Spaces:

moustafa7
/

flwo

Runtime error

App Files Files Community

flwo / PHASE_2_BACKEND.md

moustafa7

Initial commit

24727a3 4 months ago

preview code

Raw History Blame Contribute Delete

54.5 kB

DesignFlow — المرحلة الثانية: Backend + PostgreSQL + Security

للـ AI المنفذ: اقرأ هذا الملف كاملاً قبل كتابة أي سطر كود.
كل قرار أمني هنا إلزامي وليس اختيارياً. ترتيب التنفيذ مهم.
لا تبدأ ربط الـ Frontend إلا بعد اختبار كل endpoint بـ Postman/Thunder Client.

1. إعداد المشروع

mkdir apps/server && cd apps/server
npm init -y

# Core
npm install express cors helmet cookie-parser express-rate-limit

# Database
npm install prisma @prisma/client
npx prisma init

# Redis
npm install ioredis

# Auth & Security
npm install bcryptjs jsonwebtoken

# Validation
npm install zod

# File Upload
npm install multer
npm install cloudinary multer-storage-cloudinary

# Real-time
npm install socket.io

# Utilities
npm install uuid dotenv morgan compression

# Dev
npm install -D nodemon jest supertest

1.1 هيكل مجلدات الـ Backend الكامل

apps/server/
├── prisma/
│   ├── schema.prisma
│   └── migrations/
│       └── (auto-generated)
│
├── src/
│   ├── config/
│   │   ├── index.js          ← env validation + config object
│   │   ├── database.js       ← Prisma singleton
│   │   └── redis.js          ← ioredis singleton
│   │
│   ├── middleware/
│   │   ├── auth.js           ← verifyToken, requireRole
│   │   ├── validate.js       ← zod validation wrapper
│   │   ├── rateLimiter.js    ← rate limit factories
│   │   ├── upload.js         ← multer + cloudinary config
│   │   └── errorHandler.js   ← global error handler
│   │
│   ├── modules/
│   │   ├── auth/
│   │   │   ├── auth.routes.js
│   │   │   ├── auth.controller.js
│   │   │   ├── auth.service.js
│   │   │   └── auth.schema.js
│   │   ├── users/
│   │   │   ├── users.routes.js
│   │   │   ├── users.controller.js
│   │   │   ├── users.service.js
│   │   │   └── users.schema.js
│   │   ├── templates/
│   │   │   ├── templates.routes.js
│   │   │   ├── templates.controller.js
│   │   │   ├── templates.service.js
│   │   │   └── templates.schema.js
│   │   ├── orders/
│   │   │   ├── orders.routes.js
│   │   │   ├── orders.controller.js
│   │   │   ├── orders.service.js
│   │   │   └── orders.schema.js
│   │   ├── chat/
│   │   │   ├── chat.routes.js
│   │   │   ├── chat.controller.js
│   │   │   ├── chat.service.js
│   │   │   └── chat.gateway.js   ← socket.io handlers
│   │   ├── admin/
│   │   │   ├── admin.routes.js
│   │   │   ├── admin.controller.js
│   │   │   └── admin.service.js
│   │   └── landing/
│   │       ├── landing.routes.js
│   │       ├── landing.controller.js
│   │       └── landing.service.js
│   │
│   ├── lib/
│   │   ├── jwt.js            ← sign/verify helpers
│   │   ├── AppError.js       ← custom error class
│   │   └── pagination.js     ← pagination helper
│   │
│   ├── socket/
│   │   └── index.js          ← socket.io setup
│   │
│   ├── app.js               ← express app (no listen)
│   └── server.js            ← http server + socket + listen
│
├── tests/
│   ├── unit/
│   │   ├── auth.service.test.js
│   │   ├── jwt.test.js
│   │   └── validation.test.js
│   └── integration/
│       ├── auth.test.js
│       ├── templates.test.js
│       ├── orders.test.js
│       └── chat.test.js
│
├── .env
├── .env.example
├── .env.test
├── ecosystem.config.js      ← PM2 config
└── package.json

2. Environment Variables

# apps/server/.env.example

# ===== App =====
NODE_ENV=development
PORT=5000
CLIENT_URL=http://localhost:5173
# CRITICAL: غير المسار ده في الـ production
ADMIN_ROUTE_HINT=x9k2-manage

# ===== Database =====
# Connection string مع PgBouncer في الـ production
DATABASE_URL="postgresql://designflow_user:StrongPassword123!@localhost:5432/designflow_db?schema=public"
# للـ testing: قاعدة منفصلة
DATABASE_URL_TEST="postgresql://designflow_user:StrongPassword123!@localhost:5432/designflow_test?schema=public"

