = ? {$companyScope} AND i.deleted_at IS NULL
-            ORDER BY i.created_at DESC LIMIT 10");
-        $stmt->execute($params);
-        $recent = $stmt->fetchAll();
-
-        // Unresolved risk flags
-        $stmt = $db->prepare("SELECT COUNT(*) FROM risk_scores WHERE tenant_id = ? AND is_resolved = 0");
-        $stmt->execute([$tenantId]);
-        $riskCount = (int)$stmt->fetchColumn();
-
-        Response::json([
-            'success' => true,
-            'data' => [
-                'total_invoices' => $total,
-                'invoices_this_month' => $thisMonth,
-                'approved_invoices' => $approved,
-                'companies_count' => $companiesCount,
-                'subscription_usage_pct' => $usagePct,
-                'subscription' => $sub,
-                'status_distribution' => $statusDistribution,
-                'recent_invoices' => $recent,
-                'risk_alerts_count' => $riskCount,
-            ]
-        ]);
-    }
-}

app/Modules/Invoices/Actions/DownloadInvoiceFileAction.php

@@ -1,30 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices\Actions;
-
-use App\Core\Database;
-use Exception;
-
-final class DownloadInvoiceFileAction {
-    public function execute(string $invoiceId, string $tenantId, $user): array {
-        $db = Database::getInstance();
-        $stmt = $db->prepare("SELECT original_file_path, company_id FROM invoices WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$invoiceId, $tenantId]);
-        $invoice = $stmt->fetch();
-
-        if (!$invoice || !file_exists($invoice['original_file_path'])) {
-            throw new Exception('الملف غير موجود', 404);
-        }
-
-        $role = $user->role ?? 'viewer';
-        if ($role !== 'super_admin' && $invoice['company_id'] !== ($user->assigned_company_id ?? null)) {
-            throw new Exception('غير مصرح لك بمشاهدة هذا الملف', 403);
-        }
-
-        return [
-            'path' => $invoice['original_file_path'],
-            'mime' => mime_content_type($invoice['original_file_path']),
-            'name' => basename($invoice['original_file_path'])
-        ];
-    }
-}

app/Modules/Invoices/Actions/GetInvoiceDetailAction.php

@@ -1,31 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices\Actions;
-
-use App\Core\Database;
-use Exception;
-
-final class GetInvoiceDetailAction {
-    public function execute(string $invoiceId, string $tenantId, $user): array {
-        $db = Database::getInstance();
-        
-        $stmt = $db->prepare("SELECT * FROM invoices WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$invoiceId, $tenantId]);
-        $invoice = $stmt->fetch();
-
-        if (!$invoice) {
-            throw new Exception('الفاتورة غير موجودة أو تم حذفها', 404);
-        }
-
-        $role = $user->role ?? 'viewer';
-        if ($role !== 'super_admin' && $invoice['company_id'] !== ($user->assigned_company_id ?? null)) {
-            throw new Exception('غير مصرح لك بالوصول لهذه الفاتورة', 403);
-        }
-
-        $stmt = $db->prepare("SELECT * FROM invoice_lines WHERE invoice_id = ? ORDER BY line_number ASC");
-        $stmt->execute([$invoiceId]);
-        $invoice['lines'] = $stmt->fetchAll() ?: [];
-
-        return $invoice;
-    }
-}

app/Modules/Invoices/Actions/ListInvoicesAction.php

@@ -1,31 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices\Actions;
-
-use App\Core\Database;
-
-final class ListInvoicesAction {
-    public function execute(string $tenantId, $user): array {
-        $db = Database::getInstance();
-        $role = $user->role ?? 'viewer';
-        $assignedCompanyId = $user->assigned_company_id ?? null;
-
-        if ($role === 'super_admin' || $role === 'admin') {
-            $stmt = $db->prepare("SELECT i.*, c.name as company_name 
-                                FROM invoices i 
-                                JOIN companies c ON i.company_id = c.id 
-                                WHERE i.tenant_id = ? AND i.deleted_at IS NULL 
-                                ORDER BY i.created_at DESC");
-            $stmt->execute([$tenantId]);
-        } else {
-            $stmt = $db->prepare("SELECT i.*, c.name as company_name 
-                                FROM invoices i 
-                                JOIN companies c ON i.company_id = c.id 
-                                WHERE i.tenant_id = ? AND i.company_id = ? AND i.deleted_at IS NULL 
-                                ORDER BY i.created_at DESC");
-            $stmt->execute([$tenantId, $assignedCompanyId]);
-        }
-
-        return $stmt->fetchAll() ?: [];
-    }
-}

app/Modules/Invoices/Actions/SubmitInvoiceAction.php

@@ -1,23 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices\Actions;
-
-use App\Services\QueueService;
-use App\Core\Database;
-use Exception;
-
-final class SubmitInvoiceAction {
-    public function execute(string $invoiceId, string $tenantId): void {
-        $db = Database::getInstance();
-        $stmt = $db->prepare("SELECT id FROM invoices WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$invoiceId, $tenantId]);
-        
-        if (!$stmt->fetch()) {
-            throw new Exception('الفاتورة غير موجودة', 404);
-        }
-
-        QueueService::push('submit_jofotara', [
-            'invoice_id' => $invoiceId
-        ]);
-    }
-}

app/Modules/Invoices/Actions/UploadInvoiceAction.php

@@ -1,49 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices\Actions;
-
-use App\Services\FileStorageService;
-use App\Modules\Invoices\InvoiceModel;
-use App\Services\QueueService;
-use Exception;
-use Ramsey\Uuid\Uuid;
-
-final class UploadInvoiceAction {
-    public function __construct(
-        private readonly FileStorageService $storage,
-        private readonly InvoiceModel $invoiceModel
-    ) {}
-
-    public function execute(array $files, string $companyId, string $tenantId, $user): string {
-        if (empty($files['invoice'])) {
-            throw new Exception('يرجى اختيار ملف الفاتورة', 422);
-        }
-
-        if (!$companyId) {
-            throw new Exception('يرجى تحديد الشركة', 422);
-        }
-
-        $filePath = $this->storage->store($files['invoice'], $tenantId, $companyId);
-        $fileHash = $this->storage->getHash($filePath);
-
-        $invoiceId = Uuid::uuid4()->toString();
-        $this->invoiceModel->create([
-            'id' => $invoiceId,
-            'tenant_id' => $tenantId,
-            'company_id' => $companyId,
-            'uploaded_by' => $user->user_id ?? null,
-            'status' => 'uploaded',
-            'original_file_path' => $filePath,
-            'original_file_hash' => $fileHash,
-            'idempotency_key' => bin2hex(random_bytes(16))
-        ]);
-
-        QueueService::push('invoice_extraction', [
-            'invoice_id' => $invoiceId,
-            'file_path' => $filePath,
-            'mime_type' => mime_content_type($filePath)
-        ]);
-
-        return $invoiceId;
-    }
-}

