fix: PSR-4 compliance — rename core/middleware/services to PascalCase for Linux server compatibility
This commit is contained in:
Hamza-Ayed
49
app/Middleware/AuthMiddleware.php
Normal file
49
app/Middleware/AuthMiddleware.php
Normal file
@@ -0,0 +1,49 @@
|
||||
<?php
|
||||
/**
|
||||
* Simple Authentication Middleware
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Middleware;
|
||||
|
||||
use App\Core\JWT;
|
||||
|
||||
final class AuthMiddleware
|
||||
{
|
||||
public static function check(): array
|
||||
{
|
||||
$headers = getallheaders();
|
||||
$authHeader = $headers['Authorization'] ?? $headers['authorization'] ?? '';
|
||||
|
||||
if (!str_starts_with($authHeader, 'Bearer ')) {
|
||||
json_error('Unauthorized: Missing or invalid token', 401);
|
||||
}
|
||||
|
||||
$token = substr($authHeader, 7);
|
||||
$secret = env('JWT_SECRET');
|
||||
|
||||
if (!$secret || strlen($secret) < 32) {
|
||||
error_log('FATAL: JWT_SECRET is missing or too short');
|
||||
json_error('Server configuration error', 500);
|
||||
}
|
||||
|
||||
$decoded = JWT::decode($token, $secret);
|
||||
|
||||
if (!$decoded) {
|
||||
// Check if it's specifically expired if your JWT class supports it,
|
||||
// otherwise just send the standard 401 with a code.
|
||||
http_response_code(401);
|
||||
header('Content-Type: application/json');
|
||||
echo json_encode([
|
||||
'success' => false,
|
||||
'message' => 'انتهت صلاحية الجلسة',
|
||||
'code' => 'TOKEN_EXPIRED',
|
||||
'redirect'=> '/login.php'
|
||||
]);
|
||||
exit;
|
||||
}
|
||||
|
||||
return $decoded;
|
||||
}
|
||||
}
|
||||
62
app/Middleware/HmacMiddleware.php
Normal file
62
app/Middleware/HmacMiddleware.php
Normal file
@@ -0,0 +1,62 @@
|
||||
<?php
|
||||
/**
|
||||
* HMAC Request Signature Middleware
|
||||
*
|
||||
* Verifies that incoming requests are signed with a shared secret,
|
||||
* preventing replay attacks and ensuring request integrity.
|
||||
*
|
||||
* Client must send:
|
||||
* X-Timestamp: Unix timestamp (seconds)
|
||||
* X-HMAC-Signature: HMAC-SHA256(timestamp + "." + raw_body, HMAC_SECRET_KEY)
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Middleware;
|
||||
|
||||
use App\Core\Security;
|
||||
|
||||
final class HmacMiddleware
|
||||
{
|
||||
/**
|
||||
* @param int $maxAgeSeconds Max age for replay attack window (default: 5 minutes)
|
||||
*/
|
||||
public static function verify(int $maxAgeSeconds = 300): void
|
||||
{
|
||||
$headers = getallheaders();
|
||||
$signature = $headers['X-HMAC-Signature'] ?? $headers['x-hmac-signature'] ?? '';
|
||||
$timestamp = $headers['X-Timestamp'] ?? $headers['x-timestamp'] ?? '';
|
||||
|
||||
// 1. Ensure both headers are present
|
||||
if (empty($signature) || empty($timestamp)) {
|
||||
json_error('Missing HMAC signature or timestamp', 401);
|
||||
}
|
||||
|
||||
// 2. Validate timestamp is numeric
|
||||
if (!ctype_digit((string)$timestamp)) {
|
||||
json_error('Invalid timestamp format', 401);
|
||||
}
|
||||
|
||||
// 3. Replay attack prevention — reject stale requests
|
||||
$age = abs(time() - (int)$timestamp);
|
||||
if ($age > $maxAgeSeconds) {
|
||||
json_error('Request expired. Check your system clock.', 401);
|
||||
}
|
||||
|
||||
// 4. Build the expected signature
|
||||
$body = file_get_contents('php://input');
|
||||
$payload = $timestamp . '.' . $body;
|
||||
$secret = env('HMAC_SECRET_KEY');
|
||||
|
||||
if (!$secret || strlen($secret) < 32) {
|
||||
error_log('FATAL: HMAC_SECRET_KEY is missing or too short in .env');
|
||||
json_error('Server configuration error', 500);
|
||||
}
|
||||
|
||||
// 5. Verify using constant-time comparison (prevents timing attacks)
|
||||
if (!Security::verifySignature($payload, $signature, $secret)) {
|
||||
error_log("HMAC verification failed for " . ($_SERVER['REQUEST_URI'] ?? ''));
|
||||
json_error('Invalid request signature', 401);
|
||||
}
|
||||
}
|
||||
}
|
||||
270
app/Middleware/QuotaMiddleware.php
Normal file
270
app/Middleware/QuotaMiddleware.php
Normal file
@@ -0,0 +1,270 @@
|
||||
<?php
|
||||
/**
|
||||
* Quota Enforcement Middleware
|
||||
*
|
||||
* Checks tenant subscription limits before allowing resource creation.