# ===== Redis =====
REDIS_URL="redis://localhost:6379"
REDIS_PASSWORD=""   # فاضي في dev، في production لازم يكون موجود

# ===== JWT =====
# CRITICAL: استخدم openssl rand -base64 64 لتوليد secrets حقيقية
JWT_ACCESS_SECRET="CHANGE_ME_USE_OPENSSL_RAND_64_CHARS_MINIMUM_HERE"
JWT_REFRESH_SECRET="CHANGE_ME_DIFFERENT_FROM_ACCESS_SECRET_HERE"
JWT_ACCESS_EXPIRES="15m"
JWT_REFRESH_EXPIRES="7d"

# ===== Cloudinary =====
CLOUDINARY_CLOUD_NAME=""
CLOUDINARY_API_KEY=""
CLOUDINARY_API_SECRET=""

# ===== Rate Limiting =====
RATE_LIMIT_WINDOW_MS=900000    # 15 دقيقة
RATE_LIMIT_MAX_GENERAL=100
RATE_LIMIT_MAX_AUTH=5
RATE_LIMIT_MAX_REGISTER=3

3. Config Layer

// src/config/index.js
import { z } from 'zod'
import dotenv from 'dotenv'
dotenv.config()

// Validate ENV vars عند الـ startup — تقف التطبيق لو فيه حاجة ناقصة
const envSchema = z.object({
  NODE_ENV:           z.enum(['development', 'production', 'test']).default('development'),
  PORT:               z.string().default('5000').transform(Number),
  CLIENT_URL:         z.string().url(),
  DATABASE_URL:       z.string().url(),
  REDIS_URL:          z.string(),
  JWT_ACCESS_SECRET:  z.string().min(32, 'JWT_ACCESS_SECRET must be at least 32 chars'),
  JWT_REFRESH_SECRET: z.string().min(32, 'JWT_REFRESH_SECRET must be at least 32 chars'),
  JWT_ACCESS_EXPIRES: z.string().default('15m'),
  JWT_REFRESH_EXPIRES:z.string().default('7d'),
  CLOUDINARY_CLOUD_NAME: z.string(),
  CLOUDINARY_API_KEY:    z.string(),
  CLOUDINARY_API_SECRET: z.string(),
})

const parsed = envSchema.safeParse(process.env)
if (!parsed.success) {
  console.error('❌ Invalid environment variables:', parsed.error.flatten().fieldErrors)
  process.exit(1)
}

export const config = parsed.data

// src/config/database.js
import { PrismaClient } from '@prisma/client'

// Singleton — لا تعمل instance جديدة في كل request
const globalForPrisma = globalThis

export const prisma = globalForPrisma.prisma ?? new PrismaClient({
  log: process.env.NODE_ENV === 'development' ? ['query', 'error'] : ['error'],
})

if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma

// اختبار الاتصال
export async function connectDB() {
  try {
    await prisma.$connect()
    console.log('✅ PostgreSQL connected')
  } catch (err) {
    console.error('❌ Database connection failed:', err)
    process.exit(1)
  }
}

// src/config/redis.js
import Redis from 'ioredis'
import { config } from './index.js'

export const redis = new Redis(config.REDIS_URL, {
  password: process.env.REDIS_PASSWORD || undefined,
  retryStrategy: (times) => Math.min(times * 100, 3000),  // retry مع backoff
  maxRetriesPerRequest: 3,
  enableReadyCheck: true,
})

redis.on('connect', () => console.log('✅ Redis connected'))
redis.on('error', (err) => console.error('❌ Redis error:', err))

4. Prisma Schema الكامل

// prisma/schema.prisma
generator client {
  provider = "prisma-client-js"
}

datasource db {
  provider = "postgresql"
  url      = env("DATABASE_URL")
}

// ════════════════════════════════════════════
// ENUMS
// ════════════════════════════════════════════

enum Role {
  CLIENT
  SUPPORT
  ADMIN
}

enum OrderStatus {
  PENDING
  ACCEPTED
  IN_PROGRESS
  COMPLETED
  CANCELLED
}

// ════════════════════════════════════════════
// MODELS
// ════════════════════════════════════════════

model User {
  id           String   @id @default(cuid())
  firstName    String   @db.VarChar(50)
  lastName     String   @db.VarChar(50)
  phone        String   @unique @db.VarChar(20)
  email        String   @unique @db.VarChar(255)
  passwordHash String   @db.Text
  avatarUrl    String?  @db.Text
  role         Role     @default(CLIENT)
  isActive     Boolean  @default(true)
  createdAt    DateTime @default(now())
  updatedAt    DateTime @updatedAt