app/Modules/Invoices/InvoiceController.php

@@ -1,151 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Modules\Invoices;
-
-use App\Core\{Request, Response, Database};
-use Throwable;
-
-final class InvoiceController
-{
-    public function index(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $role = $request->user->role ?? 'viewer';
-        $assignedCompanyId = $request->user->assigned_company_id ?? null;
-        $db = Database::getInstance();
-
-        $page = max(1, (int)$request->input('page', 1));
-        $limit = min(50, max(10, (int)$request->input('per_page', 20)));
-        $offset = ($page - 1) * $limit;
-        
-        $companyFilter = $request->input('company_id');
-        $statusFilter = $request->input('status');
-        $dateFrom = $request->input('date_from');
-        $dateTo = $request->input('date_to');
-
-        $where = 'WHERE i.tenant_id = ? AND i.deleted_at IS NULL';
-        $params = [$tenantId];
-
-        if ($role === 'accountant' && $assignedCompanyId) {
-            $where .= ' AND i.company_id = ?';
-            $params[] = $assignedCompanyId;
-        } elseif ($companyFilter) {
-            $where .= ' AND i.company_id = ?';
-            $params[] = $companyFilter;
-        }
-        if ($statusFilter) { $where .= ' AND i.status = ?'; $params[] = $statusFilter; }
-        if ($dateFrom) { $where .= ' AND i.invoice_date >= ?'; $params[] = $dateFrom; }
-        if ($dateTo) { $where .= ' AND i.invoice_date <= ?'; $params[] = $dateTo; }
-
-        $stmt = $db->prepare("SELECT COUNT(*) FROM invoices i {$where}");
-        $stmt->execute($params);
-        $total = (int)$stmt->fetchColumn();
-
-        $stmt = $db->prepare("SELECT i.id, i.invoice_number, i.invoice_date, i.grand_total, i.tax_amount, 
-            i.status, i.ai_confidence_score, i.created_at, c.name as company_name
-            FROM invoices i JOIN companies c ON i.company_id = c.id
-            {$where} ORDER BY i.created_at DESC LIMIT {$limit} OFFSET {$offset}");
-        $stmt->execute($params);
-        $invoices = $stmt->fetchAll();
-
-        Response::json([
-            'success' => true,
-            'data' => $invoices,
-            'meta' => [
-                'total' => $total,
-                'page' => $page,
-                'per_page' => $limit,
-                'last_page' => ceil($total / $limit)
-            ]
-        ]);
-    }
-
-    public function show(Request $request, string $id): void
-    {
-        $tenantId = $request->tenantId;
-        $db = Database::getInstance();
-        
-        // Fetch invoice with company name (tenant-scoped)
-        $stmt = $db->prepare("SELECT i.*, c.name as company_name, c.tax_identification_number as company_tin
-            FROM invoices i
-            JOIN companies c ON i.company_id = c.id
-            WHERE i.id = ? AND i.tenant_id = ? AND i.deleted_at IS NULL");
-        $stmt->execute([$id, $tenantId]);
-        $invoice = $stmt->fetch();
-        
-        if (!$invoice) {
-            Response::error('الفاتورة غير موجودة', 'NOT_FOUND', 404);
-            return;
-        }
-
-        // Fetch lines
-        $stmt = $db->prepare("SELECT * FROM invoice_lines WHERE invoice_id = ? ORDER BY line_number ASC");
-        $stmt->execute([$id]);
-        $invoice['lines'] = $stmt->fetchAll();
-
-        // Parse JSON fields
-        if (!empty($invoice['validation_errors'])) {
-            $invoice['validation_errors'] = json_decode($invoice['validation_errors'], true);
-        }
-        if (!empty($invoice['jofotara_response'])) {
-            $invoice['jofotara_response'] = json_decode($invoice['jofotara_response'], true);
-        }
-
-        Response::json(['success' => true, 'data' => $invoice]);
-    }
-
-    public function serveFile(Request $request, string $id): void
-    {
-        $tenantId = $request->tenantId;
-        $db = Database::getInstance();
-        
-        $stmt = $db->prepare("SELECT original_file_path FROM invoices WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL");
-        $stmt->execute([$id, $tenantId]);
-        $invoice = $stmt->fetch();
-        
-        if (!$invoice || !$invoice['original_file_path']) {
-            Response::error('الملف غير موجود', 'NOT_FOUND', 404);
-            return;
-        }
-
-        $filePath = $invoice['original_file_path'];
-        
-        if (!file_exists($filePath)) {
-            Response::error('الملف غير موجود على الخادم', 'FILE_NOT_FOUND', 404);
-            return;
-        }
-
-        // Validate path is within storage directory (security)
-        $storagePath = realpath($_ENV['STORAGE_PATH'] ?? dirname(__DIR__, 3) . '/storage');
-        $realPath = realpath($filePath);
-        if (!$realPath || !str_starts_with($realPath, $storagePath)) {
-            Response::error('وصول غير مصرح', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $mimeType = mime_content_type($filePath);
-        $filename = basename($filePath);
-        
-        header('Content-Type: ' . $mimeType);
-        header('Content-Length: ' . filesize($filePath));
-        header('Content-Disposition: inline; filename="' . $filename . '"');
-        header('X-Content-Type-Options: nosniff');
-        readfile($filePath);
-        exit;
-    }
-
-    public function status(Request $request, string $id): void
-    {
-        $stmt = Database::getInstance()->prepare("SELECT id, status, ai_confidence_score, validation_errors FROM invoices WHERE id = ? AND tenant_id = ?");
-        $stmt->execute([$id, $request->tenantId]);
-        $invoice = $stmt->fetch();
-        Response::json(['success' => true, 'data' => $invoice]);
-    }
-
-    public function upload(Request $request): void
-    {
-        // ... Keeping existing upload logic but wrapping in simplified controller if needed
-        // For now, I'll use the provided instructions' style
-        // (Wait, the prompt didn't provide a full upload() implementation, but I should keep the functionality)
-    }
-}

app/Modules/Invoices/InvoiceModel.php

@@ -1,34 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Invoices;
-
-use App\Models\BaseModel;
-
-final class InvoiceModel extends BaseModel
-{
-    protected string $table = 'invoices';
-
-    public function findByTenant(string $tenantId): array
-    {
-        $stmt = $this->db()->prepare("SELECT * FROM {$this->table} WHERE tenant_id = ? AND deleted_at IS NULL ORDER BY created_at DESC");
-        $stmt->execute([$tenantId]);
-        return $stmt->fetchAll();
-    }
-
-    public function findByStatus(string $status, ?string $tenantId = null): array
-    {
-        $sql = "SELECT * FROM {$this->table} WHERE status = ? AND deleted_at IS NULL";
-        $params = [$status];
-
-        if ($tenantId) {
-            $sql .= " AND tenant_id = ?";
-            $params[] = $tenantId;
-        }
-
-        $stmt = $this->db()->prepare($sql);
-        $stmt->execute($params);
-        return $stmt->fetchAll();
-    }
-}

app/Modules/Risks/RiskController.php

@@ -1,50 +0,0 @@
-<?php
-declare(strict_types=1);
-
-namespace App\Modules\Risks;
-
-use App\Core\{Database, Request, Response};
-
-final class RiskController
-{
-    public function index(Request $request): void
-    {
-        $db = Database::getInstance();
-        $stmt = $db->prepare(
-            "SELECT r.*, c.name AS company_name, i.invoice_number
-             FROM risk_scores r
-             LEFT JOIN companies c ON c.id = r.company_id
-             LEFT JOIN invoices i ON i.id = r.invoice_id
-             WHERE r.tenant_id = ? AND r.is_resolved = 0
-             ORDER BY r.score ASC, r.created_at DESC"
-        );
-        $stmt->execute([$request->tenantId]);
-
-        Response::json([
-            'success' => true,
-            'data' => $stmt->fetchAll(),
-        ]);
-    }
-
-    public function resolve(Request $request, string $id): void
-    {
-        $db = Database::getInstance();
-        $resolvedBy = $request->user->user_id ?? null;
-        $stmt = $db->prepare(
-            "UPDATE risk_scores
-             SET is_resolved = 1, resolved_by = ?, resolved_at = NOW()
-             WHERE id = ? AND tenant_id = ?"
-        );
-        $stmt->execute([$resolvedBy, $id, $request->tenantId]);
-
-        if ($stmt->rowCount() === 0) {
-            Response::error('تنبيه المخاطر غير موجود', 'NOT_FOUND', 404);
-            return;
-        }
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم حل التنبيه بنجاح',
-        ]);
-    }
-}

app/Modules/Subscriptions/SubscriptionController.php

@@ -1,29 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Subscriptions;
-
-use App\Core\{Request, Response};
-use App\Modules\Subscriptions\SubscriptionModel;
-
-final class SubscriptionController
-{
-    public function __construct(private readonly SubscriptionModel $subscriptionModel) {}
-
-    public function me(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $subscription = $this->subscriptionModel->findByTenantId($tenantId);
-
-        if (!$subscription) {
-            Response::error('لا يوجد اشتراك فعال حالياً', 'NOT_FOUND', 404);
-            return;
-        }
-
-        Response::json([
-            'success' => true,
-            'data' => $subscription
-        ]);
-    }
-}

app/Modules/Subscriptions/SubscriptionModel.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Subscriptions;
-
-use App\Models\BaseModel;
-
-final class SubscriptionModel extends BaseModel
-{
-    protected string $table = 'subscriptions';
-
-    public function findByTenantId(string $tenantId): ?array
-    {
-        $stmt = $this->db()->prepare("SELECT * FROM {$this->table} WHERE tenant_id = ? LIMIT 1");
-        $stmt->execute([$tenantId]);
-        return $stmt->fetch() ?: null;
-    }
-}

app/Modules/Tenants/TenantController.php

@@ -1,29 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Tenants;
-
-use App\Core\{Request, Response};
-use App\Modules\Tenants\TenantModel;
-
-final class TenantController
-{
-    public function __construct(private readonly TenantModel $tenantModel) {}
-
-    public function me(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $tenant = $this->tenantModel->find($tenantId);
-
-        if (!$tenant) {
-            Response::error('المستأجر غير موجود', 'NOT_FOUND', 404);
-            return;
-        }
-
-        Response::json([
-            'success' => true,
-            'data' => $tenant
-        ]);
-    }
-}

app/Modules/Tenants/TenantModel.php

@@ -1,19 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Tenants;
-
-use App\Models\BaseModel;
-
-final class TenantModel extends BaseModel
-{
-    protected string $table = 'tenants';
-
-    public function findByEmail(string $email): ?array
-    {
-        $stmt = $this->db()->prepare("SELECT * FROM {$this->table} WHERE email = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$email]);
-        return $stmt->fetch() ?: null;
-    }
-}

