Hamza/musadaq-saas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update: 2026-07-30 02:27:45

Browse Source
This commit is contained in:
Hamza-Ayed
2026-07-30 02:27:45 +03:00
parent 5f62455113
commit ca4a7c2e70
56 changed files with 3391 additions and 709 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Core/AI.php
+71 -14
View File
@@ -14,10 +14,52 @@ class AI
private static int $maxRetries = 3;
/** Tenant the current extraction belongs to, for per-office cost attribution. */
private static ?string $tenantContext = null;
/**
* Extract Data from Invoice Image or PDF (Base64)
* Set the tenant whose quota/cost the next extraction(s) belong to.
* Workers should call this before extracting so ai_usage_log is attributable.
*/
public static function setTenantContext(?string $tenantId): void
{
self::$tenantContext = $tenantId;
}
/**
* Progress output that is safe to call from a web request.
* Writing to stdout mid-request would corrupt the JSON response body.
*/
private static function progress(string $msg): void
{
if (php_sapi_name() === 'cli') {
echo $msg . "\n";
}
@file_put_contents(
STORAGE_PATH . '/logs/worker.log',
'[' . date('Y-m-d H:i:s') . '] [AI] ' . $msg . "\n",
FILE_APPEND
);
}
/**
* Extract the FIRST invoice found in an image or PDF (Base64).
*
* Kept for callers that only ever expect one invoice. Prefer
* extractInvoices() when an image might contain more than one.
*/
public static function extractInvoiceData(string $base64Data, string $mimeType): ?array
{
$invoices = self::extractInvoices($base64Data, $mimeType);
return $invoices[0] ?? null;
}
/**
* Extract EVERY invoice found in an image or PDF (Base64).
*
* @return array<int, array>|null
*/
public static function extractInvoices(string $base64Data, string $mimeType): ?array
{
$apiKey = env('GEMINI_API_KEY');
if (!$apiKey) {
@@ -64,7 +106,7 @@ class AI
error_log("AI Error: cURL failed (attempt $attempt): $curlError");
if ($attempt < self::$maxRetries) {
$wait = pow(2, $attempt) + rand(1, 3);
echo " Retrying in {$wait}s (cURL error)...\n";
self::progress(" Retrying in {$wait}s (cURL error)...");
sleep($wait);
continue;
}
@@ -78,7 +120,7 @@ class AI
// Retry on 503 (overloaded) or 429 (rate limit)
if (in_array($httpCode, [503, 429]) && $attempt < self::$maxRetries) {
$wait = pow(2, $attempt) + rand(1, 3);
echo " Gemini $httpCode — retrying in {$wait}s (attempt $attempt/" . self::$maxRetries . ")...\n";
self::progress(" Gemini $httpCode - retrying in {$wait}s (attempt $attempt/" . self::$maxRetries . ")...");
sleep($wait);
continue;
}
@@ -106,18 +148,22 @@ class AI
return null;
}
// If the AI returns an array of invoices, extract the first one
if (isset($data['invoices']) && is_array($data['invoices']) && count($data['invoices']) > 0) {
$data = $data['invoices'][0];
}
// Track token usage from Gemini response
$usage = $result['usageMetadata'] ?? [];
if (!empty($usage)) {
self::logTokenUsage($usage);
}
return $data;
// The prompt asks for {"invoices": [...]}. Return the whole list; a single
// photo can legitimately hold two receipts, and the old code kept only
// $data['invoices'][0] and discarded the rest without a trace.
if (isset($data['invoices']) && is_array($data['invoices'])) {
$invoices = array_values(array_filter($data['invoices'], 'is_array'));
return empty($invoices) ? null : $invoices;
}
// Model answered with a bare invoice object rather than the wrapper.
return empty($data) ? null : [$data];
}
/**
@@ -138,16 +184,27 @@ class AI
$totalCostUsd = $inputCost + $outputCost;
$totalCostJod = $totalCostUsd * 0.709; // 1 USD ≈ 0.709 JOD
$db->prepare("
INSERT INTO ai_usage_log (id, input_tokens, output_tokens, total_tokens, cost_usd, cost_jod, model, created_at)
VALUES (UUID(), ?, ?, ?, ?, ?, 'gemini-flash-lite', NOW())
")->execute([
$params = [
$inputTokens,
$outputTokens,
$totalTokens,
round($totalCostUsd, 8),
round($totalCostJod, 8),
]);
];
try {
// Preferred: attribute the cost to a tenant.
$db->prepare("
INSERT INTO ai_usage_log (id, tenant_id, input_tokens, output_tokens, total_tokens, cost_usd, cost_jod, model, created_at)
VALUES (UUID(), ?, ?, ?, ?, ?, ?, 'gemini-flash-lite', NOW())
")->execute(array_merge([self::$tenantContext], $params));
} catch (\PDOException $e) {
// Older deployments have no tenant_id column yet - fall back.
$db->prepare("
INSERT INTO ai_usage_log (id, input_tokens, output_tokens, total_tokens, cost_usd, cost_jod, model, created_at)
VALUES (UUID(), ?, ?, ?, ?, ?, 'gemini-flash-lite', NOW())
")->execute($params);
}
} catch (\Exception $e) {
// Never crash the main flow for logging
error_log("[AI] Token usage log failed: " . $e->getMessage());
app/Middleware/AuthMiddleware.php
+7
View File
@@ -44,6 +44,13 @@ final class AuthMiddleware
exit;
}
// Defence in depth for mobile requests: prove the caller also holds the
// per-device secret, so a stolen bearer token on its own is not enough.
// Controlled by HMAC_ENFORCE in .env - see HmacMiddleware.
if (($decoded['source'] ?? null) === 'mobile') {
HmacMiddleware::verify($decoded);
}
return $decoded;
}
}
app/Middleware/HmacMiddleware.php
+152 -32
View File
@@ -1,62 +1,182 @@
<?php
/**
* HMAC Request Signature Middleware
*
* Verifies that incoming requests are signed with a shared secret,
* preventing replay attacks and ensuring request integrity.
*
* HMAC Request Signature Middleware (per-device)
*
* Proves a request came from a device that completed login on this account, and
* that nobody altered it in flight. This is defence in depth on top of the JWT:
* a stolen bearer token alone is not enough to sign a request.
*
* Client must send:
* X-Timestamp: Unix timestamp (seconds)
* X-HMAC-Signature: HMAC-SHA256(timestamp + "." + raw_body, HMAC_SECRET_KEY)
* X-Timestamp: milliseconds since epoch
* X-Signature: HMAC-SHA256("METHOD:path:timestamp[:json_body]", device_secret)
*
* The device_secret is issued at login and stored encrypted (reversibly) in
* user_devices - it CANNOT be bcrypt-hashed, because the server has to be able
* to recompute the same HMAC the client computed.
*
* Rollout: enforcement is controlled by HMAC_ENFORCE in .env.
* HMAC_ENFORCE=false (default) -> a present signature is verified and a bad
* one is rejected, but a missing signature is
* allowed through. Lets older app builds keep
* working while the new build rolls out.
* HMAC_ENFORCE=true -> a signature is mandatory.
*/
declare(strict_types=1);
namespace App\Middleware;
use App\Core\Security;
use App\Core\Database;
use App\Core\Encryption;
final class HmacMiddleware
{
/**
* @param int $maxAgeSeconds Max age for replay attack window (default: 5 minutes)
* @param array $decoded The decoded JWT payload from AuthMiddleware::check().
* @param int $maxAgeSeconds Replay window (default: 5 minutes).
*/
public static function verify(int $maxAgeSeconds = 300): void
public static function verify(array $decoded, int $maxAgeSeconds = 300): void
{
$headers = getallheaders();
$signature = $headers['X-HMAC-Signature'] ?? $headers['x-hmac-signature'] ?? '';
$timestamp = $headers['X-Timestamp'] ?? $headers['x-timestamp'] ?? '';
$enforce = strtolower((string)env('HMAC_ENFORCE', 'false')) === 'true';
// 1. Ensure both headers are present
if (empty($signature) || empty($timestamp)) {
json_error('Missing HMAC signature or timestamp', 401);
$headers = getallheaders();
$signature = $headers['X-Signature'] ?? $headers['x-signature']
?? $headers['X-HMAC-Signature'] ?? $headers['x-hmac-signature'] ?? '';
$timestamp = $headers['X-Timestamp'] ?? $headers['x-timestamp'] ?? '';
// 1. Missing headers: hard fail only when enforcing.
if ($signature === '' || $timestamp === '') {
if ($enforce) {
json_error('Missing request signature', 401);
}
return;
}
// 2. Validate timestamp is numeric
// 2. Validate timestamp format.
if (!ctype_digit((string)$timestamp)) {
json_error('Invalid timestamp format', 401);
}
// 3. Replay attack prevention — reject stale requests
$age = abs(time() - (int)$timestamp);
if ($age > $maxAgeSeconds) {
json_error('Request expired. Check your system clock.', 401);
// 3. Replay prevention. The client sends milliseconds; older callers may
// send seconds, so normalise by magnitude rather than guessing.
$ts = (int)$timestamp;
$tsSeconds = $ts > 100000000000 ? intdiv($ts, 1000) : $ts;
if (abs(time() - $tsSeconds) > $maxAgeSeconds) {
json_error('Request expired. Check your device clock.', 401);
}
// 4. Build the expected signature
$body = file_get_contents('php://input');
$payload = $timestamp . '.' . $body;
$secret = env('HMAC_SECRET_KEY');
// 4. Look up this device's secret.
$deviceId = $decoded['device_id'] ?? null;
$userId = $decoded['user_id'] ?? null;
if (!$secret || strlen($secret) < 32) {
error_log('FATAL: HMAC_SECRET_KEY is missing or too short in .env');
json_error('Server configuration error', 500);
if (!$deviceId || !$userId) {
if ($enforce) {
json_error('Signed requests require a registered device', 401);
}
return;
}
// 5. Verify using constant-time comparison (prevents timing attacks)
if (!Security::verifySignature($payload, $signature, $secret)) {
error_log("HMAC verification failed for " . ($_SERVER['REQUEST_URI'] ?? ''));
json_error('Invalid request signature', 401);
$secret = self::deviceSecret((string)$userId, (string)$deviceId);
if ($secret === null) {
if ($enforce) {
json_error('Unknown device. Please sign in again.', 401);
}
return;
}
// 5. Rebuild the signing payload exactly as the client does.
$method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
$body = file_get_contents('php://input');
// index.php accepts both clean URLs (/api/v1/batches/create) and the
// ?route=v1/batches/create form, which produce different REQUEST_URIs for
// the same endpoint. Accept either so the signature does not depend on
// how the deployment happens to rewrite URLs.
$paths = array_unique(array_filter([
self::requestPath(),
self::normalisePath((string)($_GET['route'] ?? '')),
]));
$candidates = [];
foreach ($paths as $path) {
if ($body !== '' && $body !== false) {
$candidates[] = "{$method}:{$path}:{$timestamp}:{$body}";
}
// GET/multipart requests sign without a body.
