Initial commit: Uruk Prize Platform architecture, backend core, mobile app, gateway caller & deployment pipeline

backend/app/Middlewares/AuthMiddleware.php

@@ -0,0 +1,54 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Middlewares;
+
+use Core\Middleware;
+use Core\Request;
+use Core\Response;
+use Core\Database;
+use PDO;
+
+class AuthMiddleware extends Middleware
+{
+    public function handle(Request $request, callable $next): void
+    {
+        $authHeader = $request->getHeader('authorization');
+        if (empty($authHeader) || !str_starts_with($authHeader, 'Bearer ')) {
+            Response::unauthorized('Bearer token required in Authorization header.');
+        }
+
+        $token = substr($authHeader, 7);
+        $userId = $request->getHeader('x-user-id');
+
+        try {
+            $pdo = Database::getConnection();
+            $stmt = $pdo->prepare('
+                SELECT u.id, u.phone, u.full_name, u.role, u.status, us.last_token
+                FROM users u
+                JOIN user_security us ON us.user_id = u.id
+                WHERE u.id = :user_id AND us.last_token = :token
+                LIMIT 1
+            ');
+            $stmt->execute([
+                ':user_id' => $userId,
+                ':token' => $token,
+            ]);
+            $user = $stmt->fetch(PDO::FETCH_ASSOC);
+
+            if (!$user) {
+                Response::unauthorized('Invalid or expired authentication session token.');
+            }
+
+            if ($user['status'] !== 'ACTIVE' && $user['status'] !== 'PENDING_VERIFICATION') {
+                Response::forbidden('User account is not currently active.');
+            }
+
+        } catch (\Throwable $e) {
+            Response::error('Authentication verification failure: ' . $e->getMessage(), 500);
+        }
+
+        $next($request);
+    }
+}