|
||||
* Automatically resets monthly counters when the billing period rolls over.
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Middleware;
|
||||
|
||||
use App\Core\Database;
|
||||
|
||||
final class QuotaMiddleware
|
||||
{
|
||||
/**
|
||||
* Check if the tenant can upload more invoices this month.
|
||||
* Automatically resets the counter if the billing period has ended.
|
||||
*
|
||||
* @return array The current subscription data (for UI display)
|
||||
*/
|
||||
public static function checkInvoiceQuota(string $tenantId): array
|
||||
{
|
||||
$db = Database::getInstance();
|
||||
|
||||
// Fetch subscription with plan info
|
||||
$stmt = $db->prepare("
|
||||
SELECT s.*, sp.name_ar as plan_name, sp.ai_features, sp.jofotara_enabled
|
||||
FROM subscriptions s
|
||||
LEFT JOIN subscription_plans sp ON s.plan_id = sp.id
|
||||
WHERE s.tenant_id = ?
|
||||
");
|
||||
$stmt->execute([$tenantId]);
|
||||
$sub = $stmt->fetch();
|
||||
|
||||
if (!$sub) {
|
||||
json_error('لا يوجد اشتراك فعّال لهذا المكتب. يرجى التواصل مع الإدارة.', 403);
|
||||
}
|
||||
|
||||
// Check subscription status
|
||||
if ($sub['status'] === 'cancelled') {
|
||||
json_error('تم إلغاء اشتراكك. يرجى تجديد الاشتراك للمتابعة.', 403);
|
||||
}
|
||||
|
||||
if ($sub['status'] === 'past_due') {
|
||||
json_error('اشتراكك متأخر الدفع. يرجى تسوية المبلغ المستحق للمتابعة.', 403);
|
||||
}
|
||||
|
||||
// Auto-reset monthly counter if billing period has ended
|
||||
if (!empty($sub['current_period_end']) && strtotime($sub['current_period_end']) < time()) {
|
||||
$newStart = date('Y-m-d H:i:s');
|
||||
$newEnd = date('Y-m-d H:i:s', strtotime('+30 days'));
|
||||
|
||||
$resetStmt = $db->prepare("
|
||||
UPDATE subscriptions
|
||||
SET invoices_used_this_month = 0,
|
||||
current_period_start = ?,
|
||||
current_period_end = ?,
|
||||
updated_at = NOW()
|
||||
WHERE tenant_id = ?