$candidates[] = "{$method}:{$path}:{$timestamp}";
}
foreach ($candidates as $payload) {
$expected = hash_hmac('sha256', $payload, $secret);
if (hash_equals($expected, strtolower($signature))) {
return; // Verified.
}
}
error_log('HMAC verification failed for ' . ($_SERVER['REQUEST_URI'] ?? ''));
json_error('Invalid request signature', 401);
}
/**
* The path the client signed. Dio signs options.path, i.e. the endpoint
* relative to the API base URL ("batches/finalize"), without a query string.
*/
private static function requestPath(): string
{
$uri = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '';
return self::normalisePath($uri);
}
/**
* Strip the leading slash and any deployment prefix so the signed value
* matches what the client hashed.
*/
private static function normalisePath(string $raw): string
{
$path = ltrim(trim($raw), '/');
foreach (['api/v1/', 'api/', 'v1/'] as $prefix) {
if (str_starts_with($path, $prefix)) {
$path = substr($path, strlen($prefix));
break;
}
}
return $path;
}
/**
* Decrypt the stored per-device secret, or null if the device is unknown.
*/
private static function deviceSecret(string $userId, string $deviceId): ?string
{
try {
$db = Database::getInstance();
$stmt = $db->prepare("
SELECT device_secret FROM user_devices
WHERE user_id = ? AND device_fingerprint = ? AND is_trusted = 1
LIMIT 1
");
$stmt->execute([$userId, $deviceId]);
$stored = $stmt->fetchColumn();
if (!$stored) {
return null;
}
// Legacy rows hold a bcrypt hash, which is one-way and therefore
// unusable for HMAC. Treat those devices as un-signable until the
// user logs in again on the new build.
if (str_starts_with((string)$stored, '$2y$') || str_starts_with((string)$stored, '$2a$')) {
return null;
}
$plain = Encryption::decrypt((string)$stored);
return $plain === false ? null : $plain;
} catch (\Throwable $e) {
error_log('[HmacMiddleware] device secret lookup failed: ' . $e->getMessage());
return null;
}
}
}
app/Middleware/QuotaMiddleware.php
+48 -6
View File
@@ -21,14 +21,16 @@ final class QuotaMiddleware
*
* @return array The current subscription data (for UI display)
*/
public static function checkInvoiceQuota(string $tenantId): array
public static function checkInvoiceQuota(string $tenantId, int $needed = 1): array
{
$cacheKey = "quota_sub_{$tenantId}";
$sub = Cache::get($cacheKey);
if ($sub === false || $sub === null) {
$db = Database::getInstance();
// $db is needed by the auto-reset branch below regardless of whether the
// subscription came from the cache, so resolve it unconditionally.
$db = Database::getInstance();
if ($sub === false || $sub === null) {
// Fetch subscription with plan info
$stmt = $db->prepare("
SELECT s.*, sp.name_ar as plan_name, sp.ai_features, sp.jofotara_enabled, sp.price_monthly_jod, sp.price_annual_jod
@@ -78,18 +80,30 @@ final class QuotaMiddleware
$sub['current_period_start'] = $newStart;
$sub['current_period_end'] = $newEnd;
// The cached copy still holds the pre-reset counters.
Cache::delete($cacheKey);
error_log("QuotaMiddleware: Auto-reset annual counter for tenant {$tenantId}");
}
// Check invoice quota
// Check invoice quota. $needed lets callers reserve a whole batch at once
// instead of only asking "is there room for one more?".
$used = (int)$sub['invoices_used_this_month'];
$limit = (int)$sub['max_invoices_per_month']; // Keeping the DB column name the same for compatibility
$needed = max(1, $needed);
if ($used >= $limit) {
json_error('لقد وصلت للحد الأقصى من الفواتير المسموحة في باقتك الحالية (' . $limit . ' فاتورة). يرجى ترقية باقتك للاستمرار.', 429, [
if (($used + $needed) > $limit) {
$remaining = max(0, $limit - $used);
$message = $remaining === 0
? 'لقد وصلت للحد الأقصى من الفواتير المسموحة في باقتك الحالية (' . $limit . ' فاتورة). يرجى ترقية باقتك للاستمرار.'
: 'رصيدك المتبقي ' . $remaining . ' فاتورة فقط، وقد طلبت ' . $needed . '. يرجى تقليل عدد الفواتير أو ترقية باقتك.';
json_error($message, 429, [
'quota_type' => 'invoices',
'used' => $used,
'limit' => $limit,
'requested' => $needed,
'remaining' => $remaining,
'plan' => $sub['plan_id'] ?? 'free',
'plan_name' => $sub['plan_name'] ?? 'مجانية',
'period_end' => $sub['current_period_end'],
@@ -99,6 +113,34 @@ final class QuotaMiddleware
return $sub;
}
/**
* Non-fatal variant of checkInvoiceQuota() for background workers.
*
* Workers must never emit an HTTP response, so this returns a boolean
* instead of calling json_error().
*/
public static function hasInvoiceQuota(string $tenantId, int $needed = 1): bool
{
try {
$db = Database::getInstance();
$stmt = $db->prepare("
SELECT invoices_used_this_month, max_invoices_per_month, status
FROM subscriptions WHERE tenant_id = ?
");
$stmt->execute([$tenantId]);
$sub = $stmt->fetch();
if (!$sub) return false;
if (in_array($sub['status'], ['cancelled', 'past_due'], true)) return false;
return ((int)$sub['invoices_used_this_month'] + max(1, $needed))
<= (int)$sub['max_invoices_per_month'];
} catch (\Throwable $e) {
error_log('[QuotaMiddleware] hasInvoiceQuota failed: ' . $e->getMessage());
return false;
}
}
/**
* Increment the monthly invoice counter after a successful upload.
*/
app/Services/InvoiceProcessor.php
+342 -129
View File
@@ -20,6 +20,90 @@ class InvoiceProcessor
}
}
/**
* Atomically claim a pending queue item.
*
* Two consumers race for the queue (the background task spawned by
* batches/finalize.php and the every-minute cron). A SELECT-then-UPDATE
* would let both see the same row as 'pending' and process it twice,
* producing duplicate invoices and double-charging the tenant's quota.
* A single conditional UPDATE makes the claim exclusive: only the process
* whose UPDATE affected a row owns the item.
*
* @return array|null The claimed item joined with its batch, or null if
* another process got there first / it is exhausted.
*/
private static function claimQueueItem(\PDO $db, int $queueId): ?array
{
$claim = $db->prepare("
UPDATE invoice_processing_queue
SET status = 'processing',
attempts = attempts + 1,
claimed_at = NOW(),
error_message = NULL
WHERE id = ?
AND status = 'pending'
AND attempts < COALESCE(max_attempts, 3)
");
$claim->execute([$queueId]);
if ($claim->rowCount() !== 1) {
return null;
}
$stmt = $db->prepare("
SELECT q.*, b.tenant_id AS batch_tenant_id, b.company_id AS batch_company_id,
b.uploaded_by, b.total_images, b.status AS batch_status
FROM invoice_processing_queue q
JOIN invoice_batches b ON q.batch_id = b.id
WHERE q.id = ?
");
$stmt->execute([$queueId]);
$item = $stmt->fetch();
return $item ?: null;
}
/**
* Release a claimed item back to the queue for a later retry, or bury it as
* permanently failed once max_attempts is exhausted.
*
* Only a permanent failure counts towards the batch's failed_images, so a
* transient AI hiccup does not prematurely "complete" a batch.
*/
private static function failQueueItem(\PDO $db, array $item, string $reason): void
{
$queueId = (int)$item['id'];
$attempts = (int)($item['attempts'] ?? 1);
$maxAttempts = (int)($item['max_attempts'] ?? 3);
$batchId = (string)$item['batch_id'];
if ($attempts < $maxAttempts) {
$db->prepare("
UPDATE invoice_processing_queue
SET status = 'pending', error_message = ?
WHERE id = ?
")->execute([$reason, $queueId]);
self::log("Queue ID $queueId: will retry ($attempts/$maxAttempts) - $reason");
return;
}
$db->prepare("
UPDATE invoice_processing_queue
SET status = 'failed', error_message = ?, processed_at = NOW()
WHERE id = ?
")->execute([$reason, $queueId]);
$db->prepare("
UPDATE invoice_batches SET failed_images = failed_images + 1 WHERE id = ?
")->execute([$batchId]);
self::log("Queue ID $queueId: PERMANENTLY FAILED after $attempts attempt(s) - $reason");
self::checkBatchCompletion($batchId);
}
/**
* Processes a single invoice queue item by its ID.
*/
@@ -34,37 +118,41 @@ class InvoiceProcessor
return false;
}
$item = null;
// Once the invoice is committed the item must never be released back to
// 'pending', or a later worker would re-insert the same invoice.
$committed = false;
try {
// Fetch the queue item and its batch info
$stmt = $db->prepare("
SELECT q.*, b.tenant_id, b.company_id, b.uploaded_by, b.total_images
FROM invoice_processing_queue q
JOIN invoice_batches b ON q.batch_id = b.id
WHERE q.id = ? AND q.status = 'pending'
");
$stmt->execute([$queueId]);
$item = $stmt->fetch();
$item = self::claimQueueItem($db, $queueId);
if (!$item) {
self::log("Queue ID $queueId: Not found or not pending. Skipping.");
self::log("Queue ID $queueId: not claimable (already taken, not pending, or attempts exhausted). Skipping.");
return false;
}
$batchId = $item['batch_id'];
$tenantId = $item['tenant_id'];
$companyId = $item['company_id'];
$batchId = (string)$item['batch_id'];
$tenantId = (string)$item['batch_tenant_id'];
$companyId = (string)$item['batch_company_id'];
$userId = $item['uploaded_by'];
$imagePath = $item['image_path'];
$imagePath = (string)$item['image_path'];
self::log("Queue ID $queueId: Image=$imagePath, Batch=$batchId");
// Mark as processing
$db->prepare("UPDATE invoice_processing_queue SET status = 'processing' WHERE id = ?")->execute([$queueId]);
// Check file exists
// Check file exists. A missing file will never appear, so bury it
// immediately rather than burning the remaining retries.
if (!file_exists($imagePath)) {
self::log("Queue ID $queueId: FILE NOT FOUND: $imagePath");
$db->prepare("UPDATE invoice_processing_queue SET status = 'failed', error_message = 'File not found' WHERE id = ?")->execute([$queueId]);
$item['attempts'] = $item['max_attempts'] ?? 3;
self::failQueueItem($db, $item, 'File not found');
return false;
}
// Refuse to spend AI credit the tenant no longer has.