  // Relations
  orders        Order[]
  sentMessages  Message[]    @relation("SentMessages")
  refreshTokens RefreshToken[]

  @@index([email])
  @@index([phone])
  @@index([role])
  @@map("users")
}

model RefreshToken {
  id        String   @id @default(cuid())
  token     String   @unique @db.Text      // hashed token
  userId    String
  user      User     @relation(fields: [userId], references: [id], onDelete: Cascade)
  expiresAt DateTime
  createdAt DateTime @default(now())

  @@index([userId])
  @@index([expiresAt])          // لحذف المنتهية تلقائياً
  @@map("refresh_tokens")
}

model Template {
  id            String   @id @default(cuid())
  title         String   @db.VarChar(100)
  description   String   @db.Text
  category      String   @db.VarChar(50)
  price         Decimal  @db.Decimal(10, 2)
  previewUrl    String   @db.Text
  demoUrl       String?  @db.Text
  tags          String[]
  isPublished   Boolean  @default(false)
  defaultColors Json     // { primary, secondary, accent, text }
  components    Json     // { sections: [...], colorBindings: {...} }
  sortOrder     Int      @default(0)
  createdAt     DateTime @default(now())
  updatedAt     DateTime @updatedAt

  orders Order[]

  @@index([isPublished])
  @@index([category])
  @@index([sortOrder])
  @@map("templates")
}

model Order {
  id            String      @id @default(cuid())
  orderNumber   String      @unique
  userId        String
  user          User        @relation(fields: [userId], references: [id])
  templateId    String
  template      Template    @relation(fields: [templateId], references: [id])
  status        OrderStatus @default(PENDING)
  customization Json        // { sections: [...], colorTokens: {...} }
  totalAmount   Decimal     @db.Decimal(10, 2)
  notes         String?     @db.Text
  createdAt     DateTime    @default(now())
  updatedAt     DateTime    @updatedAt

  conversation Conversation?

  @@index([userId])
  @@index([status])
  @@index([createdAt])
  @@map("orders")
}

model Conversation {
  id        String   @id @default(cuid())
  orderId   String   @unique
  order     Order    @relation(fields: [orderId], references: [id])
  isOpen    Boolean  @default(true)
  createdAt DateTime @default(now())
  updatedAt DateTime @updatedAt

  messages Message[]

  @@map("conversations")
}

model Message {
  id             String       @id @default(cuid())
  conversationId String
  conversation   Conversation @relation(fields: [conversationId], references: [id], onDelete: Cascade)
  senderId       String
  sender         User         @relation("SentMessages", fields: [senderId], references: [id])
  content        String       @db.Text
  isRead         Boolean      @default(false)
  createdAt      DateTime     @default(now())

  @@index([conversationId])
  @@index([createdAt])
  @@index([isRead])
  @@map("messages")
}

model LandingContent {
  id        String   @id @default(cuid())
  section   String   @unique @db.VarChar(50)    // "hero", "features", etc.
  content   Json
  updatedAt DateTime @updatedAt

  @@map("landing_content")
}

4.1 Migration & Seed

# إنشاء migration
npx prisma migrate dev --name init

# توليد Prisma Client
npx prisma generate

# Seed (إنشاء أدمن أولي + landing content)
npx prisma db seed

// prisma/seed.js
import { PrismaClient } from '@prisma/client'
import bcrypt from 'bcryptjs'

const prisma = new PrismaClient()

async function main() {
  // Admin user
  const hashedPass = await bcrypt.hash('Admin@123456', 12)
  await prisma.user.upsert({
    where: { email: 'admin@designflow.com' },
    update: {},
    create: {
      firstName:    'Admin',
      lastName:     'System',
      phone:        '+201000000000',
      email:        'admin@designflow.com',
      passwordHash: hashedPass,
      role:         'ADMIN',
    }
  })

  // Default landing content
  const sections = ['hero', 'features', 'how_it_works', 'testimonials', 'footer']
  for (const section of sections) {
    await prisma.landingContent.upsert({
      where: { section },
      update: {},
      create: { section, content: getDefaultContent(section) }
    })
  }

  console.log('✅ Seed completed')
}

main().catch(console.error).finally(() => prisma.$disconnect())

