Update codebase

backend/auth/passenger/loginUsingCredentialsWithoutGoogle.php

@@ -9,18 +9,16 @@ $password = filterRequest("password");
 $fingerprint = filterRequest('fingerPrint') ?? filterRequest('fingerprint');
 $audience = filterRequest('aud') ?: 'siro_passenger';
 
-// 1. تطبيق حد معدل الطلبات (Rate Limiting) للفاحصين: 3 محاولات بالدقيقة لكل IP
+// 1. حد معدل الطلبات مطبّق على الجميع (الحد مرفوع إلى 30/دقيقة في RateLimiter)
 $rateLimiter = new RateLimiter($redis);
 $rateLimiter->enforce(RateLimiter::identifier(), 'tester_login');
 
-if (!$email || !$password) {
-    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
-    exit();
-}
-
-// 2. التحقق من أن الحساب مخصص للفحص فقط (isTest check)
-$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: '';
-$allowedEmails = array_filter(array_map('trim', explode(',', $allowedTesterEmailsEnv)));
+// 2. قائمة بيضاء صريحة لحسابات الفحص — مطابقة تامة فقط، لا مطابقة جزئية ولا مطابقة نطاق
+$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: ($_ENV['ALLOWED_TESTER_EMAILS'] ?? '');
+$allowedEmails = array_filter(array_map(
+    fn($e) => strtolower(trim($e)),
+    explode(',', $allowedTesterEmailsEnv)
+));
 if (empty($allowedEmails)) {
     $allowedEmails = [
         'driver_tester@siromove.com',
@@ -28,12 +26,13 @@ if (empty($allowedEmails)) {
     ];
 }
 
+$cleanEmail = strtolower(trim((string) $email));
+$isTester = in_array($cleanEmail, $allowedEmails, true);
 
-$cleanEmail = strtolower(trim($email));
-$isTester = in_array($cleanEmail, $allowedEmails) || 
-            substr($cleanEmail, -13) === '@siromove.com' ||
-            str_contains($cleanEmail, 'tester') ||
-            str_contains($cleanEmail, 'reviewer');
+if (!$email || !$password) {
+    echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
+    exit();
+}
 
 try {
     $con = Database::get('main');
@@ -121,7 +120,7 @@ try {
     http_response_code(500);
     echo json_encode([
         "status" => "failure",
-        "message" => "Server error: " . $e->getMessage() . " in " . basename($e->getFile()) . " on line " . $e->getLine()
+        "message" => "Server error. Please try again."
     ]);
 }
 exit();

backend/auth/passenger/register.php

@@ -63,7 +63,7 @@ try {
     $firstName_encrypted   = $encryptionHelper->encryptData($firstName);
     $lastName_encrypted    = $encryptionHelper->encryptData($lastName);
     $email_encrypted       = $encryptionHelper->encryptData($email);
-    $uniqueId = substr(md5($phoneNumber), 0, 20);
+    $uniqueId = substr(md5($phoneNumber), 0, 16);
     $password_hashed       = password_hash($email . $uniqueId, PASSWORD_DEFAULT);
     $unknown_encrypted     = $encryptionHelper->encryptData("unknown yet");
 
@@ -77,12 +77,13 @@ try {
     // (مهلة أوسع من صلاحية الرمز نفسه [5 دقائق] لإعطاء وقت كافٍ لإكمال
     // نموذج التسجيل بعد التحقق مباشرة).
     $step = 4.5;
+    $otpSearchKey = otpPhoneKey($phoneNumber);
     $verifyCheckStmt = $con->prepare(
         "SELECT id FROM phone_verification_passenger
          WHERE phone_number = ? AND verified = 1 AND created_at > DATE_SUB(NOW(), INTERVAL 30 MINUTE)
          LIMIT 1"
     );
-    $verifyCheckStmt->execute([$phoneNumber_encrypted]);
+    $verifyCheckStmt->execute([$otpSearchKey]);
     if ($verifyCheckStmt->rowCount() === 0) {
         error_log("$logTag Step 4.5 Error: Phone number not verified via OTP.");
         jsonError("Phone number must be verified before registration.");

backend/auth/passenger/token/send_otp.php

@@ -1,6 +1,6 @@
 <?php
 // File: send_otp.php  (بديل عن النسخة المعتمدة على RaseelPlus)
-require_once __DIR__ . '/../../connect.php';
+require_once __DIR__ . '/../../../connect.php';
 
 /* 1) توليد رمز التحقق (3 خانات) */
 $otp      = (string)random_int(100, 999);

backend/auth/passenger/token/verify_otp.php

@@ -1,7 +1,7 @@
 <?php
 // File: verify_otp.php (with enhanced logging)
 // siro_v1/auth/token_passenger
-require_once __DIR__ . '/../../connect.php';
+require_once __DIR__ . '/../../../connect.php';
 
 // --- Start of Script Execution ---
  error_log("--- [verify_otp.php] Script execution started. ---");