if (!QuotaMiddleware::hasInvoiceQuota($tenantId)) {
self::log("Queue ID $queueId: tenant $tenantId is out of invoice quota.");
$item['attempts'] = $item['max_attempts'] ?? 3;
self::failQueueItem($db, $item, 'تم استنفاد رصيد الفواتير لهذا الشهر');
return false;
}
@@ -75,124 +163,92 @@ class InvoiceProcessor
$base64Data = base64_encode($fileContent);
// AI Extraction (this takes ~5-15 seconds)
$extracted = AI::extractInvoiceData($base64Data, $mimeType);
AI::setTenantContext($tenantId);
$extractedInvoices = AI::extractInvoices($base64Data, $mimeType);
AI::setTenantContext(null);
if (!$extracted) {
self::log("Queue ID $queueId: AI extraction returned NULL (failed).");
$db->prepare("UPDATE invoice_processing_queue SET status = 'failed', error_message = 'AI failed to extract data from image' WHERE id = ?")->execute([$queueId]);
if (empty($extractedInvoices)) {
self::log("Queue ID $queueId: AI extraction returned nothing.");
self::failQueueItem($db, $item, 'AI failed to extract data from image');
return false;
}
self::log("Queue ID $queueId: AI extraction successful. Saving to DB...");
self::log("Queue ID $queueId: AI extracted " . count($extractedInvoices) . " invoice(s). Saving to DB...");
$createdInvoiceIds = [];
// Save to database in a transaction
$db->beginTransaction();
try {
$invoiceId = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4));
$supplierTin = $extracted['supplier']['tin'] ?? '';
$invoiceNum = $extracted['invoice_number'] ?? '';
$invoiceDate = $extracted['invoice_date'] ?? '';
$validDate = (!empty($invoiceDate) && strtotime($invoiceDate)) ? $invoiceDate : null;
$stmt = $db->prepare("
INSERT INTO invoices (
id, tenant_id, company_id, uploaded_by, original_file_path, status,
invoice_number, invoice_date, invoice_type, invoice_category,
supplier_tin, supplier_name, supplier_address,
buyer_tin, buyer_name, buyer_national_id,
subtotal, tax_amount, discount_total, grand_total, currency_code,
created_at
) VALUES (
?, ?, ?, ?, ?, 'extracted',
?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
?, ?, ?, ?, ?,
NOW()
)
");
$stmt->execute([
$invoiceId, $tenantId, $companyId, $userId, $imagePath,
$invoiceNum, $validDate, $extracted['invoice_type'] ?? 'cash', $extracted['invoice_category'] ?? 'simplified',
Encryption::encrypt($supplierTin), Encryption::encrypt($extracted['supplier']['name'] ?? ''), Encryption::encrypt($extracted['supplier']['address'] ?? ''),
Encryption::encrypt($extracted['buyer']['tin'] ?? ''), Encryption::encrypt($extracted['buyer']['name'] ?? ''), Encryption::encrypt($extracted['buyer']['national_id'] ?? ''),
$extracted['subtotal'] ?? 0, $extracted['tax_amount'] ?? 0, $extracted['discount_total'] ?? 0, $extracted['grand_total'] ?? 0, $extracted['currency_code'] ?? 'JOD'
]);
// Save invoice line items
if (!empty($extracted['lines'])) {
$lineStmt = $db->prepare("
INSERT INTO invoice_lines (
id, invoice_id, line_number, description,
quantity, unit_price, tax_rate, tax_amount,
discount_amount, net_total, line_total, tax_category
) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
");
foreach ($extracted['lines'] as $idx => $line) {
$quantity = (float)($line['quantity'] ?? 1);
$unitPrice = (float)($line['unit_price'] ?? 0);
$taxRate = (float)($line['tax_rate'] ?? 0);
$discount = (float)($line['discount'] ?? $line['discount_amount'] ?? 0);
$subtotal = $quantity * $unitPrice;
$taxAmount = (float)($line['tax_amount'] ?? ($subtotal * $taxRate));
$netTotal = (float)($line['net_total'] ?? ($line['line_total'] ?? ($subtotal + $taxAmount - $discount)));
$lineStmt->execute([
vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4)),
$invoiceId,
$line['line_number'] ?? ($idx + 1),
$line['description'] ?? '',
$quantity,
$unitPrice,
$taxRate,
$taxAmount,
$discount,
$netTotal,
$netTotal, // line_total
$line['tax_category'] ?? 'standard'
]);
}
self::log("Queue ID $queueId: Saved " . count($extracted['lines']) . " line items.");
foreach ($extractedInvoices as $extracted) {
$createdInvoiceIds[] = self::insertInvoice(
$db,
$extracted,
$batchId,
$tenantId,
$companyId,
$userId,
$imagePath
);
}
$primaryInvoiceId = $createdInvoiceIds[0];
// Mark queue item done
$db->prepare("UPDATE invoice_processing_queue SET status = 'done', invoice_id = ?, processed_at = NOW() WHERE id = ?")->execute([$invoiceId, $queueId]);
$db->prepare("UPDATE invoice_processing_queue SET status = 'done', invoice_id = ?, error_message = NULL, processed_at = NOW() WHERE id = ?")
->execute([$primaryInvoiceId, $queueId]);
// Update batch progress
$db->prepare("UPDATE invoice_batches SET processed_images = processed_images + 1 WHERE id = ?")->execute([$batchId]);
// Increment quota
QuotaMiddleware::incrementInvoiceUsage($tenantId);
$db->prepare("UPDATE invoice_batches SET processed_images = processed_images + 1 WHERE id = ?")
->execute([$batchId]);
$db->commit();
self::log("Queue ID $queueId: ✓ Invoice $invoiceId created and committed.");
$committed = true;
self::log("Queue ID $queueId: OK - invoice(s) " . implode(', ', $createdInvoiceIds) . " committed.");
} catch (\Throwable $e) {
if ($db->inTransaction()) {
$db->rollBack();
}
self::log("Queue ID $queueId: DB ERROR: " . $e->getMessage());
try {
$db->prepare("UPDATE invoice_processing_queue SET status = 'failed', error_message = ? WHERE id = ?")->execute([$e->getMessage(), $queueId]);
} catch (\Throwable $e2) {}
self::failQueueItem($db, $item, $e->getMessage());
return false;
}
// Charge quota only for invoices that are actually committed. This runs
// outside the transaction so a quota-write failure cannot roll back
// (or be rolled back by) the invoice itself.
//
// Wrapped separately: letting this bubble to the outer catch would
// release an ALREADY-COMMITTED item back to 'pending' and the next
// worker would insert the same invoice a second time.
try {
foreach ($createdInvoiceIds as $_) {
QuotaMiddleware::incrementInvoiceUsage($tenantId);
}
} catch (\Throwable $quotaErr) {
self::log("Queue ID $queueId: quota increment failed (invoice already saved): " . $quotaErr->getMessage());
}
// Check if entire batch is complete
self::checkBatchCompletion($batchId);
// Progress/Completion Push
// Progress push (silent data message + Live Activity update)
try {
$stmt = $db->prepare("SELECT total_images, processed_images, uploaded_by FROM invoice_batches WHERE id = ?");
$stmt = $db->prepare("SELECT total_images, processed_images, failed_images, status, uploaded_by FROM invoice_batches WHERE id = ?");
$stmt->execute([$batchId]);
$currentBatch = $stmt->fetch();
if ($currentBatch) {
$notifier = new NotificationService();
// Send data notification with invoice_id for auto-navigation
// 'batch_progress' is the type NotificationService recognises for
// iOS Live Activity / Android Live Update payloads.
$notifier->sendDataNotification($currentBatch['uploaded_by'], [
'type' => 'invoice_processed',
'batch_id' => $batchId,
'invoice_id' => $invoiceId,
'processed' => $currentBatch['processed_images'],
'total' => $currentBatch['total_images']
'type' => 'batch_progress',
'batch_id' => $batchId,
'invoice_id' => $createdInvoiceIds[0],
'processed' => $currentBatch['processed_images'],
'failed' => $currentBatch['failed_images'],
'total' => $currentBatch['total_images'],
'is_done' => in_array($currentBatch['status'], ['done', 'partial_fail', 'failed'], true) ? 1 : 0,
]);
}
} catch (\Throwable $pushErr) {
@@ -203,42 +259,199 @@ class InvoiceProcessor
} catch (\Throwable $e) {
self::log("Queue ID $queueId: UNHANDLED EXCEPTION: " . $e->getMessage() . "\n" . $e->getTraceAsString());
// Never leave a claimed row stuck in 'processing' - unless the invoice
// was already committed, in which case retrying would duplicate it.
if ($item !== null && !$committed) {
try {
self::failQueueItem($db, $item, $e->getMessage());
} catch (\Throwable $e2) {
self::log("Queue ID $queueId: could not release item: " . $e2->getMessage());
}
}
return false;
}
}
/**
* Insert one extracted invoice (plus its line items) and return its id.
*/
private static function insertInvoice(
\PDO $db,
array $extracted,
string $batchId,
string $tenantId,
string $companyId,
?string $userId,
string $imagePath
): string {
$invoiceId = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4));
$supplierTin = $extracted['supplier']['tin'] ?? '';
$invoiceNum = $extracted['invoice_number'] ?? '';
$invoiceDate = $extracted['invoice_date'] ?? '';
$validDate = (!empty($invoiceDate) && strtotime($invoiceDate)) ? $invoiceDate : null;
$stmt = $db->prepare("
INSERT INTO invoices (
id, tenant_id, company_id, batch_id, uploaded_by, original_file_path, status,
invoice_number, invoice_date, invoice_type, invoice_category,
supplier_tin, supplier_name, supplier_address,
buyer_tin, buyer_name, buyer_national_id,
subtotal, tax_amount, discount_total, grand_total, currency_code,
created_at
) VALUES (
?, ?, ?, ?, ?, ?, 'extracted',
?, ?, ?, ?, ?, ?, ?, ?, ?, ?,
?, ?, ?, ?, ?,
NOW()
)
");
$stmt->execute([
$invoiceId, $tenantId, $companyId, $batchId, $userId, $imagePath,
$invoiceNum, $validDate, $extracted['invoice_type'] ?? 'cash', $extracted['invoice_category'] ?? 'simplified',
Encryption::encrypt($supplierTin), Encryption::encrypt($extracted['supplier']['name'] ?? ''), Encryption::encrypt($extracted['supplier']['address'] ?? ''),
Encryption::encrypt($extracted['buyer']['tin'] ?? ''), Encryption::encrypt($extracted['buyer']['name'] ?? ''), Encryption::encrypt($extracted['buyer']['national_id'] ?? ''),
$extracted['subtotal'] ?? 0, $extracted['tax_amount'] ?? 0, $extracted['discount_total'] ?? 0, $extracted['grand_total'] ?? 0, $extracted['currency_code'] ?? 'JOD'
]);
// Save invoice line items
if (!empty($extracted['lines'])) {
$lineStmt = $db->prepare("
INSERT INTO invoice_lines (
id, invoice_id, line_number, description,
quantity, unit_price, tax_rate, tax_amount,
discount_amount, net_total, line_total, tax_category
) VALUES (?,?,?,?,?,?,?,?,?,?,?,?)