5. Security Layer — كل الـ Middleware

5.1 AppError Class

// src/lib/AppError.js
export class AppError extends Error {
  constructor(message, statusCode = 500, code = 'INTERNAL_ERROR') {
    super(message)
    this.statusCode = statusCode
    this.code = code
    this.isOperational = true
    Error.captureStackTrace(this, this.constructor)
  }
}

// استخدام موحد في كل مكان:
// throw new AppError('المستخدم غير موجود', 404, 'USER_NOT_FOUND')
// throw new AppError('البيانات غير صحيحة', 400, 'VALIDATION_ERROR')
// throw new AppError('غير مصرح', 401, 'UNAUTHORIZED')
// throw new AppError('ممنوع الوصول', 403, 'FORBIDDEN')

5.2 Global Error Handler

// src/middleware/errorHandler.js
export function errorHandler(err, req, res, next) {
  // Log non-operational errors (programming bugs)
  if (!err.isOperational) {
    console.error('💥 CRITICAL ERROR:', err)
    // في production: أرسل لـ Sentry/DataDog
  }

  // Prisma errors
  if (err.code === 'P2002') {
    return res.status(409).json({ error: 'هذا البريد أو رقم الهاتف مستخدم بالفعل', code: 'DUPLICATE_ENTRY' })
  }
  if (err.code === 'P2025') {
    return res.status(404).json({ error: 'العنصر غير موجود', code: 'NOT_FOUND' })
  }

  // JWT errors
  if (err.name === 'JsonWebTokenError') {
    return res.status(401).json({ error: 'رمز المصادقة غير صحيح', code: 'INVALID_TOKEN' })
  }
  if (err.name === 'TokenExpiredError') {
    return res.status(401).json({ error: 'انتهت صلاحية الجلسة', code: 'TOKEN_EXPIRED' })
  }

  // Zod validation errors
  if (err.name === 'ZodError') {
    return res.status(400).json({ error: 'بيانات غير صحيحة', code: 'VALIDATION_ERROR', details: err.flatten() })
  }

  // Operational errors (expected)
  if (err.isOperational) {
    return res.status(err.statusCode).json({ error: err.message, code: err.code })
  }

  // Unknown errors — لا تكشف التفاصيل
  return res.status(500).json({ error: 'حدث خطأ داخلي', code: 'INTERNAL_ERROR' })
}

5.3 Auth Middleware

// src/middleware/auth.js
import jwt from 'jsonwebtoken'
import { config } from '../config/index.js'
import { redis } from '../config/redis.js'
import { AppError } from '../lib/AppError.js'
import { prisma } from '../config/database.js'

export async function authenticate(req, res, next) {
  try {
    // 1. Extract token
    const authHeader = req.headers.authorization
    if (!authHeader?.startsWith('Bearer ')) {
      throw new AppError('لم يتم توفير رمز المصادقة', 401, 'NO_TOKEN')
    }
    const token = authHeader.split(' ')[1]

    // 2. Check blacklist (Redis) — للـ tokens المُبطلة بعد logout
    const isBlacklisted = await redis.get(`blacklist:${token}`)
    if (isBlacklisted) throw new AppError('رمز المصادقة ملغي', 401, 'TOKEN_REVOKED')

    // 3. Verify JWT
    const decoded = jwt.verify(token, config.JWT_ACCESS_SECRET)

    // 4. Check user still exists and is active
    const user = await prisma.user.findUnique({
      where: { id: decoded.sub },
      select: { id: true, role: true, isActive: true, email: true, firstName: true, lastName: true }
    })

    if (!user || !user.isActive) {
      throw new AppError('المستخدم غير موجود أو محظور', 401, 'USER_NOT_FOUND')
    }

    req.user = user
    next()
  } catch (err) {
    next(err)
  }
}

// Role-based access
export function requireRole(...roles) {
  return (req, res, next) => {
    if (!req.user) return next(new AppError('غير مصادق', 401, 'UNAUTHORIZED'))
    if (!roles.includes(req.user.role)) {
      return next(new AppError('ليس لديك صلاحية', 403, 'FORBIDDEN'))
    }
    next()
  }
}

// Shortcuts
export const requireAdmin   = requireRole('ADMIN')
export const requireSupport = requireRole('ADMIN', 'SUPPORT')