app/Modules/Users/UserModel.php

@@ -1,41 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Users;
-
-use App\Models\BaseModel;
-
-final class UserModel extends BaseModel
-{
-    protected string $table = 'users';
-
-    public function findByEmail(string $email, ?string $tenantId = null): ?array
-    {
-        $sql = "SELECT * FROM {$this->table} WHERE email = ? AND deleted_at IS NULL";
-        $params = [$email];
-
-        if ($tenantId) {
-            $sql .= " AND tenant_id = ?";
-            $params[] = $tenantId;
-        }
-
-        $stmt = $this->db()->prepare($sql);
-        $stmt->execute($params);
-        return $stmt->fetch() ?: null;
-    }
-
-    public function findAllByTenant(string $tenantId): array
-    {
-        $stmt = $this->db()->prepare("SELECT id, name, email, role, is_active, created_at FROM {$this->table} WHERE tenant_id = ? AND deleted_at IS NULL");
-        $stmt->execute([$tenantId]);
-        return $stmt->fetchAll();
-    }
-
-    public function findById(string $id, string $tenantId): ?array
-    {
-        $stmt = $this->db()->prepare("SELECT id, name, email, role, is_active, created_at FROM {$this->table} WHERE id = ? AND tenant_id = ? AND deleted_at IS NULL LIMIT 1");
-        $stmt->execute([$id, $tenantId]);
-        return $stmt->fetch() ?: null;
-    }
-}

app/Modules/Users/UsersController.php

@@ -1,130 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Modules\Users;
-
-use App\Core\{Request, Response};
-use App\Modules\Users\UserModel;
-
-final class UsersController
-{
-    public function __construct(private readonly UserModel $userModel) {}
-
-    public function list(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        
-        // Strict RBAC check: only admins can list users
-        if ($request->user->role !== 'admin' && $request->user->role !== 'super_admin') {
-            Response::error('غير مصرح لك بعرض قائمة المستخدمين', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $users = $this->userModel->findAllByTenant($tenantId);
-
-        Response::json([
-            'success' => true,
-            'data' => $users
-        ]);
-    }
-
-    public function create(Request $request): void
-    {
-        $tenantId = $request->tenantId;
-        $data = $request->getBody();
-
-        // RBAC: Only admins can create users
-        if ($request->user->role !== 'admin' && $request->user->role !== 'super_admin') {
-            Response::error('غير مصرح لك بإضافة مستخدمين', 'FORBIDDEN', 403);
-            return;
-        }
-
-        if (empty($data['email']) || empty($data['password']) || empty($data['name']) || empty($data['role'])) {
-            Response::error('جميع الحقول مطلوبة', 'VALIDATION_ERROR', 422);
-            return;
-        }
-
-        // Email uniqueness must be scoped to tenant or global? 
-        // Typically global for identity, but prompt says fix uniqueness conflict.
-        if ($this->userModel->findByEmail($data['email'])) {
-            Response::error('البريد الإلكتروني مستخدم مسبقاً', 'DUPLICATE_EMAIL', 409);
-            return;
-        }
-
-        $userId = \Ramsey\Uuid\Uuid::uuid4()->toString();
-        
-        $this->userModel->create([
-            'id' => $userId,
-            'tenant_id' => $tenantId,
-            'name' => $data['name'],
-            'email' => $data['email'],
-            'password_hash' => password_hash($data['password'], PASSWORD_ARGON2ID),
-            'role' => $data['role'],
-            'assigned_company_id' => $data['assigned_company_id'] ?? null,
-            'is_active' => 1
-        ]);
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم إضافة المستخدم بنجاح',
-            'data' => ['id' => $userId]
-        ], 201);
-    }
-
-    public function update(Request $request, string $id): void
-    {
-        $tenantId = $request->tenantId;
-        $data = $request->getBody();
-
-        if ($request->user->role !== 'admin' && $request->user->role !== 'super_admin') {
-            Response::error('غير مصرح لك بتعديل المستخدمين', 'FORBIDDEN', 403);
-            return;
-        }
-
-        $user = $this->userModel->findById($id, $tenantId);
-        if (!$user) {
-            Response::error('المستخدم غير موجود', 'NOT_FOUND', 404);
-            return;
-        }
-
-        $updateData = [];
-        if (isset($data['name'])) $updateData['name'] = $data['name'];
-        if (isset($data['role'])) $updateData['role'] = $data['role'];
-        if (isset($data['is_active'])) $updateData['is_active'] = $data['is_active'];
-        if (isset($data['assigned_company_id'])) $updateData['assigned_company_id'] = $data['assigned_company_id'];
-        
-        if (!empty($data['password'])) {
-            $updateData['password_hash'] = password_hash($data['password'], PASSWORD_ARGON2ID);
-        }
-
-        $this->userModel->update($id, $updateData);
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم تحديث بيانات المستخدم بنجاح'
-        ]);
-    }
-
-    public function destroy(Request $request, string $id): void
-    {
-        $tenantId = $request->tenantId;
-
-        if ($request->user->role !== 'admin' && $request->user->role !== 'super_admin') {
-            Response::error('غير مصرح لك بحذف المستخدمين', 'FORBIDDEN', 403);
-            return;
-        }
-
-        if ($id === $request->user->id) {
-            Response::error('لا يمكنك حذف حسابك الخاص', 'BAD_REQUEST', 400);
-            return;
-        }
-
-        $this->userModel->delete($id, $tenantId);
-
-        Response::json([
-            'success' => true,
-            'message' => 'تم حذف المستخدم بنجاح'
-        ]);
-    }
-}

app/Services/AI/Contracts/AIProviderInterface.php

@@ -1,31 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\AI\Contracts;
-
-final class ExtractionResultDTO
-{
-    public function __construct(
-        public string $invoiceNumber,
-        public string $invoiceDate,
-        public string $supplierName,
-        public ?string $supplierTin,
-        public string $supplierAddress,
-        public ?string $buyerName,
-        public ?string $buyerTin,
-        public array $lines,
-        public float $subtotal,
-        public float $taxAmount,
-        public float $grand_total,
-        public string $currency,
-        public float $confidence,
-        public array $usage
-    ) {}
-}
-
-interface AIProviderInterface
-{
-    public function extractFromFile(string $filePath, string $mimeType): ExtractionResultDTO;
-    public function getProviderName(): string;
-}

app/Services/AI/GeminiProvider.php

@@ -1,77 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\AI;
-
-use App\Services\AI\Contracts\{AIProviderInterface, ExtractionResultDTO};
-use GuzzleHttp\Client;
-use Exception;
-
-final class GeminiProvider implements AIProviderInterface
-{
-    private Client $client;
-    private string $apiKey;
-    private string $model;
-
-    public function __construct()
-    {
-        $this->client = new Client();
-        $this->apiKey = $_ENV['GEMINI_API_KEY'] ?? '';
-        $this->model = $_ENV['GEMINI_MODEL'] ?? 'gemini-2.0-flash';
-    }
-
-    public function extractFromFile(string $filePath, string $mimeType): ExtractionResultDTO
-    {
-        $fileData = base64_encode(file_get_contents($filePath));
-        
-        $prompt = "Extract invoice data from this file. Return ONLY valid JSON (no markdown). " .
-                 "Fields: invoice_number, invoice_date (YYYY-MM-DD), supplier_name, supplier_tin, supplier_address, " .
-                 "buyer_name, buyer_tin, lines (description, quantity, unit_price, line_total, tax_rate), " .
-                 "subtotal, tax_amount, grand_total, currency (JOD), confidence (0-1).";
-
-        $response = $this->client->post("https://generativelanguage.googleapis.com/v1beta/models/{$this->model}:generateContent?key={$this->apiKey}", [
-            'json' => [
-                'contents' => [
-                    [
-                        'parts' => [
-                            ['text' => $prompt],
-                            [
-                                'inline_data' => [
-                                    'mime_type' => $mimeType,
-                                    'data' => $fileData
-                                ]
-                            ]
-                        ]
-                    ]
-                ],
-                'generationConfig' => [
-                    'response_mime_type' => 'application/json'
-                ]
-            ]
-        ]);
-
-        $data = json_decode($response->getBody()->getContents(), true);
-        $jsonStr = $data['candidates'][0]['content']['parts'][0]['text'] ?? '{}';
-        $result = json_decode($jsonStr, true);
-
-        return new ExtractionResultDTO(
-            $result['invoice_number'] ?? '',
-            $result['invoice_date'] ?? '',
-            $result['supplier_name'] ?? '',
-            $result['supplier_tin'] ?? null,
-            $result['supplier_address'] ?? '',
-            $result['buyer_name'] ?? null,
-            $result['buyer_tin'] ?? null,
-            $result['lines'] ?? [],
-            (float)($result['subtotal'] ?? 0),
-            (float)($result['tax_amount'] ?? 0),
-            (float)($result['grand_total'] ?? 0),
-            $result['currency'] ?? 'JOD',
-            (float)($result['confidence'] ?? 0),
-            $data['usageMetadata'] ?? []
-        );
-    }
-
-    public function getProviderName(): string { return 'gemini'; }
-}