");
foreach ($extracted['lines'] as $idx => $line) {
$quantity = (float)($line['quantity'] ?? 1);
$unitPrice = (float)($line['unit_price'] ?? 0);
$taxRate = (float)($line['tax_rate'] ?? 0);
$discount = (float)($line['discount'] ?? $line['discount_amount'] ?? 0);
$subtotal = $quantity * $unitPrice;
$taxAmount = (float)($line['tax_amount'] ?? ($subtotal * $taxRate));
$netTotal = (float)($line['net_total'] ?? ($line['line_total'] ?? ($subtotal + $taxAmount - $discount)));
$lineStmt->execute([
vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4)),
$invoiceId,
$line['line_number'] ?? ($idx + 1),
$line['description'] ?? '',
$quantity,
$unitPrice,
$taxRate,
$taxAmount,
$discount,
$netTotal,
$netTotal, // line_total
$line['tax_category'] ?? 'standard'
]);
}
self::log("Invoice $invoiceId: saved " . count($extracted['lines']) . " line items.");
}
return $invoiceId;
}
/**
* Close a batch once every image has reached a terminal state.
*
* Two rules matter here:
* 1. A batch still in 'uploading' is NEVER completed. total_images grows as
* each image arrives, so a worker that processed the first image would
* otherwise see 1 >= 1 and lock the batch while the user is still
* uploading - after which upload-image and finalize both reject with a
* misleading "already processed" error.
* 2. Permanent failures count towards completion, otherwise one bad photo
* leaves the batch (and the app's progress bar) hanging forever.
*/
public static function checkBatchCompletion(string $batchId): void
{
try {
$db = Database::getInstance();
$stmt = $db->prepare("SELECT total_images, processed_images, uploaded_by FROM invoice_batches WHERE id = ?");
$stmt = $db->prepare("
SELECT total_images, processed_images, failed_images, status, uploaded_by
FROM invoice_batches WHERE id = ?
");
$stmt->execute([$batchId]);
$batch = $stmt->fetch();
if ($batch && $batch['processed_images'] >= $batch['total_images']) {
$db->prepare("UPDATE invoice_batches SET status = 'done', completed_at = NOW() WHERE id = ?")->execute([$batchId]);
self::log("Batch $batchId: COMPLETE ({$batch['processed_images']}/{$batch['total_images']})");
try {
// Try to get the last invoice_id for this batch for completion navigation
$invStmt = $db->prepare("SELECT id FROM invoices WHERE original_file_path IN (SELECT image_path FROM invoice_processing_queue WHERE batch_id = ?) ORDER BY created_at DESC LIMIT 1");
$invStmt->execute([$batchId]);
$lastInvoiceId = $invStmt->fetchColumn();
if (!$batch) {
return;
}
$notifier = new NotificationService();
$notifier->sendNotification(
$batch['uploaded_by'],
"اكتملت معالجة الدفعة",
"تمت معالجة جميع الفواتير بنجاح. يمكنك الآن مراجعتها وتدقيقها.",
[
'type' => 'batch_complete',
'batch_id' => $batchId,
'invoice_id' => $lastInvoiceId ?: ''
]
);
} catch (\Throwable $e) {
self::log("Batch $batchId: Completion notification failed: " . $e->getMessage());
}
// Rule 1: the user is still uploading - nothing to close yet.
if ($batch['status'] === 'uploading') {
self::log("Batch $batchId: still uploading, completion check deferred.");
return;
}
// Already terminal.
if (in_array($batch['status'], ['done', 'partial_fail', 'failed'], true)) {
return;
}
$total = (int)$batch['total_images'];
$processed = (int)$batch['processed_images'];
$failed = (int)$batch['failed_images'];
// Rule 2: terminal means done OR permanently failed.
if ($total <= 0 || ($processed + $failed) < $total) {
return;
}
if ($failed === 0) {
$finalStatus = 'done';
} elseif ($processed === 0) {
$finalStatus = 'failed';
} else {
$finalStatus = 'partial_fail';
}
$db->prepare("UPDATE invoice_batches SET status = ?, completed_at = NOW() WHERE id = ?")
->execute([$finalStatus, $batchId]);
self::log("Batch $batchId: $finalStatus ($processed ok / $failed failed / $total total)");
try {
// invoices.batch_id is populated now, so this is a direct lookup.
$invStmt = $db->prepare("SELECT id FROM invoices WHERE batch_id = ? ORDER BY created_at DESC LIMIT 1");
$invStmt->execute([$batchId]);
$lastInvoiceId = $invStmt->fetchColumn();
[$title, $body] = match ($finalStatus) {
'done' => [
'اكتملت معالجة الدفعة',
'تمت معالجة جميع الفواتير بنجاح. يمكنك الآن مراجعتها وتدقيقها.',
],
'partial_fail' => [
'اكتملت المعالجة مع أخطاء',
"تمت معالجة {$processed} فاتورة بنجاح، وفشلت {$failed}. يمكنك إعادة تصوير الفواتير الفاشلة.",
],
default => [
'فشلت معالجة الدفعة',
"لم نتمكن من استخراج البيانات من {$failed} فاتورة. يرجى إعادة التصوير بإضاءة أفضل.",
],
};
$notifier = new NotificationService();
$notifier->sendNotification(
$batch['uploaded_by'],
$title,
$body,
[
'type' => 'batch_complete',
'batch_id' => $batchId,
'status' => $finalStatus,
'processed' => $processed,
'failed' => $failed,
'total' => $total,
'is_done' => 1,
'invoice_id' => $lastInvoiceId ?: '',
]
);
} catch (\Throwable $e) {
self::log("Batch $batchId: Completion notification failed: " . $e->getMessage());
}
} catch (\Throwable $e) {
self::log("Batch $batchId: checkBatchCompletion error: " . $e->getMessage());
app/Services/NotificationService.php
+157 -27
View File
@@ -77,27 +77,109 @@ class NotificationService
public function sendDataNotification(string $userId, array $data, ?string $deviceId = null): bool
{
$db = Database::getInstance();
// Fetch the Live Activity token alongside the FCM one. They are different
// tokens with different delivery semantics: the FCM registration token
// wakes the app, while an ActivityKit token is the only thing that can
// update a Live Activity on the lock screen.
$sql = "SELECT push_token, live_activity_token, platform
FROM user_devices
WHERE user_id = ? AND push_token IS NOT NULL";
$params = [$userId];
if ($deviceId) {
$stmt = $db->prepare("SELECT push_token FROM user_devices WHERE user_id = ? AND device_fingerprint = ? AND push_token IS NOT NULL");
$stmt->execute([$userId, $deviceId]);
} else {
$stmt = $db->prepare("SELECT push_token FROM user_devices WHERE user_id = ? AND push_token IS NOT NULL");
$stmt->execute([$userId]);
$sql .= " AND device_fingerprint = ?";
$params[] = $deviceId;
}
$tokens = $stmt->fetchAll(\PDO::FETCH_COLUMN);
if (empty($tokens)) return false;
try {
$stmt = $db->prepare($sql);
$stmt->execute($params);
$devices = $stmt->fetchAll();
} catch (\PDOException $e) {
// Deployment has not run the live_activity_token migration yet.
$fallbackSql = str_replace(', live_activity_token', '', $sql);
$stmt = $db->prepare($fallbackSql);
$stmt->execute($params);
$devices = $stmt->fetchAll();
}
if (empty($devices)) return false;
$isLiveActivityUpdate = ($data['type'] ?? '') === 'batch_progress';
$successCount = 0;
foreach ($tokens as $token) {
if ($this->dispatchToFcm($token, null, null, $data)) {
foreach ($devices as $device) {
// 1. Silent data push to the app itself (drives in-app progress and
// the Android ongoing notification).
if ($this->dispatchToFcm($device['push_token'], null, null, $data)) {
$successCount++;
}
// 2. Separate ActivityKit push for the iOS Live Activity.
$activityToken = $device['live_activity_token'] ?? null;
if ($isLiveActivityUpdate && !empty($activityToken)) {
if ($this->dispatchLiveActivityUpdate($activityToken, $data)) {
$successCount++;
}
}
}
return $successCount > 0;
}
/**
* Push an ActivityKit content-state update to a running Live Activity.
*
* The content-state keys must match InvoiceBatchAttributes.ContentState in
* the iOS widget extension exactly, or iOS discards the update.
*/
private function dispatchLiveActivityUpdate(string $activityToken, array $data): bool
{
$accessToken = $this->getAccessToken();
if (!$accessToken) return false;
$processed = (int)($data['processed'] ?? 0);
$total = max(1, (int)($data['total'] ?? 1));
$failed = (int)($data['failed'] ?? 0);
$isDone = !empty($data['is_done']);
$message = [
'apns' => [
// The token that identifies the ACTIVITY, not the app install.
'live_activity_token' => $activityToken,
'headers' => [
'apns-push-type' => 'liveactivity',
'apns-priority' => '10',
'apns-topic' => env('IOS_BUNDLE_ID', 'com.musadaq.app') . '.push-type.liveactivity',
],
'payload' => [
'aps' => [
'timestamp' => time(),
'event' => $isDone ? 'end' : 'update',
'content-state' => [
'current' => $processed,
'total' => $total,
'failed' => $failed,
'isDone' => $isDone,
],
// Give iOS a moment to show the final state before it
// clears a finished activity.
'dismissal-date' => $isDone ? (time() + 30) : null,
],
],
],
];
// Strip nulls: APNs rejects a null dismissal-date.
$message['apns']['payload']['aps'] = array_filter(
$message['apns']['payload']['aps'],
static fn($v) => $v !== null
);
return $this->postToFcm(['message' => $message], 'live-activity');
}
/**
* Dispatch notification to Firebase via HTTP v1 API
*/
@@ -108,11 +190,6 @@ class NotificationService
return false;
}
$accessToken = $this->getAccessToken();
if (!$accessToken) return false;
$url = "https://fcm.googleapis.com/v1/projects/{$this->projectId}/messages:send";
$message = [
'token' => $token,
'data' => array_map('strval', $data),
@@ -138,7 +215,11 @@ class NotificationService
],
];
} else {
// Silent push / Live Activity Update
// Silent data push: wakes the app so it can update its own progress
// UI. Live Activity updates are a SEPARATE push that must target the
// ActivityKit token - see dispatchLiveActivityUpdate(). Sending
// apns-push-type: liveactivity to an app registration token, as this
// used to do, never reaches the activity.
$message['android'] = [
'priority' => 'high'
];
@@ -153,19 +234,31 @@ class NotificationService
]
]
];
// If the data contains live activity update markers, adjust headers for iOS ActivityKit
if (isset($data['type']) && $data['type'] === 'batch_progress') {
$message['apns']['headers']['apns-push-type'] = 'liveactivity';
$message['apns']['headers']['apns-priority'] = '10';
$message['apns']['payload']['aps']['content-state'] = $data;
$message['apns']['payload']['aps']['timestamp'] = time();
$message['apns']['payload']['aps']['event'] = 'update';
}
}
$payload = ['message' => $message];
return $this->postToFcm(['message' => $message], 'message');
}
/**
* POST a prepared FCM v1 payload. Shared by the notification, silent-data and
* Live Activity paths so auth/error handling lives in one place.