5.4 Validation Middleware

// src/middleware/validate.js
export function validate(schema, source = 'body') {
  return (req, res, next) => {
    const data = source === 'body' ? req.body
               : source === 'params' ? req.params
               : req.query

    const result = schema.safeParse(data)
    if (!result.success) {
      return res.status(400).json({
        error: 'بيانات غير صحيحة',
        code: 'VALIDATION_ERROR',
        details: result.error.flatten().fieldErrors
      })
    }
    req.validatedData = result.data
    next()
  }
}

5.5 Rate Limiters

// src/middleware/rateLimiter.js
import rateLimit from 'express-rate-limit'
import RedisStore from 'rate-limit-redis'
import { redis } from '../config/redis.js'

const makeStore = (prefix) => new RedisStore({
  prefix: `rl:${prefix}:`,
  sendCommand: (...args) => redis.call(...args),
})

// General API rate limit
export const generalLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 100,
  store: makeStore('general'),
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'عدد كبير جداً من الطلبات، حاول بعد 15 دقيقة', code: 'RATE_LIMIT_EXCEEDED' }
})

// Auth endpoints — أشد تقييداً
export const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,
  max: 5,                         // 5 محاولات login فقط
  store: makeStore('login'),
  skipSuccessfulRequests: true,   // لا يحسب الـ successful logins
  message: { error: 'تجاوزت الحد المسموح، حاول بعد 15 دقيقة', code: 'TOO_MANY_LOGIN_ATTEMPTS' }
})

export const registerLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,      // ساعة
  max: 3,
  store: makeStore('register'),
  message: { error: 'حد التسجيل، حاول بعد ساعة', code: 'TOO_MANY_REGISTRATIONS' }
})

// Upload limiter
export const uploadLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,
  max: 20,
  store: makeStore('upload'),
  message: { error: 'حد الرفع، حاول بعد ساعة', code: 'UPLOAD_RATE_LIMIT' }
})

5.6 Upload Middleware

// src/middleware/upload.js
import multer from 'multer'
import { v2 as cloudinary } from 'cloudinary'
import { CloudinaryStorage } from 'multer-storage-cloudinary'
import { config } from '../config/index.js'
import { AppError } from '../lib/AppError.js'

cloudinary.config({
  cloud_name: config.CLOUDINARY_CLOUD_NAME,
  api_key:    config.CLOUDINARY_API_KEY,
  api_secret: config.CLOUDINARY_API_SECRET,
})

const ALLOWED_MIME_TYPES = ['image/jpeg', 'image/png', 'image/webp']
const MAX_FILE_SIZE = 5 * 1024 * 1024  // 5MB

function makeCloudinaryStorage(folder) {
  return new CloudinaryStorage({
    cloudinary,
    params: { folder: `designflow/${folder}`, allowed_formats: ['jpg', 'jpeg', 'png', 'webp'] }
  })
}

function fileFilter(req, file, cb) {
  if (ALLOWED_MIME_TYPES.includes(file.mimetype)) {
    cb(null, true)
  } else {
    cb(new AppError('نوع الملف غير مسموح (فقط JPEG, PNG, WebP)', 400, 'INVALID_FILE_TYPE'))
  }
}

export const uploadAvatar = multer({
  storage: makeCloudinaryStorage('avatars'),
  limits: { fileSize: MAX_FILE_SIZE },
  fileFilter,
}).single('avatar')

export const uploadTemplateImage = multer({
  storage: makeCloudinaryStorage('templates'),
  limits: { fileSize: MAX_FILE_SIZE * 2 },  // 10MB للقوالب
  fileFilter,
}).single('preview')

6. JWT Service

// src/lib/jwt.js
import jwt from 'jsonwebtoken'
import { config } from '../config/index.js'
import { redis } from '../config/redis.js'

export function signAccessToken(userId, role) {
  return jwt.sign(
    { sub: userId, role, type: 'access' },
    config.JWT_ACCESS_SECRET,
    { expiresIn: config.JWT_ACCESS_EXPIRES }
  )
}

export function signRefreshToken(userId) {
  return jwt.sign(
    { sub: userId, type: 'refresh' },
    config.JWT_REFRESH_SECRET,
    { expiresIn: config.JWT_REFRESH_EXPIRES }
  )
}

export function verifyAccessToken(token) {
  return jwt.verify(token, config.JWT_ACCESS_SECRET)
}

export function verifyRefreshToken(token) {
  return jwt.verify(token, config.JWT_REFRESH_SECRET)
}

// Blacklist access token عند الـ logout
export async function blacklistToken(token) {
  const decoded = jwt.decode(token)
  if (!decoded?.exp) return
  const ttl = decoded.exp - Math.floor(Date.now() / 1000)
  if (ttl > 0) await redis.setex(`blacklist:${token}`, ttl, '1')
}