|
||||
");
|
||||
$resetStmt->execute([$newStart, $newEnd, $tenantId]);
|
||||
|
||||
$sub['invoices_used_this_month'] = 0;
|
||||
$sub['current_period_start'] = $newStart;
|
||||
$sub['current_period_end'] = $newEnd;
|
||||
|
||||
error_log("QuotaMiddleware: Auto-reset monthly counter for tenant {$tenantId}");
|
||||
}
|
||||
|
||||
// Check invoice quota
|
||||
$used = (int)$sub['invoices_used_this_month'];
|
||||
$limit = (int)$sub['max_invoices_per_month'];
|
||||
|
||||
if ($used >= $limit) {
|
||||
json_error('لقد وصلت للحد الأقصى من الفواتير المسموحة هذا الشهر (' . $limit . ' فاتورة). يرجى ترقية باقتك.', 429, [
|
||||
'quota_type' => 'invoices',
|
||||
'used' => $used,
|
||||
'limit' => $limit,
|
||||
'plan' => $sub['plan_id'] ?? 'free',
|
||||
'plan_name' => $sub['plan_name'] ?? 'مجانية',
|
||||
'period_end' => $sub['current_period_end'],
|
||||
]);
|
||||
}
|
||||
|
||||
return $sub;
|
||||
}
|
||||
|
||||
/**
|
||||
* Increment the monthly invoice counter after a successful upload.
|
||||
*/
|
||||
public static function incrementInvoiceUsage(string $tenantId): void
|
||||
{
|
||||
$db = Database::getInstance();
|
||||
$stmt = $db->prepare("
|
||||
UPDATE subscriptions
|
||||
SET invoices_used_this_month = invoices_used_this_month + 1,
|
||||
updated_at = NOW()
|
||||
WHERE tenant_id = ?
|
||||
");
|
||||
$stmt->execute([$tenantId]);
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the tenant can add more companies.
|
||||
*/
|
||||
public static function checkCompanyQuota(string $tenantId): array
|
||||
{
|
||||
$db = Database::getInstance();
|
||||
|
||||
// Get subscription
|
||||
$stmt = $db->prepare("
|
||||
SELECT s.*, sp.name_ar as plan_name
|
||||
FROM subscriptions s
|
||||
LEFT JOIN subscription_plans sp ON s.plan_id = sp.id
|
||||
WHERE s.tenant_id = ?
|
||||
");
|
||||
$stmt->execute([$tenantId]);
|
||||
$sub = $stmt->fetch();
|
||||
|
||||
if (!$sub) {
|
||||
json_error('لا يوجد اشتراك فعّال لهذا المكتب.', 403);
|
||||
}
|
||||
|
||||
// Count current active companies
|
||||
$countStmt = $db->prepare("
|
||||
SELECT COUNT(*) FROM companies
|
||||
WHERE tenant_id = ? AND (deleted_at IS NULL)
|
||||
");
|
||||
$countStmt->execute([$tenantId]);
|
||||
$currentCount = (int)$countStmt->fetchColumn();
|
||||
|
||||
$limit = (int)$sub['max_companies'];
|
||||
|
||||
if ($currentCount >= $limit) {
|
||||
json_error('لقد وصلت للحد الأقصى من الشركات المسموحة (' . $limit . ' شركة). يرجى ترقية باقتك.', 429, [
|
||||
'quota_type' => 'companies',
|
||||
'used' => $currentCount,
|
||||
'limit' => $limit,
|
||||
'plan' => $sub['plan_id'] ?? 'free',
|
||||
'plan_name' => $sub['plan_name'] ?? 'مجانية',
|
||||
]);
|
||||
}
|
||||
|
||||
return $sub;
|
||||
}
|
||||
|
||||
/**
|
||||
* Check if the tenant can add more users.
|
||||
*/
|
||||
public static function checkUserQuota(string $tenantId): array
|
||||
{
|
||||
$db = Database::getInstance();
|
||||
|
||||
// Get subscription
|
||||
$stmt = $db->prepare("
|
||||
SELECT s.*, sp.name_ar as plan_name
|
||||
FROM subscriptions s
|
||||
LEFT JOIN subscription_plans sp ON s.plan_id = sp.id
|
||||
WHERE s.tenant_id = ?