*/
private function postToFcm(array $payload, string $kind): bool
{
if (!file_exists($this->serviceAccountPath)) {
error_log("[NotificationService] Firebase service account file missing: {$this->serviceAccountPath}");
return false;
}
$accessToken = $this->getAccessToken();
if (!$accessToken) return false;
if (empty($this->projectId)) {
error_log('[NotificationService] Firebase project id is empty');
return false;
}
$url = "https://fcm.googleapis.com/v1/projects/{$this->projectId}/messages:send";
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
@@ -175,20 +268,57 @@ class NotificationService
'Content-Type: application/json',
]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload));
curl_setopt($ch, CURLOPT_TIMEOUT, 15);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($payload, JSON_UNESCAPED_UNICODE));
$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$curlError = curl_error($ch);
curl_close($ch);
if ($curlError) {
error_log("[NotificationService] FCM cURL error ($kind): $curlError");
return false;
}
if ($httpCode !== 200) {
error_log("[NotificationService] FCM Send Error ($httpCode): " . $response);
error_log("[NotificationService] FCM Send Error [$kind] ($httpCode): " . $response);
// A token the server rejected as unregistered will never work again;
// clear it so we stop paying for the round trip on every batch.
if (in_array($httpCode, [400, 404], true) && str_contains((string)$response, 'UNREGISTERED')) {
$this->pruneToken($payload);
}
return false;
}
return true;
}
/**
* Drop a token FCM reported as permanently invalid.
*/
private function pruneToken(array $payload): void
{
$token = $payload['message']['token'] ?? null;
$activityToken = $payload['message']['apns']['live_activity_token'] ?? null;
try {
$db = Database::getInstance();
if ($token) {
$db->prepare("UPDATE user_devices SET push_token = NULL WHERE push_token = ?")
->execute([$token]);
error_log('[NotificationService] Pruned unregistered push token');
}
if ($activityToken) {
$db->prepare("UPDATE user_devices SET live_activity_token = NULL WHERE live_activity_token = ?")
->execute([$activityToken]);
}
} catch (\Throwable $e) {
error_log('[NotificationService] pruneToken failed: ' . $e->getMessage());
}
}
/**
* Get OAuth2 Access Token for Firebase using Service Account JWT
* Self-contained: no external libraries needed.
app/cron/process_batches.php
+44 -4
View File
@@ -47,16 +47,56 @@ try {
$processed = 0;
$failed = 0;
// Get ALL pending items (no infinite loop!)
// Get pending items whose batch is ready for processing.
//
// The b.status <> 'uploading' filter is essential: queue rows are inserted as
// 'pending' the moment each image lands, while total_images is still growing.
// Picking them up mid-upload made the batch look complete after the first
// image, which locked the batch and made every later upload fail with
// "لا يمكن إضافة صور لدفعة تمت معالجتها".
$stmt = $db->prepare("
SELECT id FROM invoice_processing_queue
WHERE status = 'pending'
ORDER BY created_at ASC
SELECT q.id
FROM invoice_processing_queue q
JOIN invoice_batches b ON q.batch_id = b.id
WHERE q.status = 'pending'
AND q.attempts < COALESCE(q.max_attempts, 3)
AND b.status <> 'uploading'
ORDER BY q.created_at ASC
LIMIT 20
");
$stmt->execute();
$items = $stmt->fetchAll(\PDO::FETCH_COLUMN);
// Rescue items abandoned in 'processing' by a crashed worker. claimed_at is
// set at claim time, so "claimed over 10 minutes ago and still processing"
// reliably means the owning process died mid-flight.
$rescued = $db->prepare("
UPDATE invoice_processing_queue
SET status = 'pending',
error_message = 'Reclaimed from a stalled worker'
WHERE status = 'processing'
AND claimed_at IS NOT NULL
AND claimed_at < (NOW() - INTERVAL 10 MINUTE)
");
$rescued->execute();
if ($rescued->rowCount() > 0) {
workerLog("Reclaimed {$rescued->rowCount()} stalled item(s) back to pending.");
}
// Also close out batches whose images all reached a terminal state but whose
// status was never flipped (e.g. the worker died right after the last item).
$stuck = $db->query("
SELECT id FROM invoice_batches
WHERE status = 'processing'
AND total_images > 0
AND (processed_images + failed_images) >= total_images
LIMIT 50
")->fetchAll(\PDO::FETCH_COLUMN);
foreach ($stuck as $stuckBatchId) {
workerLog("Closing stuck batch: $stuckBatchId");
InvoiceProcessor::checkBatchCompletion((string)$stuckBatchId);
}
if (empty($items)) {
workerLog("No pending items. Exiting.");
} else {
app/helpers/helpers.php
+2 -1
View File
@@ -10,7 +10,8 @@ if (!function_exists('env')) {
}
if (!function_exists('input')) {
function input(string $key = null, $default = null) {
// ?string, not string: implicit nullable params are deprecated in PHP 8.4.
function input(?string $key = null, $default = null) {
static $inputData = null;
if ($inputData === null) {
$json = file_get_contents('php://input');
app/middleware/AuthMiddleware.php
+7
View File
@@ -44,6 +44,13 @@ final class AuthMiddleware
exit;
}
// Defence in depth for mobile requests: prove the caller also holds the
// per-device secret, so a stolen bearer token on its own is not enough.
// Controlled by HMAC_ENFORCE in .env - see HmacMiddleware.
if (($decoded['source'] ?? null) === 'mobile') {
HmacMiddleware::verify($decoded);
}
return $decoded;
}
}
app/middleware/HmacMiddleware.php
+152 -32
View File
@@ -1,62 +1,182 @@
<?php
/**
* HMAC Request Signature Middleware
*
* Verifies that incoming requests are signed with a shared secret,
* preventing replay attacks and ensuring request integrity.
*
* HMAC Request Signature Middleware (per-device)
*
* Proves a request came from a device that completed login on this account, and
* that nobody altered it in flight. This is defence in depth on top of the JWT:
* a stolen bearer token alone is not enough to sign a request.
*
* Client must send:
* X-Timestamp: Unix timestamp (seconds)
* X-HMAC-Signature: HMAC-SHA256(timestamp + "." + raw_body, HMAC_SECRET_KEY)
* X-Timestamp: milliseconds since epoch
* X-Signature: HMAC-SHA256("METHOD:path:timestamp[:json_body]", device_secret)
*
* The device_secret is issued at login and stored encrypted (reversibly) in
* user_devices - it CANNOT be bcrypt-hashed, because the server has to be able
* to recompute the same HMAC the client computed.
*
* Rollout: enforcement is controlled by HMAC_ENFORCE in .env.
* HMAC_ENFORCE=false (default) -> a present signature is verified and a bad
* one is rejected, but a missing signature is
* allowed through. Lets older app builds keep
* working while the new build rolls out.
* HMAC_ENFORCE=true -> a signature is mandatory.
*/
declare(strict_types=1);
namespace App\Middleware;
use App\Core\Security;
use App\Core\Database;
use App\Core\Encryption;
final class HmacMiddleware
{
/**
* @param int $maxAgeSeconds Max age for replay attack window (default: 5 minutes)
* @param array $decoded The decoded JWT payload from AuthMiddleware::check().
* @param int $maxAgeSeconds Replay window (default: 5 minutes).
*/
public static function verify(int $maxAgeSeconds = 300): void
public static function verify(array $decoded, int $maxAgeSeconds = 300): void
{
$headers = getallheaders();
$signature = $headers['X-HMAC-Signature'] ?? $headers['x-hmac-signature'] ?? '';
$timestamp = $headers['X-Timestamp'] ?? $headers['x-timestamp'] ?? '';
$enforce = strtolower((string)env('HMAC_ENFORCE', 'false')) === 'true';
// 1. Ensure both headers are present
if (empty($signature) || empty($timestamp)) {
json_error('Missing HMAC signature or timestamp', 401);
$headers = getallheaders();
$signature = $headers['X-Signature'] ?? $headers['x-signature']
?? $headers['X-HMAC-Signature'] ?? $headers['x-hmac-signature'] ?? '';
$timestamp = $headers['X-Timestamp'] ?? $headers['x-timestamp'] ?? '';
// 1. Missing headers: hard fail only when enforcing.
if ($signature === '' || $timestamp === '') {
if ($enforce) {
json_error('Missing request signature', 401);
}
return;
}
// 2. Validate timestamp is numeric
// 2. Validate timestamp format.
if (!ctype_digit((string)$timestamp)) {
json_error('Invalid timestamp format', 401);
}
// 3. Replay attack prevention — reject stale requests
$age = abs(time() - (int)$timestamp);
if ($age > $maxAgeSeconds) {
json_error('Request expired. Check your system clock.', 401);
// 3. Replay prevention. The client sends milliseconds; older callers may
// send seconds, so normalise by magnitude rather than guessing.
$ts = (int)$timestamp;
$tsSeconds = $ts > 100000000000 ? intdiv($ts, 1000) : $ts;
if (abs(time() - $tsSeconds) > $maxAgeSeconds) {
json_error('Request expired. Check your device clock.', 401);
}
// 4. Build the expected signature
$body = file_get_contents('php://input');
$payload = $timestamp . '.' . $body;
$secret = env('HMAC_SECRET_KEY');
// 4. Look up this device's secret.
$deviceId = $decoded['device_id'] ?? null;
$userId = $decoded['user_id'] ?? null;
if (!$secret || strlen($secret) < 32) {
error_log('FATAL: HMAC_SECRET_KEY is missing or too short in .env');
json_error('Server configuration error', 500);
if (!$deviceId || !$userId) {
if ($enforce) {
json_error('Signed requests require a registered device', 401);
}
return;
}
// 5. Verify using constant-time comparison (prevents timing attacks)
if (!Security::verifySignature($payload, $signature, $secret)) {
error_log("HMAC verification failed for " . ($_SERVER['REQUEST_URI'] ?? ''));
json_error('Invalid request signature', 401);
$secret = self::deviceSecret((string)$userId, (string)$deviceId);
if ($secret === null) {
if ($enforce) {
json_error('Unknown device. Please sign in again.', 401);
}
return;
}
// 5. Rebuild the signing payload exactly as the client does.
$method = strtoupper($_SERVER['REQUEST_METHOD'] ?? 'GET');
$body = file_get_contents('php://input');
// index.php accepts both clean URLs (/api/v1/batches/create) and the
// ?route=v1/batches/create form, which produce different REQUEST_URIs for
// the same endpoint. Accept either so the signature does not depend on
// how the deployment happens to rewrite URLs.
