feat(phase-1): complete backend core, savings ledger, multi-channel auth, and dynamic QR verification

backend/app/Services/QrTokenService.php

@@ -60,8 +60,13 @@ class QrTokenService
     /**
      * Verifies a QR token scanned by a hospital or hotel receptionist.
      */
-    public static function verifyScannedToken(string $token, int $partnerId, ?string $staffName = null): array
-    {
+    public static function verifyScannedToken(
+        string $token,
+        int $partnerId,
+        ?string $staffName = null,
+        float $billAmount = 0.0,
+        string $serviceName = 'استخدام خدمات الشريك'
+    ): array {
         // Decode base64 payload to get user ID without signature first
         $parts = explode('.', $token);
         if (count($parts) !== 2) {
@@ -126,6 +131,32 @@ class QrTokenService
             ':sig' => substr($parts[1], 0, 64),
         ]);
 
+        $savedAmount = 0.0;
+        $paidAmount = 0.0;
+
+        // Record savings into savings_ledger if bill amount is provided
+        if ($billAmount > 0) {
+            $savedAmount = round($billAmount * ($discount / 100.0), 2);
+            $paidAmount = round($billAmount - $savedAmount, 2);
+
+            $saveStmt = $pdo->prepare('
+                INSERT INTO savings_ledger 
+                (subscription_id, user_id, partner_id, service_name, original_amount, discount_percentage, saved_amount, paid_amount, currency, verified_by_staff, created_at)
+                VALUES (:sub_id, :uid, :pid, :sname, :orig, :disc, :saved, :paid, "IQD", :staff, NOW())
+            ');
+            $saveStmt->execute([
+                ':sub_id' => $record['sub_id'],
+                ':uid' => $record['user_id'],
+                ':pid' => $partnerId,
+                ':sname' => $serviceName,
+                ':orig' => $billAmount,
+                ':disc' => $discount,
+                ':saved' => $savedAmount,
+                ':paid' => $paidAmount,
+                ':staff' => $staffName ?: 'Front Desk',
+            ]);
+        }
+
         return [
             'success' => true,
             'is_valid' => true,
@@ -136,6 +167,9 @@ class QrTokenService
             'expires_at' => $record['expires_at'],
             'partner_name' => $partner['name_ar'] ?? 'Partner',
             'discount_percentage' => $discount,
+            'original_bill_iqd' => $billAmount,
+            'saved_amount_iqd' => $savedAmount,
+            'paid_amount_iqd' => $paidAmount,
             'verified_at' => date('Y-m-d H:i:s'),
         ];
     }