Hamza/tripz-llc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update codebase

Browse Source
This commit is contained in:
Hamza-Ayed
2026-08-09 16:56:13 +03:00
parent 95e2e4f35d
commit b64debaa88
1058 changed files with 164327 additions and 113928 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/auth/otp/verify.php
+72 -5
View File
@@ -147,7 +147,70 @@ try {
$stmtUpd = $con->prepare($sqlUpdate);
$stmtUpd->bindParam(':id', $matchedRowId, PDO::PARAM_INT);
$stmtUpd->execute();
jsonSuccess(null, "Your phone number has been verified.");
// ═══════════════════════════════════════════════════════
// تغيير الجهاز: التحقق وحده لا يكفي. لا بد من ربط بصمة
// الجهاز الجديد ثم إصدار توكن driver — وإلا بقي التطبيق
// على توكن التسجيل ورجع كل endpoint محمي 403، وهو ما كان
// يجعل شاشة OTP "تنجح" ثم لا يعمل شيء بعدها.
// ═══════════════════════════════════════════════════════
$chk = $con->prepare("SELECT id FROM driver WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
global $blindIndex;
$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone_number) : null;
$chk->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
$driverRow = $chk->fetch(PDO::FETCH_ASSOC);
if (!$driverRow) {
jsonSuccess(null, "Your phone number has been verified.");
exit;
}
$driverID = (string)$driverRow['id'];
$fpRaw = filterRequest("fingerprint") ?? filterRequest("fingerPrint") ?? ($_SERVER['HTTP_X_DEVICE_FP'] ?? null);
if ($fpRaw === null && function_exists('getallheaders')) {
$hdrs = array_change_key_case(getallheaders(), CASE_LOWER);
$fpRaw = $hdrs['x-device-fp'] ?? null;
}
if (empty($fpRaw)) {
jsonError("Device fingerprint is required to complete device change.");
exit;
}
$fpPepper = getenv('FP_PEPPER') ?: '';
$fpHashed = !empty($fpPepper) ? hash('sha256', $fpRaw . $fpPepper) : $fpRaw;
$fcmToken = filterRequest("token");
// ربط الجهاز الجديد — نفس الصيغة التي يتوقعها loginJwtDriver.
$hasRow = $con->prepare("SELECT id FROM driverToken WHERE captain_id = ?");
$hasRow->execute([$driverID]);
if ($hasRow->fetch(PDO::FETCH_ASSOC)) {
if (!empty($fcmToken)) {
$con->prepare("UPDATE driverToken SET fingerPrint = ?, token = ? WHERE captain_id = ?")
->execute([$fpHashed, $encryptionHelper->encryptData($fcmToken), $driverID]);
} else {
$con->prepare("UPDATE driverToken SET fingerPrint = ? WHERE captain_id = ?")
->execute([$fpHashed, $driverID]);
}
} else {
$con->prepare("INSERT INTO driverToken (token, fingerPrint, captain_id, created_at) VALUES (?, ?, ?, NOW())")
->execute([
!empty($fcmToken) ? $encryptionHelper->encryptData($fcmToken) : '',
$fpHashed,
$driverID,
]);
}
$audDriver = filterRequest("aud") ?: filterRequest("audience") ?: (getenv('allowedDriver2') ?: 'driver-app:ios');
$jwtSvc = new JwtService($redis);
$accessToken = $jwtSvc->generateAccessToken($driverID, 'driver', $audDriver, $fpRaw);
jsonSuccess([
"driverID" => $driverID,
"jwt" => $accessToken,
"access_token" => $accessToken,
], "Your phone number has been verified.");
} else {
jsonError("Your phone number could not be verified or the code is expired. Please try again.");
}
@@ -177,8 +240,10 @@ try {
$isRegistered = false;
$driverData = null;
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM driver WHERE phone = ?");
$chkStmt->execute([$encryptionHelper->encryptData($phone_number)]);
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM driver WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
global $blindIndex;
$phoneBidx = $blindIndex ? $blindIndex->index('driver.phone', $phone_number) : null;
$chkStmt->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
$driver = $chkStmt->fetch(PDO::FETCH_ASSOC);
// Generate driverID for unregistered users (hash of phone)
@@ -273,8 +338,10 @@ try {
$passengerData = null;
$passengerID = '';
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM passengers WHERE phone = ?");
$chkStmt->execute([$encryptionHelper->encryptData($phone_number)]);
$chkStmt = $con->prepare("SELECT id, first_name, last_name, email, phone FROM passengers WHERE phone = ? OR (? IS NOT NULL AND phone_bidx = ?)");
global $blindIndex;
$phoneBidx = $blindIndex ? $blindIndex->index('passengers.phone', $phone_number) : null;
$chkStmt->execute([$encryptionHelper->encryptData($phone_number), $phoneBidx, $phoneBidx]);
$passenger = $chkStmt->fetch(PDO::FETCH_ASSOC);
if ($passenger) {