$paths = array_unique(array_filter([
self::requestPath(),
self::normalisePath((string)($_GET['route'] ?? '')),
]));
$candidates = [];
foreach ($paths as $path) {
if ($body !== '' && $body !== false) {
$candidates[] = "{$method}:{$path}:{$timestamp}:{$body}";
}
// GET/multipart requests sign without a body.
$candidates[] = "{$method}:{$path}:{$timestamp}";
}
foreach ($candidates as $payload) {
$expected = hash_hmac('sha256', $payload, $secret);
if (hash_equals($expected, strtolower($signature))) {
return; // Verified.
}
}
error_log('HMAC verification failed for ' . ($_SERVER['REQUEST_URI'] ?? ''));
json_error('Invalid request signature', 401);
}
/**
* The path the client signed. Dio signs options.path, i.e. the endpoint
* relative to the API base URL ("batches/finalize"), without a query string.
*/
private static function requestPath(): string
{
$uri = parse_url($_SERVER['REQUEST_URI'] ?? '', PHP_URL_PATH) ?: '';
return self::normalisePath($uri);
}
/**
* Strip the leading slash and any deployment prefix so the signed value
* matches what the client hashed.
*/
private static function normalisePath(string $raw): string
{
$path = ltrim(trim($raw), '/');
foreach (['api/v1/', 'api/', 'v1/'] as $prefix) {
if (str_starts_with($path, $prefix)) {
$path = substr($path, strlen($prefix));
break;
}
}
return $path;
}
/**
* Decrypt the stored per-device secret, or null if the device is unknown.
*/
private static function deviceSecret(string $userId, string $deviceId): ?string
{
try {
$db = Database::getInstance();
$stmt = $db->prepare("
SELECT device_secret FROM user_devices
WHERE user_id = ? AND device_fingerprint = ? AND is_trusted = 1
LIMIT 1
");
$stmt->execute([$userId, $deviceId]);
$stored = $stmt->fetchColumn();
if (!$stored) {
return null;
}
// Legacy rows hold a bcrypt hash, which is one-way and therefore
// unusable for HMAC. Treat those devices as un-signable until the
// user logs in again on the new build.
if (str_starts_with((string)$stored, '$2y$') || str_starts_with((string)$stored, '$2a$')) {
return null;
}
$plain = Encryption::decrypt((string)$stored);
return $plain === false ? null : $plain;
} catch (\Throwable $e) {
error_log('[HmacMiddleware] device secret lookup failed: ' . $e->getMessage());
return null;
}
}
}
app/middleware/QuotaMiddleware.php
+48 -6
View File
@@ -21,14 +21,16 @@ final class QuotaMiddleware
*
* @return array The current subscription data (for UI display)
*/
public static function checkInvoiceQuota(string $tenantId): array
public static function checkInvoiceQuota(string $tenantId, int $needed = 1): array
{
$cacheKey = "quota_sub_{$tenantId}";
$sub = Cache::get($cacheKey);
if ($sub === false || $sub === null) {
$db = Database::getInstance();
// $db is needed by the auto-reset branch below regardless of whether the
// subscription came from the cache, so resolve it unconditionally.
$db = Database::getInstance();
if ($sub === false || $sub === null) {
// Fetch subscription with plan info
$stmt = $db->prepare("
SELECT s.*, sp.name_ar as plan_name, sp.ai_features, sp.jofotara_enabled, sp.price_monthly_jod, sp.price_annual_jod
@@ -78,18 +80,30 @@ final class QuotaMiddleware
$sub['current_period_start'] = $newStart;
$sub['current_period_end'] = $newEnd;
// The cached copy still holds the pre-reset counters.
Cache::delete($cacheKey);
error_log("QuotaMiddleware: Auto-reset annual counter for tenant {$tenantId}");
}
// Check invoice quota
// Check invoice quota. $needed lets callers reserve a whole batch at once
// instead of only asking "is there room for one more?".
$used = (int)$sub['invoices_used_this_month'];
$limit = (int)$sub['max_invoices_per_month']; // Keeping the DB column name the same for compatibility
$needed = max(1, $needed);
if ($used >= $limit) {
json_error('لقد وصلت للحد الأقصى من الفواتير المسموحة في باقتك الحالية (' . $limit . ' فاتورة). يرجى ترقية باقتك للاستمرار.', 429, [
if (($used + $needed) > $limit) {
$remaining = max(0, $limit - $used);
$message = $remaining === 0
? 'لقد وصلت للحد الأقصى من الفواتير المسموحة في باقتك الحالية (' . $limit . ' فاتورة). يرجى ترقية باقتك للاستمرار.'
: 'رصيدك المتبقي ' . $remaining . ' فاتورة فقط، وقد طلبت ' . $needed . '. يرجى تقليل عدد الفواتير أو ترقية باقتك.';
json_error($message, 429, [
'quota_type' => 'invoices',
'used' => $used,
'limit' => $limit,
'requested' => $needed,
'remaining' => $remaining,
'plan' => $sub['plan_id'] ?? 'free',
'plan_name' => $sub['plan_name'] ?? 'مجانية',
'period_end' => $sub['current_period_end'],
@@ -99,6 +113,34 @@ final class QuotaMiddleware
return $sub;
}
/**
* Non-fatal variant of checkInvoiceQuota() for background workers.
*
* Workers must never emit an HTTP response, so this returns a boolean
* instead of calling json_error().
*/
public static function hasInvoiceQuota(string $tenantId, int $needed = 1): bool
{
try {
$db = Database::getInstance();
$stmt = $db->prepare("
SELECT invoices_used_this_month, max_invoices_per_month, status
FROM subscriptions WHERE tenant_id = ?
");
$stmt->execute([$tenantId]);
$sub = $stmt->fetch();
if (!$sub) return false;
if (in_array($sub['status'], ['cancelled', 'past_due'], true)) return false;
return ((int)$sub['invoices_used_this_month'] + max(1, $needed))
<= (int)$sub['max_invoices_per_month'];
} catch (\Throwable $e) {
error_log('[QuotaMiddleware] hasInvoiceQuota failed: ' . $e->getMessage());
return false;
}
}
/**
* Increment the monthly invoice counter after a successful upload.
*/
app/modules_app/auth/login.php
+29 -5
View File
@@ -40,7 +40,12 @@ if (!$user || !password_verify($password, $user['password_hash'])) {
}
$deviceId = $data['device_id'] ?? null;
$isReviewer = (strtolower($email) === 'reviewer@musadaq.jo');
// App-store reviewer account skips the WhatsApp OTP step (reviewers have no
// access to the registered phone). Configured via .env so the exception is not
// baked into the source, and disabled entirely when the var is unset.
$reviewerEmail = strtolower(trim((string)env('REVIEWER_EMAIL', '')));
$isReviewer = $reviewerEmail !== '' && strtolower($email) === $reviewerEmail;
if ($deviceId && !$isReviewer) {
// Generate and send WhatsApp OTP
@@ -127,7 +132,9 @@ if ($deviceId) {
$deviceName,
$data['platform'] ?? 'web',
$data['app_version'] ?? '1.0.0',
password_hash($deviceSecret, PASSWORD_DEFAULT),
// Stored encrypted, NOT bcrypt-hashed: the server must be able to
// recompute the client's HMAC signature from this same secret.
\App\Core\Encryption::encrypt($deviceSecret),
]);
}
@@ -152,11 +159,28 @@ $payload = [
$token = JWT::encode($payload, $secret);
// 5. Update Refresh Token (Hashed before storage for security)
// 5. Issue Refresh Token (hashed before storage).
//
// Mobile tokens are stored PER DEVICE. users.refresh_token_hash is a single
// column, so writing there logged the user out of every other device silently.
$refreshToken = bin2hex(random_bytes(32));
$refreshTokenHash = hash('sha256', $refreshToken);
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = ?, last_login_at = NOW() WHERE id = ?");
$stmt->execute([$refreshTokenHash, $user['id']]);
$refreshTtlDays = $deviceId ? 60 : 7;
$refreshExpiresAt = date('Y-m-d H:i:s', time() + ($refreshTtlDays * 24 * 3600));
if ($deviceId) {
$stmt = $db->prepare("
UPDATE user_devices
SET refresh_token_hash = ?, refresh_expires_at = ?, last_seen_at = NOW()
WHERE user_id = ? AND device_fingerprint = ?
");
$stmt->execute([$refreshTokenHash, $refreshExpiresAt, $user['id'], $deviceId]);
$db->prepare("UPDATE users SET last_login_at = NOW() WHERE id = ?")->execute([$user['id']]);
} else {
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = ?, last_login_at = NOW() WHERE id = ?");
$stmt->execute([$refreshTokenHash, $user['id']]);
}
// 6. Secure Refresh Token delivery via HttpOnly Cookie (for web)
if (!$deviceId) {
app/modules_app/auth/logout.php
+20 -3
View File
@@ -10,9 +10,26 @@ use App\Middleware\AuthMiddleware;
$decoded = AuthMiddleware::check();
$userId = $decoded['user_id'];
// 2. Invalidate Refresh Token
// 2. Invalidate the refresh token.
// A mobile logout must only sign THIS device out - clearing the shared user
// column would drop every other device the user owns.
$db = Database::getInstance();
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
$stmt->execute([$userId]);
$deviceId = $decoded['device_id'] ?? null;
if ($deviceId) {
$stmt = $db->prepare("
UPDATE user_devices
SET refresh_token_hash = NULL,
refresh_expires_at = NULL,
push_token = NULL,
live_activity_token = NULL,
is_trusted = 0
WHERE user_id = ? AND device_fingerprint = ?
");
$stmt->execute([$userId, $deviceId]);
} else {
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = NULL WHERE id = ?");
$stmt->execute([$userId]);
}
json_success(null, 'تم تسجيل الخروج بنجاح');
app/modules_app/auth/mobile_request_otp.php
+10 -5
View File
@@ -64,8 +64,12 @@ try {
exit;
}
// A disabled account must produce the SAME answer as an unknown number,
// otherwise this endpoint tells an attacker which phones are registered.
if (!$user['is_active']) {
json_error('الحساب معطّل. تواصل مع المسؤول.', 403);
error_log("OTP request for disabled account: user {$user['id']}");
json_success(null, 'إذا كان الرقم مسجلاً، سيتم إرسال رمز التحقق');
exit;
}
// 3. Generate OTP (6 digits)
@@ -102,16 +106,17 @@ try {
$result = $whatsappService->sendMessage($phone, $message);
if (!$result['success']) {
error_log("ERROR: Failed to send OTP WhatsApp to phone: {$phone}");
json_error('عذراً، فشل في إرسال رمز التحقق. الرجاء التأكد من صحة رقم الواتساب الخاص بك والمحاولة مرة أخرى.', 500, ['whatsapp_debug' => $result]);
// Internal provider details stay in the log, not in the HTTP response.
error_log("ERROR: Failed to send OTP WhatsApp to phone: {$phone} - " . json_encode($result));
json_error('عذراً، فشل في إرسال رمز التحقق. الرجاء التأكد من صحة رقم الواتساب الخاص بك والمحاولة مرة أخرى.', 500);
}
// Log for development (REMOVE IN PRODUCTION!)