// Socket.IO auth
export async function verifySocketToken(token) {
  try {
    const decoded = verifyAccessToken(token)
    const isBlacklisted = await redis.get(`blacklist:${token}`)
    if (isBlacklisted) return null
    return decoded
  } catch {
    return null
  }
}

7. Auth Module الكامل

7.1 Schemas

// src/modules/auth/auth.schema.js
import { z } from 'zod'

export const registerSchema = z.object({
  firstName:       z.string().min(2).max(50).regex(/^[\p{L}\s]+$/u, 'اسم غير صحيح'),
  lastName:        z.string().min(2).max(50).regex(/^[\p{L}\s]+$/u, 'اسم غير صحيح'),
  phone:           z.string().regex(/^\+?[0-9]{10,15}$/, 'رقم هاتف غير صحيح'),
  email:           z.string().email('بريد إلكتروني غير صحيح').toLowerCase(),
  password:        z.string()
                    .min(8, 'كلمة المرور 8 أحرف على الأقل')
                    .regex(/^(?=.*[A-Z])/, 'يجب أن تحتوي على حرف كبير')
                    .regex(/^(?=.*[0-9])/, 'يجب أن تحتوي على رقم')
                    .regex(/^(?=.*[^A-Za-z0-9])/, 'يجب أن تحتوي على رمز خاص'),
  confirmPassword: z.string()
}).refine(d => d.password === d.confirmPassword, {
  message: 'كلمتا المرور غير متطابقتان',
  path: ['confirmPassword']
})

export const loginSchema = z.object({
  email:    z.string().email().toLowerCase(),
  password: z.string().min(1)
})

export const changePasswordSchema = z.object({
  currentPassword: z.string().min(1),
  newPassword:     z.string().min(8)
                    .regex(/^(?=.*[A-Z])(?=.*[0-9])(?=.*[^A-Za-z0-9]).+$/)
})

7.2 Service

// src/modules/auth/auth.service.js
import bcrypt from 'bcryptjs'
import { v4 as uuidv4 } from 'uuid'
import { prisma } from '../../config/database.js'
import { redis } from '../../config/redis.js'
import { signAccessToken, signRefreshToken, verifyRefreshToken, blacklistToken } from '../../lib/jwt.js'
import { AppError } from '../../lib/AppError.js'

const BCRYPT_ROUNDS = 12
const REFRESH_TOKEN_EXPIRES_DAYS = 7

export async function registerUser(data, avatarUrl = null) {
  // Check duplicates
  const existing = await prisma.user.findFirst({
    where: { OR: [{ email: data.email }, { phone: data.phone }] }
  })
  if (existing) {
    const field = existing.email === data.email ? 'البريد الإلكتروني' : 'رقم الهاتف'
    throw new AppError(`${field} مستخدم بالفعل`, 409, 'DUPLICATE_ENTRY')
  }

  const passwordHash = await bcrypt.hash(data.password, BCRYPT_ROUNDS)
  const user = await prisma.user.create({
    data: {
      firstName: data.firstName,
      lastName:  data.lastName,
      phone:     data.phone,
      email:     data.email,
      passwordHash,
      avatarUrl,
      role: 'CLIENT'
    },
    select: { id: true, firstName: true, lastName: true, email: true, role: true, avatarUrl: true }
  })

  const { accessToken, refreshToken } = await createTokenPair(user.id, user.role)
  return { user, accessToken, refreshToken }
}

export async function loginUser(email, password) {
  const user = await prisma.user.findUnique({
    where: { email },
    select: { id: true, firstName: true, lastName: true, email: true, role: true, avatarUrl: true, passwordHash: true, isActive: true }
  })

  // SECURITY: نفس الـ error message للـ user غير الموجود والـ password الغلط
  // منع User Enumeration attacks
  const isValid = user ? await bcrypt.compare(password, user.passwordHash) : await bcrypt.hash(password, 1)
  if (!user || !isValid) throw new AppError('بيانات تسجيل الدخول غير صحيحة', 401, 'INVALID_CREDENTIALS')
  if (!user.isActive) throw new AppError('الحساب موقوف، تواصل مع الدعم', 403, 'ACCOUNT_SUSPENDED')

  const { accessToken, refreshToken } = await createTokenPair(user.id, user.role)
  const { passwordHash, ...safeUser } = user
  return { user: safeUser, accessToken, refreshToken }
}

export async function refreshUserToken(oldRefreshToken) {
  if (!oldRefreshToken) throw new AppError('لم يتم توفير refresh token', 401, 'NO_REFRESH_TOKEN')