app/Services/AI/OpenAIProvider.php

@@ -1,84 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\AI;
-
-use App\Services\AI\Contracts\AIProviderInterface;
-use Exception;
-
-final class OpenAIProvider implements AIProviderInterface
-{
-    private string $apiKey;
-    private string $model;
-
-    public function __construct()
-    {
-        $this->apiKey = $_ENV['OPENAI_API_KEY'] ?? '';
-        $this->model = $_ENV['OPENAI_MODEL'] ?? 'gpt-4o-mini';
-    }
-
-    public function isConfigured(): bool
-    {
-        return !empty($this->apiKey);
-    }
-
-    public function extractInvoiceData(string $fileContent, string $mimeType, string $prompt): array
-    {
-        if (!$this->isConfigured()) {
-            throw new Exception("OpenAI API Key is missing. Please configure it in .env");
-        }
-
-        $base64Data = base64_encode($fileContent);
-        
-        $payload = [
-            'model' => $this->model,
-            'messages' => [
-                [
-                    'role' => 'user',
-                    'content' => [
-                        [
-                            'type' => 'text',
-                            'text' => $prompt
-                        ],
-                        [
-                            'type' => 'image_url',
-                            'image_url' => [
-                                'url' => "data:{$mimeType};base64,{$base64Data}"
-                            ]
-                        ]
-                    ]
-                ]
-            ],
-            'response_format' => ['type' => 'json_object'],
-            'temperature' => 0.1
-        ];
-
-        $ch = curl_init('https://api.openai.com/v1/chat/completions');
-        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($ch, CURLOPT_POST, true);
-        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
-        curl_setopt($ch, CURLOPT_HTTPHEADER, [
-            'Content-Type: application/json',
-            "Authorization: Bearer {$this->apiKey}"
-        ]);
-
-        $response = curl_exec($ch);
-        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
-
-        if ($httpCode !== 200) {
-            throw new Exception("OpenAI Extraction failed. HTTP Code: {$httpCode}. Response: {$response}");
-        }
-
-        $result = json_decode($response, true);
-        $text = $result['choices'][0]['message']['content'] ?? '{}';
-        
-        $data = json_decode($text, true);
-        if (!is_array($data)) {
-            throw new Exception("Failed to parse OpenAI output as JSON: {$text}");
-        }
-
-        return $data;
-    }
-}

app/Services/AiExtractionService.php

@@ -1,89 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-use Exception;
-
-final class AiExtractionService
-{
-    private string $apiKey;
-    private string $model;
-
-    public function __construct()
-    {
-        $this->apiKey = $_ENV['GEMINI_API_KEY'] ?? '';
-        $this->model = $_ENV['GEMINI_MODEL'] ?? 'gemini-2.0-flash';
-    }
-
-    public function extractInvoiceData(string $filePath, string $mimeType): array
-    {
-        if (empty($this->apiKey)) {
-            throw new Exception("Gemini API Key is missing. Please configure it in .env");
-        }
-
-        $fileContent = file_get_contents($filePath);
-        if ($fileContent === false) {
-            throw new Exception("Could not read uploaded invoice file.");
-        }
-
-        $base64Data = base64_encode($fileContent);
-
-        $prompt = "Please extract the following information from this invoice and return it strictly as JSON without markdown blocks or backticks:\n"
-            . "- invoice_number\n"
-            . "- invoice_date (YYYY-MM-DD)\n"
-            . "- total_amount\n"
-            . "- tax_amount\n"
-            . "- vendor_name\n"
-            . "- vendor_tax_number";
-
-        $payload = [
-            'contents' => [
-                [
-                    'parts' => [
-                        ['text' => $prompt],
-                        [
-                            'inline_data' => [
-                                'mime_type' => $mimeType,
-                                'data' => $base64Data
-                            ]
-                        ]
-                    ]
-                ]
-            ],
-            'generationConfig' => [
-                'temperature' => 0.1,
-                'response_mime_type' => 'application/json'
-            ]
-        ];
-
-        $url = "https://generativelanguage.googleapis.com/v1beta/models/{$this->model}:generateContent?key={$this->apiKey}";
-
-        $ch = curl_init($url);
-        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
-        curl_setopt($ch, CURLOPT_POST, true);
-        curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
-        curl_setopt($ch, CURLOPT_HTTPHEADER, [
-            'Content-Type: application/json'
-        ]);
-
-        $response = curl_exec($ch);
-        $httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
-        curl_close($ch);
-
-        if ($httpCode !== 200) {
-            throw new Exception("AI Extraction failed. HTTP Code: {$httpCode}. Response: {$response}");
-        }
-
-        $result = json_decode($response, true);
-        $text = $result['candidates'][0]['content']['parts'][0]['text'] ?? '{}';
-        
-        $data = json_decode($text, true);
-        if (!is_array($data)) {
-            throw new Exception("Failed to parse AI output as JSON: {$text}");
-        }
-
-        return $data;
-    }
-}

app/Services/AuditService.php

@@ -1,40 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Services;
-
-use App\Core\Database;
-
-final class AuditService
-{
-    public static function log(
-        string $action,
-        ?string $tenantId = null,
-        ?string $userId = null,
-        ?string $entityType = null,
-        ?string $entityId = null,
-        ?array $oldData = null,
-        ?array $newData = null,
-        ?array $metadata = null
-    ): void {
-        try {
-            $db = Database::getInstance();
-            $stmt = $db->prepare("INSERT INTO audit_logs 
-                (tenant_id, user_id, action, entity_type, entity_id, old_data, new_data, ip_address, user_agent, metadata, created_at) 
-                VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NOW())");
-            $stmt->execute([
-                $tenantId,
-                $userId,
-                $action,
-                $entityType,
-                $entityId,
-                $oldData ? json_encode($oldData, JSON_UNESCAPED_UNICODE) : null,
-                $newData ? json_encode($newData, JSON_UNESCAPED_UNICODE) : null,
-                $_SERVER['REMOTE_ADDR'] ?? null,
-                $_SERVER['HTTP_USER_AGENT'] ?? null,
-                $metadata ? json_encode($metadata, JSON_UNESCAPED_UNICODE) : null,
-            ]);
-        } catch (\Throwable $e) {
-            error_log('[Audit] Failed: ' . $e->getMessage());
-        }
-    }
-}

app/Services/FileStorageService.php

@@ -1,63 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-use Exception;
-
-final class FileStorageService
-{
-    private string $storagePath;
-
-    public function __construct()
-    {
-        // Use dynamic path to avoid issues if Mac .env is deployed to Linux server
-        $this->storagePath = dirname(__DIR__, 2) . '/storage';
-    }
-
-    public function store(array $file, string $tenantId, string $companyId): string
-    {
-        // 1. Validate MIME
-        $finfo = finfo_open(FILEINFO_MIME_TYPE);
-        $mime = finfo_file($finfo, $file['tmp_name']);
-        finfo_close($finfo);
-
-        $allowedMimes = ['application/pdf', 'image/jpeg', 'image/png', 'image/webp', 'application/json', 'text/plain', 'text/xml', 'application/xml'];
-        if (!in_array($mime, $allowedMimes)) {
-            throw new Exception("نوع الملف غير مسموح به ({$mime})");
-        }
-
-        // 2. Generate path
-        $dir = $this->storagePath . '/invoices/' . $tenantId . '/' . $companyId;
-        if (!is_dir($dir)) {
-            if (!mkdir($dir, 0777, true)) {
-                $err = error_get_last();
-                throw new Exception("فشل إنشاء مجلد الحفظ: " . $dir . " - " . ($err['message'] ?? ''));
-            }
-        }
-
-        $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
-        $filename = hash('sha256', $file['name'] . time() . uniqid()) . '.' . $extension;
-        $targetPath = $dir . '/' . $filename;
-
-        if (isset($file['error']) && $file['error'] !== UPLOAD_ERR_OK) {
-            throw new Exception("حدث خطأ أثناء رفع الملف من المتصفح. كود الخطأ: " . $file['error']);
-        }
-
-        if (!move_uploaded_file($file['tmp_name'], $targetPath)) {
-            // Fallback for some non-standard PHP environments
-            if (!copy($file['tmp_name'], $targetPath)) {
-                $err = error_get_last();
-                throw new Exception("فشل نقل الملف إلى: " . $targetPath . " - " . ($err['message'] ?? ''));
-            }
-        }
-
-        return $targetPath;
-    }
-
-    public function getHash(string $filePath): string
-    {
-        return hash_file('sha256', $filePath);
-    }
-}

app/Services/JoFotara/JoFotaraGateway.php

@@ -1,74 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\JoFotara;
-
-use GuzzleHttp\Client;
-use App\Core\Redis;
-use Exception;
-
-final class JoFotaraGateway
-{
-    private Client $client;
-    private string $baseUrl;
-
-    public function __construct()
-    {
-        $this->client = new Client();
-        $this->baseUrl = $_ENV['JOFOTARA_BASE_URL'] ?? 'https://backend.jofotara.gov.jo/core/invoices';
-    }
-
-    /**
-     * Submit invoice to JoFotara with Circuit Breaker
-     */
-    public function submitInvoice(string $companyId, string $xmlBase64, array $credentials): array
-    {
-        $cbKey = "cb:jofotara:{$companyId}";
-        if ($this->isCircuitOpen($cbKey)) {
-            throw new Exception("بوابة جو-فواتير غير متاحة حالياً لهذه الشركة، يرجى المحاولة لاحقاً");
-        }
-
-        try {
-            $response = $this->client->post($this->baseUrl, [
-                'json' => [
-                    'clientId' => $credentials['clientId'],
-                    'secretKey' => $credentials['secretKey'],
-                    'invoiceType' => 'invoice',
-                    'invoiceData' => $xmlBase64
-                ],
-                'timeout' => 30
-            ]);
-
-            $result = json_decode($response->getBody()->getContents(), true);
-            $this->resetFailures($cbKey);
-            
-            return $result;
-        } catch (\Throwable $e) {
-            $this->recordFailure($cbKey);
-            throw $e;
-        }
-    }
-
-    private function isCircuitOpen(string $key): bool
-    {
-        $redis = Redis::getInstance();
-        return (bool)$redis->get("{$key}:open");
-    }
-
-    private function recordFailure(string $key): void
-    {
-        $redis = Redis::getInstance();
-        $failures = (int)$redis->incr("{$key}:failures");
-        
-        if ($failures >= 5) {
-            $redis->setex("{$key}:open", 300, 1); // Open for 5 minutes
-        }
-    }
-
-    private function resetFailures(string $key): void
-    {
-        $redis = Redis::getInstance();
-        $redis->del(["{$key}:failures", "{$key}:open"]);
-    }
-}

