Stage 1 narrowed GET /customers but did not close the leak: the response still
carried every customer id, and /customers/:id, /:id/orders and
/:id/ledger-entries were still public, so the full customer book was still two
requests away. The user caught this. Stage 2 deletes the id-bearing surface.
Customer JWT, separate from the admin one (T1):
- new src/modules/customer-auth/ with its own passport strategy,
CustomerJwtGuard, @CustomerAuth() and @CurrentCustomer()
- signed with JWT_CUSTOMER_SECRET, and every token carries typ:'customer'
which the strategy verifies; both checks are present deliberately
- customer state re-read per request, so deactivating takes effect at once
- mirrors the reference's own split: auth:api vs auth('api-customer')
Real OTP (D6), porting ApiMobileController::userAuth/userVerfiy (:39-64):
- new CustomerOtp table, additive migration, nothing existing touched
- parity behaviour: rand(1000,9999), active-customer filter, faTOen digit
normalisation on both number and code, rejection on mismatch
- approved improvements over the reference: bcrypt-hashed code, 2-minute
expiry, 5 attempts then lockout, single use, send throttle (60s per
number, 5/number and 20/IP per 10 min), and no number enumeration
Routes removed, replaced by token-derived equivalents:
GET customers, customers/:id, /:id/orders, /:id/ledger-entries
-> GET customer/me, customer/me/orders, customer/me/ledger-entries
No route accepts a customer id any more, so the IDOR is closed structurally
rather than by a check. The admin panel was unaffected (admin/customers-omde/*).
Both apps migrated in the same commit per the v1/v2 parity rule: token-based
session store, Bearer header, 401 -> clear session and route to login, real
two-step OTP login. Each app keeps its own markup and styling; only logic moved.
Tests: auth-smoke.sh extended with the stage-2 assertions, 46 passed 0 failed
against a live server. jest installed dev-only (user-approved) so pnpm test
works for the first time: 7 passed covering faToEn, which moved to its own
digits.ts to be testable without booting Nest. Typecheck clean on api,
user-app and user-app-v2; both apps build.
[ref: henza_server ApiMobileController.php:39-78]
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
217 lines
5.4 KiB
Vue
217 lines
5.4 KiB
Vue
<!--
|
|
Ported from legacy henza_pwa/src/views/user/src/components/profile.vue,
|
|
restyled into the redesigned design language (see components/home/* and
|
|
HomeView).
|
|
|
|
Heavily simplified when first ported, and still is — legacy's original (971
|
|
lines, the largest view in the app) is a full edit form (bank info, KYC
|
|
document uploads, sub-user management for banker accounts). None of that has
|
|
a backend to back it: there's no update-customer endpoint, no
|
|
document-upload endpoint, and (as in DashboardView) no banker/sub-account
|
|
concept in the new Customer model at all. Kept: the real read-only info
|
|
card, all backed by fields the API genuinely returns.
|
|
|
|
DROPPED, unchanged from the previous version: "تکمیل پروفایل", the
|
|
"افزودن کاربر" sub-user FAB, and the "کارشناس فروش" contact card — that last
|
|
one needs the referring AdminUser's name/mobile, which GET /customers/:id
|
|
does not expose (only referredByAgentId, a bare id).
|
|
-->
|
|
<template>
|
|
<div class="prof">
|
|
<PageBar title="اطلاعات کاربری" back-to="userPage::hasSubRoute" />
|
|
|
|
<container class="prof__body">
|
|
<!-- Identity -->
|
|
<section class="prof__identity">
|
|
<div class="prof__avatar" aria-hidden="true">
|
|
<Icon icon="vuesax-linear:user" size="30" />
|
|
</div>
|
|
<h2 class="prof__name">{{ customer?.fullName ?? '—' }}</h2>
|
|
<p v-if="customer" class="prof__mobile">{{ customer.mobile }}</p>
|
|
<span v-if="customer" class="prof__seal" :class="isVerified ? 'is-ok' : 'is-pending'">
|
|
{{ VERIFICATION_LABELS[customer.verificationStep] ?? customer.verificationStep }}
|
|
</span>
|
|
</section>
|
|
|
|
<!-- Real, read-only fields -->
