Update: 2026-05-04 02:24:10

app/core/AI.php

@@ -23,13 +23,14 @@ class AI
         $prompt = "You are an expert in Jordanian E-Invoicing (UBL 2.1). 
         Extract all data from this invoice image/document into a JSON format.
         
-        Strict Rules:
+        CRITICAL RULES:
-        1. Ensure numeric values are numbers, not strings.
+        1. DO NOT TRANSLATE ANY TEXT. Keep the exact original language (if Arabic, keep Arabic).
-        2. Identify the Supplier TIN (Tax Identification Number) and Buyer TIN (if present).
+        2. ALL numbers and quantities MUST be in Latin numerals (0-9). Do not use Arabic/Indic numerals (٠-٩).
-        3. Identify if the invoice is 'Cash' or 'Credit'.
+        3. Identify the Supplier TIN (Tax Identification Number) and Buyer TIN (if present).
-        4. Identify if it is 'Simplified' (B2C) or 'Standard' (B2B).
+        4. Identify if the invoice is 'Cash' or 'Credit'.
-        5. Extract line items precisely.
+        5. Identify if it is 'Simplified' (B2C) or 'Standard' (B2B).
-        6. Return ONLY valid JSON, no markdown formatting.
+        6. Extract line items precisely.
+        7. Return ONLY valid JSON, no markdown formatting.
         
         Required JSON Structure:
         {

app/modules_app/invoices/file.php

@@ -6,7 +6,22 @@
 use App\Core\Database;
 use App\Middleware\AuthMiddleware;
 
-$decoded = AuthMiddleware::check();
+// Extract token from header OR query string
+$headers = getallheaders();
+$authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? '';
+$token = '';
+
+if (preg_match('/Bearer\s(\S+)/', $authHeader, $matches)) {
+    $token = $matches[1];
+} elseif (isset($_GET['token'])) {
+    $token = $_GET['token'];
+}
+
+if (!$token) die('Forbidden: No token provided');
+
+$decoded = \App\Core\JWT::decode($token);
+if (!$decoded) die('Forbidden: Invalid token');
+
 $db = Database::getInstance();
 
 $id = input('id');

public/shell.php

@@ -145,14 +145,14 @@
                 <div class="w-1/2 bg-black/40 border-l border-gray-800 flex flex-col relative">
                     <div class="p-4 border-b border-gray-800 flex justify-between items-center bg-gray-950/50">
                         <span class="text-xs font-bold text-gray-500 uppercase tracking-widest">معاينة المستند الأصلي</span>
-                        <a :href="currentInvoice?.file_url" target="_blank" class="text-[10px] bg-gray-800 px-3 py-1 rounded hover:bg-gray-700 transition">تحميل الملف 📥</a>
+                        <a :href="currentInvoice?.file_url + '&token=' + token()" target="_blank" class="text-[10px] bg-gray-800 px-3 py-1 rounded hover:bg-gray-700 transition">تحميل الملف 📥</a>
                     </div>
                     <div class="flex-1 overflow-auto p-4 flex items-start justify-center scrollbar-hide">
                         <template x-if="currentInvoice?.original_file_path?.toLowerCase().endsWith('.pdf')">
-                            <iframe :src="currentInvoice?.file_url" class="w-full h-full rounded-lg" frameborder="0"></iframe>
+                            <iframe :src="currentInvoice?.file_url + '&token=' + token()" class="w-full h-full rounded-lg" frameborder="0"></iframe>
                         </template>
                         <template x-if="!currentInvoice?.original_file_path?.toLowerCase().endsWith('.pdf')">
-                            <img :src="currentInvoice?.file_url" @error="$el.src='https://placehold.co/600x800?text=Error+Loading+Image'" class="max-w-full rounded-lg shadow-2xl border border-white/5">
+                            <img :src="currentInvoice?.file_url + '&token=' + token()" @error="$el.src='https://placehold.co/600x800?text=Error+Loading+Image'" class="max-w-full rounded-lg shadow-2xl border border-white/5">
                         </template>
                     </div>
                 </div>