  // Verify the JWT
  let decoded
  try { decoded = verifyRefreshToken(oldRefreshToken) }
  catch { throw new AppError('Refresh token منتهي أو غير صحيح', 401, 'INVALID_REFRESH_TOKEN') }

  // Check exists in DB (rotation: كل refresh → delete old, create new)
  const hashedOld = await hashToken(oldRefreshToken)
  const stored = await prisma.refreshToken.findUnique({ where: { token: hashedOld } })
  if (!stored || stored.expiresAt < new Date()) {
    // Possible token reuse attack — revoke all user tokens
    await prisma.refreshToken.deleteMany({ where: { userId: decoded.sub } })
    throw new AppError('Refresh token غير صحيح', 401, 'REFRESH_TOKEN_REUSE')
  }

  // Delete old, create new (rotation)
  await prisma.refreshToken.delete({ where: { token: hashedOld } })

  const user = await prisma.user.findUnique({
    where: { id: decoded.sub },
    select: { id: true, firstName: true, lastName: true, email: true, role: true, avatarUrl: true, isActive: true }
  })
  if (!user || !user.isActive) throw new AppError('المستخدم غير موجود', 401, 'USER_NOT_FOUND')

  const { accessToken, refreshToken } = await createTokenPair(user.id, user.role)
  return { user, accessToken, refreshToken }
}

export async function logoutUser(userId, accessToken) {
  // Blacklist current access token
  if (accessToken) await blacklistToken(accessToken)

  // Delete all refresh tokens for this user
  await prisma.refreshToken.deleteMany({ where: { userId } })
}

// ─── Helpers ───
async function createTokenPair(userId, role) {
  const accessToken  = signAccessToken(userId, role)
  const refreshToken = signRefreshToken(userId)

  const hashedRefresh = await hashToken(refreshToken)
  const expiresAt = new Date(Date.now() + REFRESH_TOKEN_EXPIRES_DAYS * 24 * 60 * 60 * 1000)

  await prisma.refreshToken.create({
    data: { token: hashedRefresh, userId, expiresAt }
  })

  return { accessToken, refreshToken }
}

async function hashToken(token) {
  // Hash the refresh token before storing (bcrypt مش ضروري هنا، sha256 كافي)
  const { createHash } = await import('crypto')
  return createHash('sha256').update(token).digest('hex')
}

7.3 Controller

// src/modules/auth/auth.controller.js
import * as authService from './auth.service.js'
import { uploadAvatar } from '../../middleware/upload.js'

const REFRESH_COOKIE_OPTIONS = {
  httpOnly: true,
  secure:   process.env.NODE_ENV === 'production',
  sameSite: 'strict',
  maxAge:   7 * 24 * 60 * 60 * 1000,  // 7 days
  path:     '/api/auth/refresh'         // Scope محدود للكوكي
}

export async function register(req, res, next) {
  try {
    const avatarUrl = req.file?.path || null
    const { user, accessToken, refreshToken } = await authService.registerUser(req.validatedData, avatarUrl)

    res.cookie('refresh_token', refreshToken, REFRESH_COOKIE_OPTIONS)
    res.status(201).json({ user, accessToken })
  } catch (err) { next(err) }
}

export async function login(req, res, next) {
  try {
    const { email, password } = req.validatedData
    const { user, accessToken, refreshToken } = await authService.loginUser(email, password)

    res.cookie('refresh_token', refreshToken, REFRESH_COOKIE_OPTIONS)
    res.json({ user, accessToken })
  } catch (err) { next(err) }
}

export async function refresh(req, res, next) {
  try {
    const oldToken = req.cookies.refresh_token
    const { user, accessToken, refreshToken } = await authService.refreshUserToken(oldToken)

    res.cookie('refresh_token', refreshToken, REFRESH_COOKIE_OPTIONS)
    res.json({ user, accessToken })
  } catch (err) { next(err) }
}

export async function logout(req, res, next) {
  try {
    const accessToken = req.headers.authorization?.split(' ')[1]
    await authService.logoutUser(req.user.id, accessToken)

    res.clearCookie('refresh_token', { path: '/api/auth/refresh' })
    res.json({ message: 'تم تسجيل الخروج بنجاح' })
  } catch (err) { next(err) }
}