|
|
<section v-if="customer" class="prof__block">
|
|
<SectionHead title="مشخصات" subtitle="اطلاعات ثبتشده حساب شما" />
|
|
<dl class="prof__specs">
|
|
<div class="prof__spec">
|
|
<dt>نام و نام خانوادگی</dt>
|
|
<dd>{{ customer.fullName }}</dd>
|
|
</div>
|
|
<div class="prof__spec">
|
|
<dt>تلفن همراه</dt>
|
|
<dd>{{ customer.mobile }}</dd>
|
|
</div>
|
|
<div class="prof__spec">
|
|
<dt>کد ملی</dt>
|
|
<dd>{{ customer.nationalCode }}</dd>
|
|
</div>
|
|
<div class="prof__spec">
|
|
<dt>وضعیت احراز هویت</dt>
|
|
<dd>{{ VERIFICATION_LABELS[customer.verificationStep] ?? customer.verificationStep }}</dd>
|
|
</div>
|
|
</dl>
|
|
</section>
|
|
|
|
<section v-else-if="!loading" class="prof__empty">
|
|
<Icon icon="vuesax-linear:user" size="26" />
|
|
<p>اطلاعات حساب در دسترس نیست.</p>
|
|
</section>
|
|
</container>
|
|
</div>
|
|
</template>
|
|
|
|
<script setup lang="ts">
|
|
import { computed, onMounted, ref } from 'vue'
|
|
import Icon from '../../components/icon/Icon.vue'
|
|
import PageBar from '../../components/ui/PageBar.vue'
|
|
import SectionHead from '../../components/home/SectionHead.vue'
|
|
import { useSessionStore } from '../../stores/session'
|
|
import { api, type CustomerDetail } from '../../api/client'
|
|
|
|
const VERIFICATION_LABELS: Record<string, string> = {
|
|
UNVERIFIED: 'احراز نشده',
|
|
STEP_ONE_SUBMITTED: 'مرحله اول ثبت شده',
|
|
STEP_TWO_SUBMITTED: 'مرحله دوم ثبت شده',
|
|
VERIFIED: 'تایید شده',
|
|
}
|
|
|
|
const session = useSessionStore()
|
|
const customer = ref<CustomerDetail | null>(null)
|
|
const loading = ref(false)
|
|
|
|
const isVerified = computed(() => customer.value?.verificationStep === 'VERIFIED')
|
|
|
|
onMounted(async () => {
|
|
if (!session.isLoggedIn) return
|
|
loading.value = true
|
|
try {
|
|
customer.value = await api.getMe()
|
|
} finally {
|
|
loading.value = false
|
|
}
|
|
})
|
|
</script>
|
|
|
|
<style scoped lang="less">
|
|
.prof {
|
|
background: @canvas;
|
|
min-height: 100vh;
|
|
}
|
|
|
|
.prof__body {
|
|
padding-top: 80px;
|
|
padding-bottom: 90px;
|
|
}
|
|
|
|
.prof__identity {
|
|
display: flex;
|
|
flex-direction: column;
|
|
align-items: center;
|
|
text-align: center;
|
|
padding: 26px 20px 28px;
|
|
border: 1px solid @hairline;
|
|
border-radius: 20px;
|
|
background: @canvasSoft;
|
|
}
|
|
|
|
.prof__avatar {
|
|
width: 72px;
|
|
height: 72px;
|
|
border-radius: 50%;
|
|
display: grid;
|
|
place-items: center;
|
|
color: @wine;
|
|
background: @wineWash;
|
|
}
|
|
|
|
.prof__name {
|
|
margin: 14px 0 0;
|
|
font-size: 15.5px;
|
|
font-weight: 800;
|
|
color: @ink;
|
|
}
|
|
|
|
.prof__mobile {
|
|
margin: 6px 0 0;
|
|
font-size: 12.5px;
|
|
color: @inkMuted;
|
|
direction: ltr;
|
|
}
|
|
|
|
.prof__seal {
|
|
margin-top: 12px;
|
|
padding: 5px 12px;
|
|
border-radius: 999px;
|
|
font-size: 11px;
|
|
font-weight: 700;
|
|
}
|
|
|
|
.prof__seal.is-ok {
|
|
color: @green;
|
|
background: #f0fdf4;
|
|
}
|
|
|
|
.prof__seal.is-pending {
|
|
color: @wine;
|
|
background: @wineWash;
|
|
}
|
|
|
|
.prof__block {
|
|
margin-top: 26px;
|
|
}
|
|
|
|
.prof__specs {
|
|
margin: 0;
|
|
border: 1px solid @hairline;
|
|
border-radius: 18px;
|
|
overflow: hidden;
|
|
}
|
|
|
|
.prof__spec {
|
|
display: flex;
|
|
align-items: center;
|
|
justify-content: space-between;
|
|
gap: 14px;
|
|
padding: 13px 14px;
|
|
border-bottom: 1px solid @hairlineSoft;
|
|
}
|
|
|
|
.prof__spec:last-child {
|
|
border-bottom: 0;
|
|
}
|
|
|
|
.prof__spec dt {
|
|
margin: 0;
|
|
font-size: 12px;
|
|
color: @inkFaint;
|
|
}
|
|
|
|
.prof__spec dd {
|
|
margin: 0;
|
|
font-size: 12.5px;
|
|
font-weight: 700;
|
|
color: @ink;
|
|
text-align: left;
|
|
}
|
|
|
|
.prof__empty {
|
|
margin-top: 26px;
|
|
padding: 34px 20px;
|
|
border: 1px dashed @hairline;
|
|
border-radius: 18px;
|
|
display: flex;
|
|
flex-direction: column;
|
|
align-items: center;
|
|
gap: 10px;
|
|
color: @inkFaint;
|
|
}
|
|
.prof__empty p {
|
|
margin: 0;
|
|
font-size: 12.5px;
|
|
}
|
|
</style>
|