Update Saqel Platform: 2026-09-08 13:43:36

backend/app/Middlewares/AuthMiddleware.php

@@ -6,6 +6,7 @@ use App\Core\Request;
 use App\Core\Response;
 use App\Core\Security;
 use App\Core\RedisClient;
+use App\Core\Database;
 
 class AuthMiddleware
 {
@@ -38,30 +39,61 @@ class AuthMiddleware
         $userId = (int)$payload['user_id'];
         $role   = (string)($payload['role'] ?? 'student');
 
+        $identityId = (int)($payload['identity_id'] ?? 0);
+        $tokenVersion = (int)($payload['token_version'] ?? 0);
+        if ($identityId <= 0 || $tokenVersion <= 0) {
+            $response->status(401)->json(['error' => 'Unauthorized', 'message' => 'جلسة قديمة؛ يرجى تسجيل الدخول مجدداً']);
+            exit;
+        }
+
+        $identity = Database::selectOne(
+            "SELECT status, token_version FROM auth_identities WHERE id = ? LIMIT 1",
+            [$identityId]
+        );
+        if (!$identity || $identity['status'] !== 'active' || (int)$identity['token_version'] !== $tokenVersion) {
+            $response->status(401)->json(['error' => 'Unauthorized', 'message' => 'تم إلغاء الجلسة أو إيقاف الحساب']);
+            exit;
+        }
+
+        $requestFingerprint = trim((string)$request->getHeader('x-device-fingerprint', ''));
+        $tokenFingerprint = (string)($payload['device_fingerprint'] ?? '');
+        if ($requestFingerprint !== '' && $tokenFingerprint !== '' && !hash_equals($tokenFingerprint, $requestFingerprint)) {
+            $response->status(401)->json(['error' => 'Unauthorized', 'message' => 'بصمة الجهاز لا تطابق الجلسة']);
+            exit;
+        }
+
         // Check if session is active in Redis (Role-isolated single active session tracking)
         try {
             $redis = RedisClient::getInstance();
             $sessionData = $redis->get("active_session:{$role}:{$userId}") ?: $redis->get("active_session:{$userId}");
             
-            if ($sessionData) {
-                $session = json_decode($sessionData, true);
-                $expectedSig = substr($token, -32);
-                if (is_array($session) && isset($session['token_signature']) && $session['token_signature'] !== $expectedSig) {
-                    $response->status(401)->json([
-                        'error'   => 'Unauthorized',
-                        'message' => 'تم تسجيل الدخول من جهاز أو متصفح آخر. يرجى إعادة تسجيل الدخول.'
-                    ]);
-                    exit;
-                }
+            if (!$sessionData) {
+                $response->status(401)->json(['error' => 'Unauthorized', 'message' => 'الجلسة غير نشطة؛ يرجى تسجيل الدخول مجدداً']);
+                exit;
+            }
+            $session = json_decode($sessionData, true);
+            $expectedSig = substr($token, -32);
+            if (!is_array($session) || !isset($session['token_signature']) || !hash_equals($session['token_signature'], $expectedSig)) {
+                $response->status(401)->json([
+                    'error'   => 'Unauthorized',
+                    'message' => 'تم تسجيل الدخول من جهاز أو متصفح آخر. يرجى إعادة تسجيل الدخول.'
+                ]);
+                exit;
             }
         } catch (\Exception $e) {
-            // If Redis is temporarily unreachable, fallback gracefully to JWT verification
-            error_log("AuthMiddleware Redis Warning: " . $e->getMessage());
+            error_log("AuthMiddleware Redis failure: " . $e->getMessage());
+            $response->status(503)->json(['error' => 'Service unavailable', 'message' => 'تعذر التحقق من الجلسة مؤقتاً']);
+            exit;
         }
 
         // Attach user info to the Request instance dynamically so controllers can use it
         $request->user_id = $userId;
         $request->role = $payload['role'];
         $request->uuid = $payload['uuid'] ?? null;
+        $request->school_id = isset($payload['school_id']) ? (int)$payload['school_id'] : null;
+        $request->directorate_id = isset($payload['directorate_id']) ? (int)$payload['directorate_id'] : null;
+        $request->full_name = isset($payload['name']) ? (string)$payload['name'] : null;
+        $request->identity_id = $identityId;
+        $request->is_super_admin = $role === 'super_admin';
     }
 }

backend/app/Middlewares/ChatRoleMiddleware.php

@@ -0,0 +1,8 @@
+<?php
+
+namespace App\Middlewares;
+
+class ChatRoleMiddleware extends RoleGuard
+{
+    protected array $allowedRoles = ['student', 'teacher'];
+}

backend/app/Middlewares/CurriculumManagerMiddleware.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class CurriculumManagerMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, [
+            'teacher',
+            'school_admin',
+            'directorate_admin',
+            'supervisor',
+            'super_admin',
+        ]);
+    }
+}

backend/app/Middlewares/GuardianRoleMiddleware.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class GuardianRoleMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, ['guardian']);
+    }
+}

backend/app/Middlewares/InstitutionalRoleMiddleware.php

@@ -0,0 +1,21 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class InstitutionalRoleMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, [
+            'school_admin',
+            'directorate_admin',
+            'supervisor',
+            'super_admin',
+        ]);
+    }
+}

backend/app/Middlewares/RoleGuard.php

@@ -0,0 +1,25 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class RoleGuard
+{
+    /** @param list<string> $allowedRoles */
+    public static function requireAny(Request $request, Response $response, array $allowedRoles): void
+    {
+        $role = $request->role;
+        if ($role === null || !in_array($role, $allowedRoles, true)) {
+            $response->status(403)->json([
+                'status' => 'error',
+                'error' => 'Forbidden',
+                'message' => 'لا تملك الصلاحية اللازمة لتنفيذ هذه العملية.',
+            ]);
+            exit;
+        }
+    }
+}

backend/app/Middlewares/StudentRoleMiddleware.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class StudentRoleMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, ['student']);
+    }
+}

backend/app/Middlewares/SuperAdminRoleMiddleware.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class SuperAdminRoleMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, ['super_admin']);
+    }
+}

backend/app/Middlewares/TeacherRoleMiddleware.php

@@ -0,0 +1,16 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use App\Core\Request;
+use App\Core\Response;
+
+final class TeacherRoleMiddleware
+{
+    public function handle(Request $request, Response $response): void
+    {
+        RoleGuard::requireAny($request, $response, ['teacher', 'super_admin']);
+    }
+}