|
||||
");
|
||||
$stmt->execute([$tenantId]);
|
||||
$sub = $stmt->fetch();
|
||||
|
||||
if (!$sub) {
|
||||
json_error('لا يوجد اشتراك فعّال لهذا المكتب.', 403);
|
||||
}
|
||||
|
||||
// Count current active users in this tenant
|
||||
$countStmt = $db->prepare("
|
||||
SELECT COUNT(*) FROM users
|
||||
WHERE tenant_id = ? AND (deleted_at IS NULL) AND is_active = 1
|
||||
");
|
||||
$countStmt->execute([$tenantId]);
|
||||
$currentCount = (int)$countStmt->fetchColumn();
|
||||
|
||||
$maxUsers = (int)($sub['max_users'] ?? 999);
|
||||
|
||||
if ($currentCount >= $maxUsers) {
|
||||
json_error('لقد وصلت للحد الأقصى من المستخدمين المسموحين (' . $maxUsers . ' مستخدم). يرجى ترقية باقتك.', 429, [
|
||||
'quota_type' => 'users',
|
||||
'used' => $currentCount,
|
||||
'limit' => $maxUsers,
|
||||
'plan' => $sub['plan_id'] ?? 'free',
|
||||
'plan_name' => $sub['plan_name'] ?? 'مجانية',
|
||||
]);
|
||||
}
|
||||
|
||||
return $sub;
|
||||
}
|
||||
|
||||
/**
|
||||
* Get usage summary for a tenant (for dashboard display).
|
||||
*/
|
||||
public static function getUsageSummary(string $tenantId): array
|
||||
{
|
||||
$db = Database::getInstance();
|
||||
|
||||
// Get subscription
|
||||
$stmt = $db->prepare("
|
||||
SELECT s.*, sp.name_ar as plan_name, sp.name_en as plan_name_en,
|
||||
sp.ai_features, sp.jofotara_enabled, sp.price_jod as plan_price
|
||||
FROM subscriptions s
|
||||
LEFT JOIN subscription_plans sp ON s.plan_id = sp.id
|
||||
WHERE s.tenant_id = ?
|
||||
");
|
||||
$stmt->execute([$tenantId]);
|
||||
$sub = $stmt->fetch();
|
||||
|
||||
if (!$sub) {
|
||||
return [
|
||||
'has_subscription' => false,
|
||||
'plan' => 'none',
|
||||
];
|
||||
}
|
||||
|
||||
// Count companies
|
||||
$compStmt = $db->prepare("SELECT COUNT(*) FROM companies WHERE tenant_id = ? AND deleted_at IS NULL");
|
||||
$compStmt->execute([$tenantId]);
|
||||
$companiesUsed = (int)$compStmt->fetchColumn();
|
||||
|
||||
// Count users
|
||||
$userStmt = $db->prepare("SELECT COUNT(*) FROM users WHERE tenant_id = ? AND (deleted_at IS NULL) AND is_active = 1");
|
||||
$userStmt->execute([$tenantId]);
|
||||
$usersUsed = (int)$userStmt->fetchColumn();
|
||||
|
||||
$invoicesUsed = (int)$sub['invoices_used_this_month'];
|
||||
$invoicesLimit = (int)$sub['max_invoices_per_month'];
|
||||
$companiesLimit = (int)$sub['max_companies'];
|
||||
$usersLimit = (int)($sub['max_users'] ?? 999);
|
||||
|
||||
return [
|
||||
'has_subscription' => true,
|
||||
'plan_id' => $sub['plan_id'] ?? 'free',
|
||||
'plan_name' => $sub['plan_name'] ?? 'مجانية',
|
||||
'plan_name_en' => $sub['plan_name_en'] ?? 'Free',
|
||||
'plan_price' => (float)($sub['plan_price'] ?? 0),
|
||||
'status' => $sub['status'],
|
||||
'ai_features' => (bool)($sub['ai_features'] ?? false),
|
||||
'jofotara_enabled' => (bool)($sub['jofotara_enabled'] ?? false),
|
||||
|
||||
'invoices' => [
|
||||
'used' => $invoicesUsed,
|
||||
'limit' => $invoicesLimit,
|
||||
'percent' => $invoicesLimit > 0 ? round(($invoicesUsed / $invoicesLimit) * 100) : 0,
|
||||
