Implement Enterprise Logic (Redis, Phone Auth, Full Schema)

backend/app/Middlewares/AuthMiddleware.php

@@ -28,16 +28,29 @@ class AuthMiddleware
             exit;
         }
 
+        // Check if session is active in Redis
+        try {
+            $redis = \App\Core\RedisClient::getInstance();
+            $userId = $payload['user_id'];
+            $sessionState = $redis->get("session:{$userId}:{$token}");
+            
+            if (!$sessionState || $sessionState !== 'active') {
+                $response->json(['error' => 'Unauthorized', 'message' => 'Session has been revoked or expired'], 401);
+                exit;
+            }
+        } catch (\Exception $e) {
+            // If Redis is down, we fallback to just JWT verification
+            error_log("AuthMiddleware Redis Error: " . $e->getMessage());
+        }
+
         // Validate required custom payload elements
-        if (!isset($payload['user_id']) || !isset($payload['company_id']) || !isset($payload['role'])) {
+        if (!isset($payload['user_id']) || !isset($payload['role'])) {
             $response->json(['error' => 'Unauthorized', 'message' => 'Malformed token payload structure'], 401);
             exit;
         }
 
         // Attach user info to the Request instance dynamically so controllers can use it
         $request->user_id = $payload['user_id'];
-        $request->company_id = $payload['company_id'];
         $request->role = $payload['role'];
-        $request->is_super_admin = (int)$payload['company_id'] === 1;
     }
 }