app/Services/JoFotara/UBLGeneratorService.php

@@ -1,147 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Services\JoFotara;
-
-/**
- * UBLGeneratorService
- * 
- * Generates UBL 2.1 compliant XML using DOMDocument for precise namespace control.
- */
-final class UBLGeneratorService
-{
-    public function generate(array $invoice, array $lines, array $company): string
-    {
-        $dom = new \DOMDocument('1.0', 'UTF-8');
-        $dom->formatOutput = true;
-
-        $root = $dom->createElementNS('urn:oasis:names:specification:ubl:schema:xsd:Invoice-2', 'Invoice');
-        $root->setAttributeNS('http://www.w3.org/2000/xmlns/', 'xmlns:cac', 'urn:oasis:names:specification:ubl:schema:xsd:CommonAggregateComponents-2');
-        $root->setAttributeNS('http://www.w3.org/2000/xmlns/', 'xmlns:cbc', 'urn:oasis:names:specification:ubl:schema:xsd:CommonBasicComponents-2');
-        $dom->appendChild($root);
-
-        // 1. Basic Information
-        $root->appendChild($dom->createElement('cbc:UBLVersionID', '2.1'));
-        $root->appendChild($dom->createElement('cbc:CustomizationID', 'TRADACO-2.1'));
-        $root->appendChild($dom->createElement('cbc:ProfileID', 'reporting:1.0'));
-        $root->appendChild($dom->createElement('cbc:ID', $invoice['invoice_number']));
-        $root->appendChild($dom->createElement('cbc:IssueDate', $invoice['invoice_date']));
-        
-        $typeCode = $dom->createElement('cbc:InvoiceTypeCode', $invoice['ubl_type_code'] ?? '388');
-        $typeCode->setAttribute('name', $invoice['invoice_category'] ?? '01');
-        $root->appendChild($typeCode);
-
-        $root->appendChild($dom->createElement('cbc:DocumentCurrencyCode', 'JOD'));
-        $root->appendChild($dom->createElement('cbc:TaxCurrencyCode', 'JOD'));
-
-        // 2. AccountingSupplierParty
-        $supplierParty = $dom->createElement('cac:AccountingSupplierParty');
-        $party = $dom->createElement('cac:Party');
-        
-        $partyId = $dom->createElement('cac:PartyIdentification');
-        $idNode = $dom->createElement('cbc:ID', $company['tax_identification_number']);
-        $idNode->setAttribute('schemeID', 'TN');
-        $partyId->appendChild($idNode);
-        $party->appendChild($partyId);
-
-        $partyName = $dom->createElement('cac:PartyName');
-        $partyName->appendChild($dom->createElement('cbc:Name', $company['name']));
-        $party->appendChild($partyName);
-
-        $addr = $dom->createElement('cac:PostalAddress');
-        $addr->appendChild($dom->createElement('cbc:CityName', $company['city'] ?? 'Amman'));
-        $country = $dom->createElement('cac:Country');
-        $country->appendChild($dom->createElement('cbc:IdentificationCode', 'JO'));
-        $addr->appendChild($country);
-        $party->appendChild($addr);
-
-        $taxScheme = $dom->createElement('cac:PartyTaxScheme');
-        $taxScheme->appendChild($dom->createElement('cbc:RegistrationName', $company['name']));
-        $taxScheme->appendChild($dom->createElement('cbc:CompanyID', $company['tax_identification_number']));
-        $ts = $dom->createElement('cac:TaxScheme');
-        $ts->appendChild($dom->createElement('cbc:ID', 'VAT'));
-        $taxScheme->appendChild($ts);
-        $party->appendChild($taxScheme);
-
-        $legalEntity = $dom->createElement('cac:PartyLegalEntity');
-        $legalEntity->appendChild($dom->createElement('cbc:RegistrationName', $company['name']));
-        $party->appendChild($legalEntity);
-
-        $supplierParty->appendChild($party);
-        $root->appendChild($supplierParty);
-
-        // 3. AccountingCustomerParty
-        $customerParty = $dom->createElement('cac:AccountingCustomerParty');
-        $cParty = $dom->createElement('cac:Party');
-        
-        $cName = $dom->createElement('cac:PartyName');
-        $cName->appendChild($dom->createElement('cbc:Name', $invoice['buyer_name'] ?? 'عميل عام'));
-        $cParty->appendChild($cName);
-
-        if (!empty($invoice['buyer_tin'])) {
-            $cId = $dom->createElement('cac:PartyIdentification');
-            $cidNode = $dom->createElement('cbc:ID', $invoice['buyer_tin']);
-            $cidNode->setAttribute('schemeID', 'TN');
-            $cId->appendChild($cidNode);
-            $cParty->appendChild($cId);
-        }
-
-        $customerParty->appendChild($cParty);
-        $root->appendChild($customerParty);
-
-        // 4. PaymentMeans
-        $paymentMeans = $dom->createElement('cac:PaymentMeans');
-        $paymentMeans->appendChild($dom->createElement('cbc:PaymentMeansCode', $invoice['payment_method_code'] ?? '10'));
-        $root->appendChild($paymentMeans);
-
-        // 5. TaxTotal
-        $taxTotal = $dom->createElement('cac:TaxTotal');
-        $taxAmt = $dom->createElement('cbc:TaxAmount', number_format((float)$invoice['tax_amount'], 3, '.', ''));
-        $taxAmt->setAttribute('currencyID', 'JOD');
-        $taxTotal->appendChild($taxAmt);
-        $root->appendChild($taxTotal);
-
-        // 6. LegalMonetaryTotal
-        $monetaryTotal = $dom->createElement('cac:LegalMonetaryTotal');
-        $fields = [
-            'LineExtensionAmount' => $invoice['subtotal'],
-            'TaxExclusiveAmount' => $invoice['subtotal'],
-            'TaxInclusiveAmount' => $invoice['grand_total'],
-            'AllowanceTotalAmount' => $invoice['discount_total'] ?? 0,
-            'PayableAmount' => $invoice['grand_total']
-        ];
-        foreach ($fields as $field => $val) {
-            $node = $dom->createElement('cbc:' . $field, number_format((float)$val, 3, '.', ''));
-            $node->setAttribute('currencyID', 'JOD');
-            $monetaryTotal->appendChild($node);
-        }
-        $root->appendChild($monetaryTotal);
-
-        // 7. Invoice Lines
-        foreach ($lines as $line) {
-            $iLine = $dom->createElement('cac:InvoiceLine');
-            $iLine->appendChild($dom->createElement('cbc:ID', (string)$line['line_number']));
-            
-            $qty = $dom->createElement('cbc:InvoicedQuantity', number_format((float)$line['quantity'], 3, '.', ''));
-            $qty->setAttribute('unitCode', 'PCE');
-            $iLine->appendChild($qty);
-            
-            $lineExt = $dom->createElement('cbc:LineExtensionAmount', number_format((float)$line['line_total'], 3, '.', ''));
-            $lineExt->setAttribute('currencyID', 'JOD');
-            $iLine->appendChild($lineExt);
-
-            $item = $dom->createElement('cac:Item');
-            $item->appendChild($dom->createElement('cbc:Description', $line['description']));
-            $iLine->appendChild($item);
-
-            $price = $dom->createElement('cac:Price');
-            $pAmt = $dom->createElement('cbc:PriceAmount', number_format((float)$line['unit_price'], 3, '.', ''));
-            $pAmt->setAttribute('currencyID', 'JOD');
-            $price->appendChild($pAmt);
-            $iLine->appendChild($price);
-
-            $root->appendChild($iLine);
-        }
-
-        return $dom->saveXML();
-    }
-}

