From 39cf087488f21c815c3f6a375702695086620ce7 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Sat, 29 Aug 2026 03:07:10 +0300
Subject: [PATCH] fix: Support array payload from Security::verifyJWT for
 student identity verification

---
 backend/app/Controllers/AuthController.php | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/backend/app/Controllers/AuthController.php b/backend/app/Controllers/AuthController.php
index 7c84546..b9fe4b1 100644
--- a/backend/app/Controllers/AuthController.php
+++ b/backend/app/Controllers/AuthController.php
@@ -472,12 +472,14 @@ class AuthController
         }
 
         $decoded = Security::verifyJWT($identityToken);
-        if (!$decoded || ($decoded->role ?? '') !== 'student_identity_pending') {
+        $role = is_array($decoded) ? ($decoded['role'] ?? '') : ($decoded->role ?? '');
+        if (!$decoded || $role !== 'student_identity_pending') {
             $response->status(401)->json(['status' => 'error', 'message' => 'الجلسة غير صالحة، يرجى إعادة التحقق من رقم الهاتف']);
             return;
         }
 
-        $identityId = (int)$decoded->identity_id;
+        $identityId = (int)(is_array($decoded) ? ($decoded['identity_id'] ?? 0) : ($decoded->identity_id ?? 0));
+        $phone = is_array($decoded) ? ($decoded['phone'] ?? '') : ($decoded->phone ?? '');
 
         // Check if student exists with this National ID
         $student = Database::selectOne("SELECT * FROM students WHERE national_id = ? LIMIT 1", [$nationalId]);
@@ -498,7 +500,7 @@ class AuthController
                 $student['uuid'],
                 'student',
                 'browser_default',
-                $decoded->phone,
+                $phone,
                 $student['full_name'],
                 $response,
                 'تم تسجيل الدخول لملف الطالب بنجاح'
@@ -573,11 +575,13 @@ class AuthController
         if ($identityToken) {
             // New Student Flow
             $decoded = Security::verifyJWT($identityToken);
-            if (!$decoded || ($decoded->role ?? '') !== 'student_identity_pending') {
+            $role = is_array($decoded) ? ($decoded['role'] ?? '') : ($decoded->role ?? '');
+            if (!$decoded || $role !== 'student_identity_pending') {
                 $response->status(401)->json(['status' => 'error', 'message' => 'الجلسة غير صالحة']);
                 return;
             }
-            $identityId = (int)$decoded->identity_id;
+            $identityId = (int)(is_array($decoded) ? ($decoded['identity_id'] ?? 0) : ($decoded->identity_id ?? 0));
+            $phone = is_array($decoded) ? ($decoded['phone'] ?? '') : ($decoded->phone ?? '');
 
             // Ensure National ID doesn't exist
             $existing = Database::selectOne("SELECT id FROM students WHERE national_id = ? LIMIT 1", [$nationalId]);
@@ -601,7 +605,7 @@ class AuthController
             }
 
             $this->generateSessionAndRespond(
-                $sId, $sUuid, 'student', 'browser_default', $decoded->phone, $fullName, $response, 'تم استكمال التسجيل بنجاح'
+                $sId, $sUuid, 'student', 'browser_default', $phone, $fullName, $response, 'تم استكمال التسجيل بنجاح'
             );
         } else {
             // Legacy / Fallback for already logged-in students updating profile