// Development only - never reached when APP_DEBUG is false.
if (env('APP_DEBUG', 'false') === 'true') {
error_log("DEV OTP for {$phone}: {$otp}");
}
json_success(['whatsapp_debug' => $result], 'إذا كان الرقم مسجلاً، سيتم إرسال رمز التحقق عبر واتساب');
json_success(null, 'إذا كان الرقم مسجلاً، سيتم إرسال رمز التحقق عبر واتساب');
} catch (\Exception $e) {
safe_error($e, 'auth/mobile_request_otp');
app/modules_app/auth/mobile_verify_otp.php
+15 -4
View File
@@ -132,7 +132,9 @@ $stmt->execute([
$platform,
$appVersion,
$pushToken,
password_hash($deviceSecret, PASSWORD_DEFAULT), // Store hashed
// Stored encrypted (reversible), not bcrypt-hashed: HmacMiddleware has to
// recompute the same signature the client produced from this secret.
\App\Core\Encryption::encrypt($deviceSecret),
]);
// 6. Generate JWT (30 days for mobile)
@@ -153,11 +155,20 @@ $payload = [
$token = JWT::encode($payload, $secret);
// 7. Generate refresh token
// 7. Generate refresh token, stored against THIS device so signing in on a
// second phone does not silently invalidate the first one.
$refreshToken = bin2hex(random_bytes(32));
$refreshTokenHash = hash('sha256', $refreshToken);
$stmt = $db->prepare("UPDATE users SET refresh_token_hash = ?, last_login_at = NOW() WHERE id = ?");
$stmt->execute([$refreshTokenHash, $userId]);
$refreshExpiresAt = date('Y-m-d H:i:s', time() + (60 * 24 * 3600)); // 60 days
$stmt = $db->prepare("
UPDATE user_devices
SET refresh_token_hash = ?, refresh_expires_at = ?, last_seen_at = NOW()
WHERE user_id = ? AND device_fingerprint = ?
");
$stmt->execute([$refreshTokenHash, $refreshExpiresAt, $userId, $deviceId]);
$db->prepare("UPDATE users SET last_login_at = NOW() WHERE id = ?")->execute([$userId]);
// 8. Decrypt name for response
$userName = $user['name'];
app/modules_app/auth/refresh.php
+90 -16
View File
@@ -1,13 +1,30 @@
<?php
/**
* Refresh Token Endpoint (Secure Cookie Based)
* Refresh Token Endpoint
*
* Two callers, two transports:
* - Web: HttpOnly cookie, token stored on users.refresh_token_hash
* - Mobile: JSON body {refresh_token, device_id}, token stored per device on
* user_devices.refresh_token_hash
*
* The mobile path used to be missing entirely (cookies only), so the app had no
* way to refresh and simply started failing with 401s once the JWT aged out.
*/
use App\Core\Database;
use Firebase\JWT\JWT;
declare(strict_types=1);
// 1. Get Refresh Token from HttpOnly Cookie
$refreshToken = $_COOKIE['refresh_token'] ?? null;
use App\Core\Database;
use App\Core\JWT;
use App\Core\Security;
use App\Middleware\RateLimitMiddleware;
// Refresh is unauthenticated by design, so rate limit it.
RateLimitMiddleware::check(20, 60);
$data = Security::sanitize(input());
$refreshToken = $_COOKIE['refresh_token'] ?? ($data['refresh_token'] ?? null);
$deviceId = $data['device_id'] ?? null;
if (!$refreshToken) {
json_error('Refresh token is required', 401);
@@ -16,30 +33,87 @@ if (!$refreshToken) {
$db = Database::getInstance();
$refreshTokenHash = hash('sha256', $refreshToken);
// 2. Verify in DB
$stmt = $db->prepare("SELECT * FROM users WHERE refresh_token_hash = ? AND is_active = 1 LIMIT 1");
$stmt->execute([$refreshTokenHash]);
$user = $stmt->fetch();
$user = null;
$isMobile = false;
// 1. Mobile: per-device lookup.
if ($deviceId) {
$stmt = $db->prepare("
SELECT u.*, d.device_fingerprint, d.refresh_expires_at
FROM user_devices d
JOIN users u ON u.id = d.user_id
WHERE d.refresh_token_hash = ?
AND d.device_fingerprint = ?
AND d.is_trusted = 1
AND u.is_active = 1
LIMIT 1
");
$stmt->execute([$refreshTokenHash, $deviceId]);
$user = $stmt->fetch();
if ($user) {
$isMobile = true;
if (!empty($user['refresh_expires_at']) && strtotime($user['refresh_expires_at']) < time()) {
json_error('انتهت صلاحية الجلسة. يرجى تسجيل الدخول من جديد.', 401);
}
}
}
// 2. Web: single-column lookup.
if (!$user) {
$stmt = $db->prepare("SELECT * FROM users WHERE refresh_token_hash = ? AND is_active = 1 LIMIT 1");
$stmt->execute([$refreshTokenHash]);
$user = $stmt->fetch();
}
if (!$user) {
json_error('Invalid refresh token', 401);
}
// 3. Generate New Access Token
$secret = $_ENV['JWT_SECRET'] ?? null;
if (!$secret) {
// 3. Generate a new access token.
$secret = env('JWT_SECRET');
if (!$secret || strlen($secret) < 32) {
error_log('FATAL: JWT_SECRET is missing or too short in .env');
json_error('Server configuration error', 500);
}
$payload = [
'user_id' => $user['id'],
'tenant_id' => $user['tenant_id'], // Now including tenant_id
'tenant_id' => $user['tenant_id'],
'role' => $user['role'],
'exp' => time() + (15 * 60) // 15 minutes
'device_id' => $isMobile ? $deviceId : null,
'source' => $isMobile ? 'mobile' : 'web',
'exp' => time() + ($isMobile ? (30 * 24 * 3600) : (15 * 60)),
];
$token = JWT::encode($payload, $secret, 'HS256');
$token = JWT::encode($payload, $secret);
// 4. Rotate the refresh token so a leaked one cannot be replayed indefinitely.
$newRefreshToken = bin2hex(random_bytes(32));
$newHash = hash('sha256', $newRefreshToken);
if ($isMobile) {
$expiresAt = date('Y-m-d H:i:s', time() + (60 * 24 * 3600));
$db->prepare("
UPDATE user_devices
SET refresh_token_hash = ?, refresh_expires_at = ?, last_seen_at = NOW()
WHERE user_id = ? AND device_fingerprint = ?
")->execute([$newHash, $expiresAt, $user['id'], $deviceId]);
} else {
$db->prepare("UPDATE users SET refresh_token_hash = ? WHERE id = ?")
->execute([$newHash, $user['id']]);
setcookie('refresh_token', $newRefreshToken, [
'expires' => time() + (7 * 24 * 60 * 60),
'path' => '/api/v1/auth/refresh',
'secure' => true,
'httponly' => true,
'samesite' => 'Strict',
]);
}
json_success([
'access_token' => $token
'access_token' => $token,
// Web keeps receiving it via the HttpOnly cookie only.
'refresh_token' => $isMobile ? $newRefreshToken : null,
]);
app/modules_app/auth/register_device.php
+8
View File
@@ -32,6 +32,14 @@ if (isset($data['push_token'])) {
$params[] = $data['push_token'];
}
// ActivityKit push token for the currently running Live Activity (iOS).
// This is a DIFFERENT token from the FCM registration token above: APNs
// liveactivity pushes must target this one specifically.
if (isset($data['live_activity_token'])) {
$updateFields[] = 'live_activity_token = ?';
$params[] = $data['live_activity_token'];
}
if (isset($data['app_version'])) {
$updateFields[] = 'app_version = ?';
$params[] = $data['app_version'];
app/modules_app/batches/create.php
+13 -10
View File
@@ -32,7 +32,9 @@ if ($errors) {
$companyId = $data['company_id'];
$source = $data['source'] ?? 'mobile_scan';
$expectedImages = (int)($data['expected_images'] ?? 0);
// The mobile client sends 'total_images'; older/web callers send 'expected_images'.
// Accept both so the expected count is never silently zero.
$expectedImages = (int)($data['expected_images'] ?? $data['total_images'] ?? 0);
// 2. Permission check
$db = Database::getInstance();
@@ -52,24 +54,25 @@ if ($decoded['role'] !== 'super_admin' && $company['tenant_id'] !== $tenantId) {
// Use the actual tenant of the company
$targetTenantId = $company['tenant_id'];
// 3. Check quota (preview — don't increment yet)
// 3. Reserve quota for the WHOLE batch up front, not just one invoice.
// checkInvoiceQuota() responds and exits by itself when there is no room, so the
// old try/catch wrapper never actually caught anything.
if ($decoded['role'] !== 'super_admin') {
try {
QuotaMiddleware::checkInvoiceQuota($targetTenantId);
} catch (\Exception $e) {
json_error('تم استنفاد رصيد الفواتير لهذا الشهر. قم بترقية باقتك.', 429);
}
QuotaMiddleware::checkInvoiceQuota($targetTenantId, max(1, $expectedImages));
}
// 4. Generate batch ID
$batchId = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4));
// 5. Create batch record
// 5. Create batch record.
// total_images starts at 0 and is incremented by upload-image for each file that
// actually lands. Seeding it with the client's expected count here would double
// count and break the (processed + failed) >= total completion check.
$stmt = $db->prepare("
INSERT INTO invoice_batches (id, tenant_id, company_id, uploaded_by, total_images, source, status)
VALUES (?, ?, ?, ?, ?, ?, 'uploading')
VALUES (?, ?, ?, ?, 0, ?, 'uploading')
");
$stmt->execute([$batchId, $targetTenantId, $companyId, $userId, $expectedImages, $source]);
$stmt->execute([$batchId, $targetTenantId, $companyId, $userId, $source]);
// 6. Create upload directory
$uploadDir = STORAGE_PATH . '/invoices/' . $targetTenantId . '/' . $companyId . '/batches/' . $batchId;
app/modules_app/batches/finalize.php
+24 -6
View File
@@ -48,14 +48,19 @@ if ($batch['total_images'] == 0) {
json_error('لا يمكن إنهاء دفعة فارغة', 400);
}
// 2. Mark as processing
// 2. Mark as processing - atomically, so two concurrent finalize calls cannot
// both start a background worker for the same batch.
$stmt = $db->prepare("
UPDATE invoice_batches
SET status = 'processing', updated_at = NOW()
WHERE id = ?