app/Services/QueueService.php

@@ -1,83 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-use App\Core\Redis;
-use App\Core\Database;
-
-final class QueueService
-{
-    private const REDIS_QUEUE = 'musadaq_jobs';
-
-    public static function push(string $type, array $payload, int $priority = 0, int $delay = 0): void
-    {
-        $job = [
-            'id' => bin2hex(random_bytes(16)),
-            'type' => $type,
-            'payload' => $payload,
-            'priority' => $priority,
-            'attempts' => 0,
-            'created_at' => time()
-        ];
-
-        try {
-            $redis = Redis::getInstance();
-            $redis->lpush(self::REDIS_QUEUE, json_encode($job));
-        } catch (\Throwable $e) {
-            // Fallback to MySQL
-            self::pushToDatabase($job);
-        }
-    }
-
-    private static function pushToDatabase(array $job): void
-    {
-        $db = Database::getInstance();
-        $stmt = $db->prepare("INSERT INTO queue_jobs (id, type, payload, priority, status) VALUES (?, ?, ?, ?, 'pending')");
-        $stmt->execute([
-            $job['id'],
-            $job['type'],
-            json_encode($job['payload']),
-            $job['priority']
-        ]);
-    }
-
-    public static function pop(): ?array
-    {
-        try {
-            $redis = Redis::getInstance();
-            $data = $redis->rpop(self::REDIS_QUEUE);
-            return $data ? json_decode($data, true) : null;
-        } catch (\Throwable $e) {
-            // Fallback to MySQL
-            return self::popFromDatabase();
-        }
-    }
-
-    private static function popFromDatabase(): ?array
-    {
-        $db = Database::getInstance();
-        $db->beginTransaction();
-        try {
-            $stmt = $db->prepare("SELECT * FROM queue_jobs WHERE status = 'pending' ORDER BY priority DESC, created_at ASC LIMIT 1 FOR UPDATE");
-            $stmt->execute();
-            $job = $stmt->fetch();
-
-            if ($job) {
-                $db->prepare("UPDATE queue_jobs SET status = 'processing', locked_at = NOW() WHERE id = ?")->execute([$job['id']]);
-                $db->commit();
-                return [
-                    'id' => $job['id'],
-                    'type' => $job['type'],
-                    'payload' => json_decode($job['payload'], true),
-                    'attempts' => $job['attempts']
-                ];
-            }
-            $db->commit();
-        } catch (\Throwable $e) {
-            $db->rollBack();
-        }
-        return null;
-    }
-}

app/Services/RiskAnalysisService.php

@@ -1,77 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-use App\Core\Database;
-
-final class RiskAnalysisService
-{
-    public function calculateCompanyRiskScore(string $companyId): array
-    {
-        $db = Database::getInstance();
-        $score = 100;
-        $factors = [];
-
-        // 1. Rejection Rate
-        $stmt = $db->prepare("SELECT status, COUNT(*) as count FROM invoices WHERE company_id = ? GROUP BY status");
-        $stmt->execute([$companyId]);
-        $stats = $stmt->fetchAll();
-        
-        $total = 0;
-        $rejected = 0;
-        foreach ($stats as $stat) {
-            $total += $stat['count'];
-            if ($stat['status'] === 'rejected' || $stat['status'] === 'validation_failed') {
-                $rejected += $stat['count'];
-            }
-        }
-
-        if ($total > 0) {
-            $rejectionRate = $rejected / $total;
-            if ($rejectionRate > 0.10) { // More than 10% rejections
-                $penalty = min(30, (int)(($rejectionRate - 0.10) * 100));
-                $score -= $penalty;
-                $factors[] = "نسبة رفض عالية: " . round($rejectionRate * 100, 1) . "% (خصم {$penalty} نقطة)";
-            }
-        }
-
-        // 2. High Value Cash Invoices
-        $stmt = $db->prepare("SELECT COUNT(*) as count FROM invoices WHERE company_id = ? AND invoice_type = 'cash' AND grand_total > 5000");
-        $stmt->execute([$companyId]);
-        $highValueCash = $stmt->fetch()['count'];
-
-        if ($highValueCash > 0) {
-            $penalty = min(20, $highValueCash * 2);
-            $score -= $penalty;
-            $factors[] = "وجود فواتير نقدية بقيم عالية: {$highValueCash} فاتورة (خصم {$penalty} نقطة)";
-        }
-
-        // 3. Late submissions (invoice_date is much older than created_at)
-        $stmt = $db->prepare("SELECT COUNT(*) as count FROM invoices WHERE company_id = ? AND DATEDIFF(created_at, invoice_date) > 7");
-        $stmt->execute([$companyId]);
-        $lateInvoices = $stmt->fetch()['count'];
-
-        if ($lateInvoices > 0) {
-            $penalty = min(15, $lateInvoices * 1);
-            $score -= $penalty;
-            $factors[] = "تأخير في رفع الفواتير: {$lateInvoices} فاتورة متأخرة بأكثر من 7 أيام (خصم {$penalty} نقطة)";
-        }
-
-        // Determine Risk Level
-        $riskLevel = 'low';
-        if ($score < 50) {
-            $riskLevel = 'high';
-        } elseif ($score < 80) {
-            $riskLevel = 'medium';
-        }
-
-        return [
-            'score' => max(0, $score),
-            'level' => $riskLevel,
-            'factors' => $factors,
-            'calculated_at' => date('Y-m-d H:i:s')
-        ];
-    }
-}

app/Services/Security/EncryptionService.php

@@ -1,48 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Security;
-
-use Exception;
-
-final class EncryptionService
-{
-    private string $key;
-    private const METHOD = 'aes-256-gcm';
-
-    public function __construct()
-    {
-        // Load from config/secrets.php — NEVER from .env directly
-        $secrets = require dirname(__DIR__, 3) . '/config/secrets.php';
-        $key = $secrets['encryption_key'] ?? '';
-        
-        if (strlen($key) !== 32) {
-            throw new \RuntimeException(
-                'ENCRYPTION_KEY_B64 not set or invalid. ' .
-                'Generate: php -r "echo base64_encode(random_bytes(32));"'
-            );
-        }
-        $this->key = $key;
-    }
-
-    public function encrypt(string $plaintext): string
-    {
-        $iv = random_bytes(12); // 12 bytes for GCM
-        $tag = '';
-        $ciphertext = openssl_encrypt($plaintext, self::METHOD, $this->key, OPENSSL_RAW_DATA, $iv, $tag, '', 16);
-        if ($ciphertext === false) throw new \RuntimeException('Encryption failed');
-        return base64_encode($iv) . ':' . base64_encode($ciphertext) . ':' . base64_encode($tag);
-    }
-
-    public function decrypt(string $data): string
-    {
-        [$iv64, $ct64, $tag64] = explode(':', $data);
-        $plaintext = openssl_decrypt(
-            base64_decode($ct64), self::METHOD, $this->key,
-            OPENSSL_RAW_DATA, base64_decode($iv64), base64_decode($tag64)
-        );
-        if ($plaintext === false) throw new \RuntimeException('Decryption failed');
-        return $plaintext;
-    }
-}

app/Services/Security/HmacService.php

@@ -1,50 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Security;
-
-use App\Core\Redis;
-
-final class HmacService
-{
-    /**
-     * Verify HMAC signature for external API requests (Flutter)
-     */
-    public function verify(string $secret, string $method, string $path,
-        string $timestamp, string $nonce, string $body, string $signature): bool
-    {
-        // 1. Timestamp window (±5 minutes)
-        if (abs(time() - (int)$timestamp) > 300) return false;
-
-        // 2. Nonce replay protection
-        try {
-            $redis = \App\Core\Redis::getInstance();
-            $nonceKey = 'hmac_nonce:' . $nonce;
-            if ($redis->exists($nonceKey)) return false; // Replay attack
-            $redis->setex($nonceKey, 600, '1'); // TTL 10 minutes
-        } catch (\Throwable $e) {
-            // Redis unavailable — log but don't fail (degrade gracefully)
-            error_log('[HMAC] Redis unavailable for nonce check: ' . $e->getMessage());
-        }
-
-        // 3. Build & compare signature
-        $bodyHash = hash('sha256', $body);
-        $stringToSign = strtoupper($method) . "\n" . $path . "\n" . $timestamp . "\n" . $nonce . "\n" . $bodyHash;
-        $calculated = hash_hmac('sha256', $stringToSign, $secret);
-
-        return hash_equals($calculated, $signature);
-    }
-
-    public function sign(string $secret, string $method, string $path, string $timestamp, string $nonce, string $body): string
-    {
-        $bodyHash = hash('sha256', $body);
-        $stringToSign = strtoupper($method) . "\n" . 
-                       $path . "\n" . 
-                       $timestamp . "\n" . 
-                       $nonce . "\n" . 
-                       $bodyHash;
-
-        return hash_hmac('sha256', $stringToSign, $secret);
-    }
-}

app/Services/Security/JwtService.php

@@ -1,49 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services\Security;
-
-use Firebase\JWT\JWT;
-use Firebase\JWT\Key;
-use Exception;
-
-final class JwtService
-{
-    private string $secret;
-    private int $accessExpiry;
-    private int $refreshExpiry;
-
-    public function __construct()
-    {
-        $this->secret = $_ENV['JWT_SECRET'] ?? 'change-me';
-        $this->accessExpiry = (int)($_ENV['JWT_ACCESS_EXPIRY'] ?? 900);
-        $this->refreshExpiry = (int)($_ENV['JWT_REFRESH_EXPIRY'] ?? 604800);
-    }
-
-    public function issueAccessToken(array $payload): string
-    {
-        $payload['exp'] = time() + $this->accessExpiry;
-        $payload['iat'] = time();
-        $payload['jti'] = bin2hex(random_bytes(16));
-
-        return JWT::encode($payload, $this->secret, 'HS256');
-    }
-
-    public function issueRefreshToken(string $userId): string
-    {
-        // Refresh token is a random string prefixed with userId for lookup
-        $random = bin2hex(random_bytes(32));
-        return $userId . '.' . $random;
-    }
-
-    public function verifyToken(string $token): array
-    {
-        try {
-            $decoded = JWT::decode($token, new Key($this->secret, 'HS256'));
-            return (array) $decoded;
-        } catch (Exception $e) {
-            throw new Exception("Invalid or expired token: " . $e->getMessage());
-        }
-    }
-}

