Update: 2026-07-30 02:27:45

app/modules_app/auth/mobile_verify_otp.php

@@ -132,7 +132,9 @@ $stmt->execute([
     $platform,
     $appVersion,
     $pushToken,
-    password_hash($deviceSecret, PASSWORD_DEFAULT), // Store hashed
+    // Stored encrypted (reversible), not bcrypt-hashed: HmacMiddleware has to
+    // recompute the same signature the client produced from this secret.
+    \App\Core\Encryption::encrypt($deviceSecret),
 ]);
 
 // 6. Generate JWT (30 days for mobile)
@@ -153,11 +155,20 @@ $payload = [
 
 $token = JWT::encode($payload, $secret);
 
-// 7. Generate refresh token
+// 7. Generate refresh token, stored against THIS device so signing in on a
+// second phone does not silently invalidate the first one.
 $refreshToken = bin2hex(random_bytes(32));
 $refreshTokenHash = hash('sha256', $refreshToken);
-$stmt = $db->prepare("UPDATE users SET refresh_token_hash = ?, last_login_at = NOW() WHERE id = ?");
-$stmt->execute([$refreshTokenHash, $userId]);
+$refreshExpiresAt = date('Y-m-d H:i:s', time() + (60 * 24 * 3600)); // 60 days
+
+$stmt = $db->prepare("
+    UPDATE user_devices
+    SET refresh_token_hash = ?, refresh_expires_at = ?, last_seen_at = NOW()
+    WHERE user_id = ? AND device_fingerprint = ?
+");
+$stmt->execute([$refreshTokenHash, $refreshExpiresAt, $userId, $deviceId]);
+
+$db->prepare("UPDATE users SET last_login_at = NOW() WHERE id = ?")->execute([$userId]);
 
 // 8. Decrypt name for response
 $userName = $user['name'];