'warning' => $invoicesLimit > 0 && ($invoicesUsed / $invoicesLimit) >= 0.9,
|
||||
],
|
||||
'companies' => [
|
||||
'used' => $companiesUsed,
|
||||
'limit' => $companiesLimit,
|
||||
'percent' => $companiesLimit > 0 ? round(($companiesUsed / $companiesLimit) * 100) : 0,
|
||||
'warning' => $companiesLimit > 0 && ($companiesUsed / $companiesLimit) >= 0.9,
|
||||
],
|
||||
'users' => [
|
||||
'used' => $usersUsed,
|
||||
'limit' => $usersLimit,
|
||||
'percent' => $usersLimit > 0 ? round(($usersUsed / $usersLimit) * 100) : 0,
|
||||
'warning' => $usersLimit > 0 && ($usersUsed / $usersLimit) >= 0.9,
|
||||
],
|
||||
|
||||
'period_start' => $sub['current_period_start'],
|
||||
'period_end' => $sub['current_period_end'],
|
||||
'trial_ends_at' => $sub['trial_ends_at'],
|
||||
'days_remaining' => !empty($sub['current_period_end'])
|
||||
? max(0, (int)ceil((strtotime($sub['current_period_end']) - time()) / 86400))
|
||||
: null,
|
||||
];
|
||||
}
|
||||
}
|
||||
71
app/Middleware/RateLimitMiddleware.php
Normal file
71
app/Middleware/RateLimitMiddleware.php
Normal file
@@ -0,0 +1,71 @@
|
||||
<?php
|
||||
/**
|
||||
* Rate Limiting Middleware (File-based, Race-Condition Safe)
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Middleware;
|
||||
|
||||
final class RateLimitMiddleware
|
||||
{
|
||||
/**
|
||||
* File-based rate limiter with file-lock to prevent race conditions.
|
||||
* For multi-server deployments, replace with Redis.
|
||||
*/
|
||||
public static function check(int $maxRequests = 60, int $timeWindow = 60): void
|
||||
{
|
||||
$ip = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
|
||||
$cacheDir = STORAGE_PATH . '/cache';
|
||||
$cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
|
||||
|
||||
if (!is_dir($cacheDir)) {
|
||||
mkdir($cacheDir, 0755, true);
|
||||
}
|
||||
|
||||
// M2 Fix: Use exclusive file lock to prevent race condition
|
||||
$fp = fopen($cacheFile, 'c+');
|
||||
if ($fp === false) {
|
||||
// If we can't open the file, fail open (don't block all users)
|
||||
return;
|
||||
}
|
||||
|
||||
try {
|
||||
flock($fp, LOCK_EX); // Exclusive lock — blocks until acquired
|
||||
|
||||
$now = time();
|
||||
$content = stream_get_contents($fp);
|
||||
$requests = [];
|
||||
|
||||
if (!empty($content)) {
|
||||
$decoded = json_decode($content, true);
|
||||
if (is_array($decoded)) {
|
||||
// Keep only requests within the time window
|
||||
$requests = array_values(
|
||||
array_filter($decoded, fn($ts) => $ts > ($now - $timeWindow))
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
if (count($requests) >= $maxRequests) {
|
||||
flock($fp, LOCK_UN);
|
||||
fclose($fp);
|
||||
|
||||
header('Retry-After: ' . $timeWindow);
|
||||
json_error('Too Many Requests. Please slow down.', 429);
|
||||
}
|
||||
|
||||
// Record this request
|
||||
$requests[] = $now;
|
||||
|
||||
// Write updated data back
|
||||
ftruncate($fp, 0);
|
||||
rewind($fp);
|
||||
fwrite($fp, json_encode($requests));
|
||||
|
||||
} finally {
|
||||
flock($fp, LOCK_UN);
|
||||
fclose($fp);
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user