111 lines
4.3 KiB
PHP
111 lines
4.3 KiB
PHP
<?php
|
|
// ============================================================
|
|
// loginUsingCredentialsWithoutGoogle.php
|
|
// مخصص لدخول الفاحصين (Testers) بالإيميل والباسورد
|
|
// ============================================================
|
|
|
|
require_once __DIR__ . '/../../core/bootstrap.php';
|
|
|
|
$email = filterRequest('email');
|
|
$password = filterRequest('password');
|
|
$audience = filterRequest('aud') ?? 'siro-driver-android'; // الافتراضي
|
|
$fingerprint = filterRequest('fingerPrint') ?? filterRequest('fingerprint');
|
|
|
|
// 1. حد معدل الطلبات مطبّق على الجميع (الحد مرفوع إلى 30/دقيقة في RateLimiter)
|
|
$rateLimiter = new RateLimiter($redis);
|
|
$rateLimiter->enforce(RateLimiter::identifier(), 'tester_login');
|
|
|
|
// 2. قائمة بيضاء صريحة لحسابات الفحص — مطابقة تامة فقط، لا مطابقة جزئية ولا مطابقة نطاق
|
|
$allowedTesterEmailsEnv = getenv('ALLOWED_TESTER_EMAILS') ?: ($_ENV['ALLOWED_TESTER_EMAILS'] ?? '');
|
|
$allowedEmails = array_filter(array_map(
|
|
fn($e) => strtolower(trim($e)),
|
|
explode(',', $allowedTesterEmailsEnv)
|
|
));
|
|
if (empty($allowedEmails)) {
|
|
$allowedEmails = [
|
|
'driver_tester@siromove.com',
|
|
'passenger_tester@siromove.com',
|
|
];
|
|
}
|
|
|
|
$cleanEmail = strtolower(trim((string) $email));
|
|
$isTester = in_array($cleanEmail, $allowedEmails, true);
|
|
|
|
if (!$email || !$password) {
|
|
echo json_encode(["status" => "failure", "message" => "Email and password are required"]);
|
|
exit();
|
|
}
|
|
|
|
try {
|
|
$con = Database::get('main');
|
|
|
|
$encryptedEmail = $encryptionHelper->encryptData($email);
|
|
global $blindIndex;
|
|
$emailBidx = $blindIndex ? $blindIndex->index('driver.email', $email) : null;
|
|
|
|
$sql = "SELECT
|
|
driver.*,
|
|
phone_verification.is_verified,
|
|
CarRegistration.make,
|
|
CarRegistration.model,
|
|
CarRegistration.year
|
|
FROM driver
|
|
LEFT JOIN phone_verification ON phone_verification.phone_number = driver.phone_key
|
|
LEFT JOIN CarRegistration ON CarRegistration.driverID = driver.id
|
|
WHERE driver.email = :email";
|
|
|
|
$params = [':email' => $encryptedEmail];
|
|
|
|
if ($emailBidx !== null) {
|
|
$sql .= " OR driver.email_bidx = :email_bidx";
|
|
$params[':email_bidx'] = $emailBidx;
|
|
}
|
|
|
|
$sql .= " LIMIT 1";
|
|
|
|
$stmt = $con->prepare($sql);
|
|
$stmt->execute($params);
|
|
|
|
$data = $stmt->fetch(PDO::FETCH_ASSOC);
|
|
|
|
if ($data) {
|
|
$isTestInDb = (isset($data['is_test']) && $data['is_test'] == 1) || (isset($data['isTest']) && $data['isTest'] == 1);
|
|
if (!$isTestInDb && !$isTester) {
|
|
jsonError("Access denied. Not a tester account.");
|
|
exit();
|
|
}
|
|
|
|
if (password_verify($password, $data['password'] ?? '')) {
|
|
unset($data['password']);
|
|
|
|
if(isset($data['phone'])) $data['phone'] = $encryptionHelper->decryptData($data['phone']);
|
|
if(isset($data['email'])) $data['email'] = $encryptionHelper->decryptData($data['email']);
|
|
if(isset($data['gender'])) $data['gender'] = $encryptionHelper->decryptData($data['gender']);
|
|
if(isset($data['birthdate'])) $data['birthdate'] = $encryptionHelper->decryptData($data['birthdate']);
|
|
if(isset($data['site'])) $data['site'] = $encryptionHelper->decryptData($data['site']);
|
|
if(isset($data['first_name'])) $data['first_name'] = $encryptionHelper->decryptData($data['first_name']);
|
|
if(isset($data['last_name'])) $data['last_name'] = $encryptionHelper->decryptData($data['last_name']);
|
|
|
|
$jwtService = new JwtService($redis);
|
|
$jwt = $jwtService->generateAccessToken($data['id'], 'tester', $audience, $fingerprint);
|
|
|
|
echo json_encode([
|
|
"status" => "success",
|
|
"jwt" => $jwt,
|
|
"data" => [$data]
|
|
], JSON_UNESCAPED_UNICODE);
|
|
} else {
|
|
jsonError("Incorrect password.");
|
|
}
|
|
} else {
|
|
jsonError("User does not exist.");
|
|
}
|
|
} catch (Throwable $e) {
|
|
error_log("[Tester Login Error] " . $e->getMessage() . " in " . $e->getFile() . ":" . $e->getLine());
|
|
jsonError("Server error occurred: " . $e->getMessage() . " in " . basename($e->getFile()) . ":" . $e->getLine());
|
|
} finally {
|
|
$stmt = null;
|
|
$con = null;
|
|
}
|
|
exit();
|
|
?>
|