From c3d526c0114019d04c1307c9531e2a7975ba2116 Mon Sep 17 00:00:00 2001
From: Hamza-Ayed <hamzaayedflutter@gmail.com>
Date: Tue, 8 Sep 2026 14:06:11 +0300
Subject: [PATCH] Update Saqel Platform: 2026-09-08 14:06:11

---
 backend/scripts/provision_staff_account.php | 67 +++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 backend/scripts/provision_staff_account.php

diff --git a/backend/scripts/provision_staff_account.php b/backend/scripts/provision_staff_account.php
new file mode 100644
index 0000000..63a78c3
--- /dev/null
+++ b/backend/scripts/provision_staff_account.php
@@ -0,0 +1,67 @@
+<?php
+/**
+ * Provision a privileged staff account from the server terminal.
+ * Usage: php scripts/provision_staff_account.php [role] [phone] [full_name]
+ * Roles: super_admin, school_admin, directorate_admin, supervisor
+ */
+declare(strict_types=1);
+
+require_once __DIR__ . '/../app/bootstrap.php';
+
+use App\Core\Database;
+use App\Core\Security;
+
+$roles = ['super_admin', 'school_admin', 'directorate_admin', 'supervisor'];
+$role = trim((string)($argv[1] ?? ''));
+$phone = trim((string)($argv[2] ?? ''));
+$name = trim((string)($argv[3] ?? ''));
+
+if (!in_array($role, $roles, true)) {
+    fwrite(STDERR, "Role must be one of: " . implode(', ', $roles) . "\n");
+    exit(2);
+}
+$phone = preg_replace('/\D+/', '', $phone) ?: '';
+if (str_starts_with($phone, '07')) $phone = '962' . substr($phone, 1);
+if (str_starts_with($phone, '7') && strlen($phone) === 9) $phone = '962' . $phone;
+if (strlen($phone) < 9 || strlen($phone) > 15 || $name === '') {
+    fwrite(STDERR, "Usage: php scripts/provision_staff_account.php ROLE PHONE FULL_NAME\n");
+    exit(2);
+}
+
+$schoolId = null;
+$directorateId = null;
+if ($role === 'school_admin') {
+    $schoolId = (int)trim((string)readline('School ID: '));
+    if ($schoolId < 1) { fwrite(STDERR, "A valid School ID is required.\n"); exit(2); }
+} elseif (in_array($role, ['directorate_admin', 'supervisor'], true)) {
+    $directorateId = (int)trim((string)readline('Directorate ID: '));
+    if ($directorateId < 1) { fwrite(STDERR, "A valid Directorate ID is required.\n"); exit(2); }
+}
+
+try {
+    $phoneHash = Security::blindIndex($phone);
+    $identity = Database::selectOne('SELECT id FROM auth_identities WHERE phone_hash = ? LIMIT 1', [$phoneHash]);
+    if ($identity) {
+        $identityId = (int)$identity['id'];
+        Database::query("UPDATE auth_identities SET status = 'active', token_version = token_version + 1 WHERE id = ?", [$identityId]);
+    } else {
+        $uuid = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000, mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff));
+        $identityId = Database::insert('INSERT INTO auth_identities (uuid, phone_number, phone_hash, status, token_version) VALUES (?, ?, ?, \'active\', 1)', [$uuid, Security::encrypt($phone), $phoneHash]);
+    }
+
+    $staff = Database::selectOne('SELECT id FROM staff_accounts WHERE identity_id = ? AND role = ? LIMIT 1', [$identityId, $role]);
+    if ($staff) {
+        Database::query('UPDATE staff_accounts SET full_name = ?, school_id = ?, directorate_id = ?, status = \'active\' WHERE id = ?', [$name, $schoolId, $directorateId, (int)$staff['id']]);
+        $staffId = (int)$staff['id'];
+        $action = 'updated';
+    } else {
+        $uuid = sprintf('%04x%04x-%04x-%04x-%04x-%04x-%04x%04x%04x', mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0x0fff) | 0x4000, mt_rand(0, 0x3fff) | 0x8000, mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff));
+        $staffId = Database::insert('INSERT INTO staff_accounts (uuid, identity_id, full_name, role, school_id, directorate_id, status) VALUES (?, ?, ?, ?, ?, ?, \'active\')', [$uuid, $identityId, $name, $role, $schoolId, $directorateId]);
+        $action = 'created';
+    }
+    echo "Staff account {$action}: id={$staffId}, role={$role}, identity_id={$identityId}\n";
+    echo "The user can now sign in through OTP; no password is created.\n";
+} catch (Throwable $e) {
+    fwrite(STDERR, "Provisioning failed: {$e->getMessage()}\n");
+    exit(1);
+}