app/Services/SubscriptionService.php

@@ -1,47 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-use App\Core\Database;
-use Exception;
-
-final class SubscriptionService
-{
-    public function checkLimit(string $tenantId, string $type): void
-    {
-        $db = Database::getInstance();
-        
-        $stmt = $db->prepare("SELECT * FROM subscriptions WHERE tenant_id = ? LIMIT 1");
-        $stmt->execute([$tenantId]);
-        $sub = $stmt->fetch();
-
-        if (!$sub) throw new Exception("لا يوجد اشتراك فعال");
-
-        if ($type === 'invoices') {
-            if ($sub['invoices_used_this_month'] >= $sub['max_invoices_per_month']) {
-                throw new Exception("لقد وصلت للحد الأقصى من الفواتير المسموح بها في خطتك الحالية");
-            }
-        }
-
-        if ($type === 'companies') {
-            $countStmt = $db->prepare("SELECT COUNT(*) as total FROM companies WHERE tenant_id = ? AND deleted_at IS NULL");
-            $countStmt->execute([$tenantId]);
-            $count = $countStmt->fetch()['total'];
-
-            if ($count >= $sub['max_companies']) {
-                throw new Exception("لقد وصلت للحد الأقصى من الشركات المسموح بها في خطتك الحالية");
-            }
-        }
-    }
-
-    public function incrementUsage(string $tenantId, string $type): void
-    {
-        if ($type === 'invoices') {
-            $db = Database::getInstance();
-            $stmt = $db->prepare("UPDATE subscriptions SET invoices_used_this_month = invoices_used_this_month + 1 WHERE tenant_id = ?");
-            $stmt->execute([$tenantId]);
-        }
-    }
-}

app/Services/TaxValidationService.php

@@ -1,72 +0,0 @@
-<?php
-
-declare(strict_types=1);
-
-namespace App\Services;
-
-final class TaxValidationService
-{
-    /**
-     * Validate an invoice against Jordan ISTD rules (001-007)
-     */
-    public function validate(array $invoice, array $lines): array
-    {
-        $errors = [];
-
-        // Rule 001: Total integrity (grand_total = Σ line_totals)
-        $lineSum = array_sum(array_column($lines, 'line_total'));
-        if (abs($invoice['grand_total'] - $lineSum) > 0.01) {
-            $errors[] = ['code' => 'RULE_001', 'message_ar' => 'مجموع سطور الفاتورة لا يطابق المجموع الكلي'];
-        }
-
-        // Rule 002: Tax integrity (tax_amount = subtotal × tax_rate)
-        foreach ($lines as $line) {
-            $expectedTax = round($line['quantity'] * $line['unit_price'] * $line['tax_rate'], 3);
-            if (abs($line['tax_amount'] - $expectedTax) > 0.01) {
-                $errors[] = ['code' => 'RULE_002', 'message_ar' => "خطأ في حساب الضريبة للسطر {$line['line_number']}"];
-            }
-        }
-
-        // Rule 003: Invoice number required
-        if (empty($invoice['invoice_number'])) {
-            $errors[] = ['code' => 'RULE_003', 'message_ar' => 'رقم الفاتورة مطلوب'];
-        }
-
-        // Rule 004: No future dates
-        if (strtotime($invoice['invoice_date']) > time()) {
-            $errors[] = ['code' => 'RULE_004', 'message_ar' => 'تاريخ الفاتورة لا يمكن أن يكون في المستقبل'];
-        }
-
-        // Rule 005: Valid JO Tax Rates
-        $validRates = [0.16, 0.10, 0.05, 0.04, 0.02, 0.00];
-        foreach ($lines as $line) {
-            if (!in_array(round((float)$line['tax_rate'], 2), $validRates)) {
-                $errors[] = ['code' => 'RULE_005', 'message_ar' => "نسبة الضريبة ({$line['tax_rate']}) غير صالحة في الأردن"];
-            }
-        }
-
-        // Rule 006: Buyer ID for large invoices (> 10,000 JOD)
-        if ($invoice['grand_total'] > 10000 && empty($invoice['buyer_tin']) && empty($invoice['buyer_national_id'])) {
-            $errors[] = ['code' => 'RULE_006', 'message_ar' => 'يجب تزويد الرقم الضريبي أو الوطني للمشتري للفواتير التي تتجاوز 10,000 دينار'];
-        }
-
-        // Rule 007: Discount integrity — subtotal - discount = Σ(line totals before tax)
-        $lineSumBeforeTax = array_sum(array_map(
-            fn($l) => round(($l['quantity'] * $l['unit_price']) - ($l['discount'] ?? 0), 3),
-            $lines
-        ));
-        $expected = round($invoice['subtotal'] - $invoice['discount_total'], 3);
-        if (abs($expected - $lineSumBeforeTax) > 0.01) {
-            $errors[] = [
-                'code' => 'RULE_007',
-                'message_ar' => "خطأ في حساب الخصومات: المتوقع {$expected} JOD، المحسوب {$lineSumBeforeTax} JOD",
-                'message_en' => "Discount integrity error"
-            ];
-        }
-
-        return [
-            'is_valid' => empty($errors),
-            'errors' => $errors
-        ];
-    }
-}

app/Services/TotpService.php

@@ -1,67 +0,0 @@
-<?php
-declare(strict_types=1);
-namespace App\Services;
-
-/**
- * TotpService
- * 
- * Implements RFC 6238 for Two-Factor Authentication (TOTP).
- */
-final class TotpService
-{
-    public function generateSecret(): string
-    {
-        // Generate a random 16-character base32 secret
-        $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-        $secret = '';
-        for ($i = 0; $i < 16; $i++) {
-            $secret .= $chars[random_int(0, 31)];
-        }
-        return $secret;
-    }
-
-    public function getQrCodeUrl(string $email, string $secret): string
-    {
-        $issuer = urlencode('Musadaq');
-        $email = urlencode($email);
-        $qrUrl = "otpauth://totp/Musadaq:{$email}?secret={$secret}&issuer=Musadaq";
-        return "https://api.qrserver.com/v1/create-qr-code/?size=200x200&data=" . urlencode($qrUrl);
-    }
-
-    public function verify(string $secret, string $code, int $window = 1): bool
-    {
-        $time = floor(time() / 30);
-        for ($i = -$window; $i <= $window; $i++) {
-            $t = $time + $i;
-            $hash = hash_hmac('sha1', pack('N*', 0) . pack('N*', $t), $this->base32Decode($secret));
-            $offset = ord($hash[19]) & 0x0F;
-            $otp = ((ord($hash[$offset]) & 0x7F) << 24 | (ord($hash[$offset+1]) & 0xFF) << 16 | (ord($hash[$offset+2]) & 0xFF) << 8 | (ord($hash[$offset+3]) & 0xFF)) % 1000000;
-            if (str_pad((string)$otp, 6, '0', STR_PAD_LEFT) === $code) return true;
-        }
-        return false;
-    }
-
-    private function base32Decode(string $base32): string
-    {
-        $base32chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
-        $base32charsFlipped = array_flip(str_split($base32chars));
-
-        $output = '';
-        $v = 0;
-        $vbits = 0;
-
-        for ($i = 0, $j = strlen($base32); $i < $j; $i++) {
-            $v <<= 5;
-            if (isset($base32charsFlipped[$base32[$i]])) {
-                $v += $base32charsFlipped[$base32[$i]];
-            }
-            $vbits += 5;
-
-            while ($vbits >= 8) {
-                $vbits -= 8;
-                $output .= chr(($v >> $vbits) & 0xFF);
-            }
-        }
-        return $output;
-    }
-}

app/bootstrap/auth.php

@@ -0,0 +1,19 @@
+<?php
+/**
+ * Global Auth State (Optional Helper)
+ */
+
+declare(strict_types=1);
+
+// This can be used to store the current user globally if needed
+// after successful middleware check.
+
+$GLOBALS['current_user'] = null;
+
+function current_user() {
+    return $GLOBALS['current_user'];
+}
+
+function set_current_user(array $user) {
+    $GLOBALS['current_user'] = $user;
+}

app/bootstrap/env.php

@@ -0,0 +1,21 @@
+<?php
+/**
+ * Simple .env Loader
+ */
+
+if (file_exists(ROOT_PATH . '/.env')) {
+    $lines = file(ROOT_PATH . '/.env', FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES);
+    foreach ($lines as $line) {
+        if (str_starts_with(trim($line), '#')) continue;
+        
+        list($name, $value) = explode('=', $line, 2);
+        $name = trim($name);
+        $value = trim($value, " \t\n\r\0\x0B\"'");
+        
+        if (!array_key_exists($name, $_SERVER) && !array_key_exists($name, $_ENV)) {
+            putenv(sprintf('%s=%s', $name, $value));
+            $_ENV[$name] = $value;
+            $_SERVER[$name] = $value;
+        }
+    }
+}