UPDATE invoice_batches
SET status = 'processing', updated_at = NOW()
WHERE id = ? AND status = 'uploading'
");
$stmt->execute([$batchId]);
if ($stmt->rowCount() !== 1) {
json_error('تم إنهاء هذه الدفعة مسبقاً', 400);
}
// 3. Send response IMMEDIATELY to mobile app
// We manually build the response instead of using json_success() because it calls exit()
$responsePayload = json_encode([
@@ -117,7 +122,16 @@ $bgLog = function(string $msg) {
$bgLog("Background processing started for batch: $batchId");
try {
$queueStmt = $db->prepare("SELECT id FROM invoice_processing_queue WHERE batch_id = ? AND status = 'pending' ORDER BY created_at ASC");
// processQueueItem() claims each row atomically, so it is safe for the cron
// worker to be walking the same batch at the same time - whoever claims a row
// first owns it and the other simply skips it.
$queueStmt = $db->prepare("
SELECT id FROM invoice_processing_queue
WHERE batch_id = ?
AND status = 'pending'
AND attempts < COALESCE(max_attempts, 3)
ORDER BY image_order ASC, created_at ASC
");
$queueStmt->execute([$batchId]);
$items = $queueStmt->fetchAll(\PDO::FETCH_COLUMN);
@@ -127,12 +141,16 @@ try {
$bgLog("Processing queue item: $queueId");
try {
$success = InvoiceProcessor::processQueueItem((int)$queueId);
$bgLog("Queue item $queueId: " . ($success ? "SUCCESS" : "FAILED"));
$bgLog("Queue item $queueId: " . ($success ? "SUCCESS" : "FAILED/SKIPPED"));
} catch (\Throwable $e) {
$bgLog("Queue item $queueId EXCEPTION: " . $e->getMessage());
}
}
// Final sweep: if every item ended up terminal, close the batch here rather
// than waiting up to a minute for the cron to notice.
InvoiceProcessor::checkBatchCompletion($batchId);
$bgLog("Background processing finished for batch: $batchId");
} catch (\Throwable $e) {
app/modules_app/batches/process_worker.php
-38
View File
@@ -1,38 +0,0 @@
<?php
/**
* Background Worker Trigger (HTTP)
* POST /api/v1/batches/process-worker
*
* This endpoint is triggered by finalize.php to start processing in the background.
*/
declare(strict_types=1);
require_once __DIR__ . '/../../../bootstrap/init.php';
use App\Services\InvoiceProcessor;
use App\Core\Database;
// 1. Ignore user abort and set no time limit
ignore_user_abort(true);
set_time_limit(0);
// 2. Get batch ID
$data = json_decode(file_get_contents('php://input'), true);
$batchId = $data['batch_id'] ?? null;
if (!$batchId) {
exit('No batch ID');
}
// 3. Process all pending items for this batch
$db = Database::getInstance();
$stmt = $db->prepare("SELECT id FROM invoice_processing_queue WHERE batch_id = ? AND status = 'pending'");
$stmt->execute([$batchId]);
$items = $stmt->fetchAll();
foreach ($items as $item) {
InvoiceProcessor::processQueueItem((int)$item['id']);
}
echo "Done";
app/modules_app/batches/status.php
+10 -4
View File
@@ -40,15 +40,21 @@ if (!$batch || ($decoded['role'] !== 'super_admin' && $batch['tenant_id'] !== $t
// 2. Get items
$stmt = $db->prepare("
SELECT id, invoice_id, image_order, status, error_message, created_at, processed_at
SELECT id, invoice_id, image_order, status, attempts, max_attempts, error_message, created_at, processed_at
FROM invoice_processing_queue
WHERE batch_id = ?
ORDER BY image_order ASC
ORDER BY image_order ASC, id ASC
");
$stmt->execute([$batchId]);
$items = $stmt->fetchAll();
// 3. Tell the client explicitly whether it should keep polling. Without this the
// app polled forever whenever a batch ended in anything other than 'done'.
$isTerminal = in_array($batch['status'], ['done', 'partial_fail', 'failed'], true);
json_success([
'batch' => $batch,
'items' => $items
'batch' => $batch,
'items' => $items,
'is_terminal' => $isTerminal,
'should_poll' => !$isTerminal,
], 'تم جلب حالة الدفعة');
app/modules_app/batches/upload_image.php
+28 -7
View File
@@ -18,7 +18,9 @@ $userId = $decoded['user_id'];
// 1. Validate request
$batchId = $_POST['batch_id'] ?? null;
$imageOrder = (int)($_POST['image_order'] ?? 0);
// The mobile client sends 'order_index'; accept both spellings so every image
// does not end up with order 0 (which also made every saved file img_000_*).
$imageOrder = (int)($_POST['image_order'] ?? $_POST['order_index'] ?? 0);
if (!$batchId || !isset($_FILES['image']) || $_FILES['image']['error'] !== UPLOAD_ERR_OK) {
$uploadError = $_FILES['image']['error'] ?? 'No file';
@@ -46,11 +48,20 @@ if ($batch['status'] !== 'uploading') {
json_error('لا يمكن إضافة صور لدفعة تمت معالجتها', 400);
}
// 3. Validate file type
$allowedTypes = ['image/jpeg', 'image/png', 'image/webp', 'image/heic', 'image/heif', 'application/pdf'];
$mimeType = $_FILES['image']['type'];
if (!in_array($mimeType, $allowedTypes)) {
json_error('نوع الملف غير مدعوم. المسموح: صور و PDF', 422);
// 3. Validate file type.
// Sniff the real type off the temp file - $_FILES[...]['type'] is supplied by the
// client and can claim anything.
$allowedTypes = [
'image/jpeg' => 'jpg',
'image/png' => 'png',
'image/webp' => 'webp',
'image/heic' => 'heic',
'image/heif' => 'heif',
'application/pdf' => 'pdf',
];
$mimeType = @mime_content_type($_FILES['image']['tmp_name']) ?: '';
if (!isset($allowedTypes[$mimeType])) {
json_error('نوع الملف غير مدعوم. المسموح: صور (JPG, PNG, WEBP, HEIC) و PDF', 422);
}
// 4. Validate file size (max 10MB)
@@ -59,6 +70,16 @@ if ($_FILES['image']['size'] > $maxSize) {
json_error('حجم الصورة أكبر من 10 ميغابايت', 422);
}
// 4b. Enforce quota per image, not just once per batch. Checking only at
// batches/create let a 50-image batch through on a single remaining credit.
$queuedStmt = $db->prepare("SELECT COUNT(*) FROM invoice_processing_queue WHERE batch_id = ?");
$queuedStmt->execute([$batchId]);
$alreadyQueued = (int)$queuedStmt->fetchColumn();
if ($decoded['role'] !== 'super_admin') {
\App\Middleware\QuotaMiddleware::checkInvoiceQuota($tenantId, $alreadyQueued + 1);
}
// 5. Save file
$companyId = $batch['company_id'];
$uploadDir = STORAGE_PATH . '/invoices/' . $tenantId . '/' . $companyId . '/batches/' . $batchId;
@@ -66,7 +87,7 @@ if (!is_dir($uploadDir)) {
mkdir($uploadDir, 0755, true);
}
$extension = pathinfo($_FILES['image']['name'], PATHINFO_EXTENSION) ?: 'jpg';
$extension = $allowedTypes[$mimeType];
$fileName = sprintf('img_%03d_%s.%s', $imageOrder, bin2hex(random_bytes(4)), $extension);
$targetPath = $uploadDir . '/' . $fileName;
app/modules_app/invoices/upload.php
+38 -5
View File
@@ -84,7 +84,31 @@ try {
}
}
$extension = pathinfo($_FILES['invoice']['name'], PATHINFO_EXTENSION);
// 4a. Validate the file BEFORE storing it. The client-supplied
// $_FILES['invoice']['type'] is attacker-controlled, so sniff the real type
// off the temp file and derive the extension from that, never from the name.
$allowedMimeTypes = [
'image/jpeg' => 'jpg',
'image/png' => 'png',
'image/webp' => 'webp',
'image/heic' => 'heic',
'image/heif' => 'heif',
'application/pdf' => 'pdf',
];
$maxSize = 10 * 1024 * 1024; // 10MB
if ($_FILES['invoice']['size'] > $maxSize) {
json_error('حجم الملف أكبر من 10 ميغابايت', 422);
exit;
}
$detectedMime = @mime_content_type($_FILES['invoice']['tmp_name']) ?: '';
if (!isset($allowedMimeTypes[$detectedMime])) {
json_error('نوع الملف غير مدعوم. المسموح: صور (JPG, PNG, WEBP, HEIC) و PDF', 422);
exit;
}
$extension = $allowedMimeTypes[$detectedMime];
$fileName = bin2hex(random_bytes(8)) . '_' . time() . '.' . $extension;
$targetFile = $uploadDir . $fileName;
@@ -94,13 +118,17 @@ try {
}
// 5. Run AI Extraction
$mimeType = $_FILES['invoice']['type'];
$mimeType = $detectedMime;
$fileContent = file_get_contents($targetFile);
$base64Data = base64_encode($fileContent);
$extracted = AI::extractInvoiceData($base64Data, $mimeType);
// extractInvoices() returns EVERY invoice in the image. extractInvoiceData()
// silently kept only the first, so a photo holding two receipts lost one.
AI::setTenantContext($tenantId);
$extractedInvoices = AI::extractInvoices($base64Data, $mimeType);
AI::setTenantContext(null);
if (!$extracted) {
if (empty($extractedInvoices)) {
$invoiceId = vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex(random_bytes(16)), 4));
$stmt = $db->prepare("
INSERT INTO invoices (
@@ -115,9 +143,14 @@ try {
}
// 6. Save Extracted Data
// Multiple invoices in one image each consume a credit, so make sure the
// tenant can actually cover the whole set before writing any of them.
if ($decoded['role'] !== 'super_admin' && count($extractedInvoices) > 1) {
QuotaMiddleware::checkInvoiceQuota($tenantId, count($extractedInvoices));
}
$db->beginTransaction();
$extractedInvoices = $extracted['invoices'] ?? [$extracted];
$savedIds = [];
foreach ($extractedInvoices as $inv) {
app/modules_app/users/create.php
+12 -3
View File
@@ -88,16 +88,25 @@ try {
date('Y-m-d H:i:s')
]);
json_success(null, 'تم إضافة المستخدم بنجاح');
// Audit BEFORE responding: json_success() calls exit(), so anything after it
// never ran and user creation was never recorded in the audit log.
AuditLogger::log('user.created', 'user', null, null, [
'name' => $data['name'],
'email' => $data['email'],
'role' => $data['role'],
], $decoded);
json_success(null, 'تم إضافة المستخدم بنجاح');
} catch (\Exception $e) {
if (str_contains($e->getMessage(), 'Duplicate entry')) {
$msg = $e->getMessage();
if (str_contains($msg, 'Duplicate entry')) {
// Say which field actually collided - reporting "email" for a duplicate
// phone sent admins hunting for the wrong problem.
if (str_contains($msg, 'phone')) {
json_error('رقم الهاتف مسجل مسبقاً لمستخدم آخر', 409);
}
json_error('البريد الإلكتروني مسجل مسبقاً', 409);
}
error_log('[users/create] ' . $msg);
json_error('حدث خطأ أثناء حفظ البيانات', 500);
}