Hamza/saqel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update Saqel Platform: 2026-09-08 13:43:36

Browse Source
This commit is contained in:
Hamza-Ayed
2026-09-08 13:43:36 +03:00
parent 0f424062fe
commit bb37b31cab
76 changed files with 3617 additions and 3059 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/app/Middlewares/AuthMiddleware.php
+44 -12
View File
@@ -6,6 +6,7 @@ use App\Core\Request;
use App\Core\Response;
use App\Core\Security;
use App\Core\RedisClient;
use App\Core\Database;
class AuthMiddleware
{
@@ -38,30 +39,61 @@ class AuthMiddleware
$userId = (int)$payload['user_id'];
$role = (string)($payload['role'] ?? 'student');
$identityId = (int)($payload['identity_id'] ?? 0);
$tokenVersion = (int)($payload['token_version'] ?? 0);
if ($identityId <= 0 || $tokenVersion <= 0) {
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'جلسة قديمة؛ يرجى تسجيل الدخول مجدداً']);
exit;
}
$identity = Database::selectOne(
"SELECT status, token_version FROM auth_identities WHERE id = ? LIMIT 1",
[$identityId]
);
if (!$identity || $identity['status'] !== 'active' || (int)$identity['token_version'] !== $tokenVersion) {
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'تم إلغاء الجلسة أو إيقاف الحساب']);
exit;
}
$requestFingerprint = trim((string)$request->getHeader('x-device-fingerprint', ''));
$tokenFingerprint = (string)($payload['device_fingerprint'] ?? '');
if ($requestFingerprint !== '' && $tokenFingerprint !== '' && !hash_equals($tokenFingerprint, $requestFingerprint)) {
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'بصمة الجهاز لا تطابق الجلسة']);
exit;
}
// Check if session is active in Redis (Role-isolated single active session tracking)
try {
$redis = RedisClient::getInstance();
$sessionData = $redis->get("active_session:{$role}:{$userId}") ?: $redis->get("active_session:{$userId}");
if ($sessionData) {
$session = json_decode($sessionData, true);
$expectedSig = substr($token, -32);
if (is_array($session) && isset($session['token_signature']) && $session['token_signature'] !== $expectedSig) {
$response->status(401)->json([
'error' => 'Unauthorized',
'message' => 'تم تسجيل الدخول من جهاز أو متصفح آخر. يرجى إعادة تسجيل الدخول.'
]);
exit;
}
if (!$sessionData) {
$response->status(401)->json(['error' => 'Unauthorized', 'message' => 'الجلسة غير نشطة؛ يرجى تسجيل الدخول مجدداً']);
exit;
}
$session = json_decode($sessionData, true);
$expectedSig = substr($token, -32);
if (!is_array($session) || !isset($session['token_signature']) || !hash_equals($session['token_signature'], $expectedSig)) {
$response->status(401)->json([
'error' => 'Unauthorized',
'message' => 'تم تسجيل الدخول من جهاز أو متصفح آخر. يرجى إعادة تسجيل الدخول.'
]);
exit;
}
} catch (\Exception $e) {
// If Redis is temporarily unreachable, fallback gracefully to JWT verification
error_log("AuthMiddleware Redis Warning: " . $e->getMessage());
error_log("AuthMiddleware Redis failure: " . $e->getMessage());
$response->status(503)->json(['error' => 'Service unavailable', 'message' => 'تعذر التحقق من الجلسة مؤقتاً']);
exit;
}
// Attach user info to the Request instance dynamically so controllers can use it
$request->user_id = $userId;
$request->role = $payload['role'];
$request->uuid = $payload['uuid'] ?? null;
$request->school_id = isset($payload['school_id']) ? (int)$payload['school_id'] : null;
$request->directorate_id = isset($payload['directorate_id']) ? (int)$payload['directorate_id'] : null;
$request->full_name = isset($payload['name']) ? (string)$payload['name'] : null;
$request->identity_id = $identityId;
$request->is_super_admin = $role === 'super_admin';
}
}