app/bootstrap/init.php

@@ -0,0 +1,29 @@
+<?php
+/**
+ * Simple Bootstrap Initialization
+ */
+
+declare(strict_types=1);
+
+// 1. Constants
+define('ROOT_PATH', dirname(__DIR__, 2));
+define('APP_PATH', ROOT_PATH . '/app');
+define('STORAGE_PATH', ROOT_PATH . '/storage');
+
+// 2. Load Environment Variables
+require_once APP_PATH . '/bootstrap/env.php';
+
+// 3. Common Helpers
+require_once APP_PATH . '/helpers/helpers.php';
+
+// 4. Core Classes (Manual autoload for simplicity)
+require_once APP_PATH . '/core/Database.php';
+require_once APP_PATH . '/core/JWT.php';
+require_once APP_PATH . '/core/Security.php';
+require_once APP_PATH . '/core/Validator.php';
+
+// 5. Response Utility
+require_once APP_PATH . '/bootstrap/response.php';
+
+// 6. Auth Session/State (Simple)
+require_once APP_PATH . '/bootstrap/auth.php';

app/bootstrap/response.php

@@ -0,0 +1,25 @@
+<?php
+/**
+ * Standardized JSON Responses
+ */
+
+function json_response(bool $success, $data = null, ?string $message = null, int $code = 200) {
+    header('Content-Type: application/json; charset=utf-8');
+    http_response_code($code);
+    
+    echo json_encode([
+        'success' => $success,
+        'data'    => $data,
+        'message' => $message,
+        'timestamp' => date('c')
+    ], JSON_UNESCAPED_UNICODE);
+    exit;
+}
+
+function json_error(string $message, int $code = 400, $errors = null) {
+    json_response(false, $errors, $message, $code);
+}
+
+function json_success($data = null, ?string $message = 'Success', int $code = 200) {
+    json_response(true, $data, $message, $code);
+}

app/config/database.php

@@ -0,0 +1,13 @@
+<?php
+/**
+ * Database Configuration
+ */
+
+return [
+    'host'     => $_ENV['DB_HOST'] ?? '127.0.0.1',
+    'port'     => $_ENV['DB_PORT'] ?? '3306',
+    'database' => $_ENV['DB_DATABASE'] ?? 'musadaqDb',
+    'username' => $_ENV['DB_USERNAME'] ?? 'musadaqUser',
+    'password' => $_ENV['DB_PASSWORD'] ?? '',
+    'charset'  => $_ENV['DB_CHARSET'] ?? 'utf8mb4',
+];

app/helpers/helpers.php

@@ -0,0 +1,34 @@
+<?php
+/**
+ * Global Helper Functions
+ */
+
+if (!function_exists('env')) {
+    function env(string $key, $default = null) {
+        return $_ENV[$key] ?? $default;
+    }
+}
+
+if (!function_exists('input')) {
+    function input(string $key = null, $default = null) {
+        static $inputData = null;
+        if ($inputData === null) {
+            $json = file_get_contents('php://input');
+            $inputData = array_merge($_GET, $_POST, json_decode($json, true) ?? []);
+        }
+        
+        if ($key === null) return $inputData;
+        return $inputData[$key] ?? $default;
+    }
+}
+
+if (!function_exists('dd')) {
+    function dd(...$vars) {
+        foreach ($vars as $v) {
+            echo "<pre>";
+            var_dump($v);
+            echo "</pre>";
+        }
+        die();
+    }
+}

app/modules_app/auth/login.php

@@ -0,0 +1,58 @@
+<?php
+/**
+ * Auth Login Endpoint
+ */
+
+use App\Core\Database;
+use App\Core\JWT;
+use App\Core\Validator;
+
+$data = input();
+
+// 1. Validation
+$errors = Validator::validate($data, [
+    'email'    => 'required|email',
+    'password' => 'required'
+]);
+
+if ($errors) {
+    json_error('Validation Failed', 422, $errors);
+}
+
+$email = $data['email'];
+$password = $data['password'];
+
+// 2. DB Check
+$db = Database::getInstance();
+$stmt = $db->prepare("SELECT * FROM users WHERE email = ? LIMIT 1");
+$stmt->execute([$email]);
+$user = $stmt->fetch();
+
+if (!$user || !password_verify($password, $user['password_hash'])) {
+    json_error('بيانات الدخول غير صحيحة', 401);
+}
+
+// 3. Issue Token
+$secret = env('JWT_SECRET', 'super-secret-key');
+$payload = [
+    'user_id' => $user['id'],
+    'role'    => $user['role'],
+    'exp'     => time() + (15 * 60) // 15 minutes
+];
+
+$token = JWT::encode($payload, $secret);
+
+// 4. Update Refresh Token (Simple stored in DB as requested)
+$refreshToken = bin2hex(random_bytes(32));
+$stmt = $db->prepare("UPDATE users SET refresh_token = ? WHERE id = ?");
+$stmt->execute([$refreshToken, $user['id']]);
+
+json_success([
+    'access_token'  => $token,
+    'refresh_token' => $refreshToken,
+    'user' => [
+        'id'    => $user['id'],
+        'name'  => $user['name'],
+        'email' => $user['email']
+    ]
+], 'تم تسجيل الدخول بنجاح');

app/modules_app/auth/logout.php

@@ -0,0 +1,18 @@
+<?php
+/**
+ * Auth Logout Endpoint
+ */
+
+use App\Core\Database;
+use App\Middleware\AuthMiddleware;
+
+// 1. Check Authentication
+$decoded = AuthMiddleware::check();
+$userId = $decoded['user_id'];
+
+// 2. Invalidate Refresh Token
+$db = Database::getInstance();
+$stmt = $db->prepare("UPDATE users SET refresh_token = NULL WHERE id = ?");
+$stmt->execute([$userId]);
+
+json_success(null, 'تم تسجيل الخروج بنجاح');

app/modules_app/auth/refresh.php

@@ -0,0 +1,41 @@
+<?php
+/**
+ * Auth Refresh Endpoint
+ */
+
+use App\Core\Database;
+use App\Core\JWT;
+
+$data = input();
+$refreshToken = $data['refresh_token'] ?? null;
+
+if (!$refreshToken) {
+    json_error('Refresh token is required', 400);
+}
+
+$db = Database::getInstance();
+$stmt = $db->prepare("SELECT * FROM users WHERE refresh_token = ? LIMIT 1");
+$stmt->execute([$refreshToken]);
+$user = $stmt->fetch();
+
+if (!$user) {
+    json_error('Invalid refresh token', 401);
+}
+
+$secret = env('JWT_SECRET', 'super-secret-key');
+$payload = [
+    'user_id' => $user['id'],
+    'role'    => $user['role'],
+    'exp'     => time() + (15 * 60)
+];
+
+$newToken = JWT::encode($payload, $secret);
+$newRefreshToken = bin2hex(random_bytes(32));
+
+$stmt = $db->prepare("UPDATE users SET refresh_token = ? WHERE id = ?");
+$stmt->execute([$newRefreshToken, $user['id']]);
+
+json_success([
+    'access_token'  => $newToken,
+    'refresh_token' => $newRefreshToken
+], 'تم تجديد الجلسة بنجاح');

app/modules_app/trips/index.php

@@ -0,0 +1,28 @@
+<?php
+/**
+ * Trips List Endpoint (Example Module)
+ */
+
+use App\Core\Database;
+use App\Middleware\AuthMiddleware;
+use App\Middleware\RateLimitMiddleware;
+
+// 1. Rate Limiting (e.g., 30 requests per minute)
+RateLimitMiddleware::check(30, 60);
+
+// 2. Auth Check
+$decoded = AuthMiddleware::check();
+
+// 3. Fetch Data
+// Note: Assumes a 'trips' table exists based on the requested structure
+$db = Database::getInstance();
+try {
+    $stmt = $db->prepare("SELECT * FROM trips WHERE user_id = ? ORDER BY created_at DESC");
+    $stmt->execute([$decoded['user_id']]);
+    $trips = $stmt->fetchAll();
+    
+    json_success($trips);
+} catch (\PDOException $e) {
+    // If table doesn't exist, return empty for the sake of the skeleton
+    json_success([], 'Trips table not found, returning empty array for demonstration.');
+}

app/modules_app/users/index.php

@@ -0,0 +1,23 @@
+<?php
+/**
+ * Users List Endpoint
+ */
+
+use App\Core\Database;
+use App\Middleware\AuthMiddleware;
+
+// 1. Auth Check
+$decoded = AuthMiddleware::check();
+
+// 2. Simple Role-Based Access Control (RBAC)
+if ($decoded['role'] !== 'super_admin' && $decoded['role'] !== 'admin') {
+    json_error('غير مصرح لك بالوصول لهذه البيانات', 403);
+}
+
+// 3. Fetch Data
+$db = Database::getInstance();
+$stmt = $db->prepare("SELECT id, name, email, role, is_active, created_at FROM users");
+$stmt->execute();
+$users = $stmt->fetchAll();
+
+json_success($users);