export async function getMe(req, res) {
  res.json(req.user)
}

7.4 Routes

// src/modules/auth/auth.routes.js
import { Router } from 'express'
import { uploadAvatar } from '../../middleware/upload.js'
import { validate } from '../../middleware/validate.js'
import { authenticate } from '../../middleware/auth.js'
import { loginLimiter, registerLimiter } from '../../middleware/rateLimiter.js'
import { registerSchema, loginSchema } from './auth.schema.js'
import * as ctrl from './auth.controller.js'

const router = Router()

router.post('/register', registerLimiter, uploadAvatar, validate(registerSchema), ctrl.register)
router.post('/login',    loginLimiter,    validate(loginSchema), ctrl.login)
router.post('/refresh',  ctrl.refresh)
router.post('/logout',   authenticate, ctrl.logout)
router.get('/me',        authenticate, ctrl.getMe)

export default router

8. Templates Module

8.1 Service (مع Redis Caching)

// src/modules/templates/templates.service.js
import { prisma } from '../../config/database.js'
import { redis } from '../../config/redis.js'
import { AppError } from '../../lib/AppError.js'

const CACHE_TTL = 300  // 5 دقائق
const CACHE_PREFIX = 'templates:'

export async function getPublishedTemplates({ category, search, page = 1, limit = 12 }) {
  const cacheKey = `${CACHE_PREFIX}list:${JSON.stringify({ category, search, page, limit })}`

  // Try cache first
  const cached = await redis.get(cacheKey)
  if (cached) return JSON.parse(cached)

  const where = {
    isPublished: true,
    ...(category && { category }),
    ...(search && {
      OR: [
        { title:       { contains: search, mode: 'insensitive' } },
        { description: { contains: search, mode: 'insensitive' } },
      ]
    })
  }

  const [templates, total] = await Promise.all([
    prisma.template.findMany({
      where,
      select: {
        id: true, title: true, description: true, category: true,
        price: true, previewUrl: true, tags: true, defaultColors: true
      },
      orderBy: [{ sortOrder: 'asc' }, { createdAt: 'desc' }],
      take: limit,
      skip: (page - 1) * limit,
    }),
    prisma.template.count({ where })
  ])

  const result = { templates, total, page, totalPages: Math.ceil(total / limit) }
  await redis.setex(cacheKey, CACHE_TTL, JSON.stringify(result))
  return result
}

export async function getTemplateById(id) {
  const cacheKey = `${CACHE_PREFIX}${id}`
  const cached = await redis.get(cacheKey)
  if (cached) return JSON.parse(cached)

  const template = await prisma.template.findUnique({
    where: { id, isPublished: true },
    select: {
      id: true, title: true, description: true, category: true,
      price: true, previewUrl: true, demoUrl: true, tags: true,
      defaultColors: true, components: true
    }
  })

  if (!template) throw new AppError('القالب غير موجود', 404, 'TEMPLATE_NOT_FOUND')

  await redis.setex(cacheKey, CACHE_TTL, JSON.stringify(template))
  return template
}

// Invalidate cache عند أي تعديل
export async function invalidateTemplateCache(id = null) {
  if (id) await redis.del(`${CACHE_PREFIX}${id}`)
  // Delete all list caches (pattern delete)
  const keys = await redis.keys(`${CACHE_PREFIX}list:*`)
  if (keys.length) await redis.del(...keys)
}

9. Orders Module

// src/modules/orders/orders.service.js
import { prisma } from '../../config/database.js'
import { AppError } from '../../lib/AppError.js'
import { createConversationWithWelcome } from '../chat/chat.service.js'
import { v4 as uuidv4 } from 'uuid'

export async function createOrder(userId, { templateId, customization, notes }) {
  // Verify template exists
  const template = await prisma.template.findUnique({
    where: { id: templateId, isPublished: true },
    select: { id: true, price: true, title: true }
  })
  if (!template) throw new AppError('القالب غير موجود', 404, 'TEMPLATE_NOT_FOUND')

  const order = await prisma.order.create({
    data: {
      orderNumber:   `ORD-${Date.now()}-${uuidv4().slice(0, 6).toUpperCase()}`,
      userId,
      templateId,
      customization,
      totalAmount:   template.price,
      notes,
      status:        'PENDING'
    },
    include: { template: { select: { title: true, previewUrl: true } } }
  })

  return order
}

export async function getUserOrders(userId, { page = 1, limit = 10, status }) {
  const where = { userId, ...(status && { status }) }
  const [orders, total] = await Promise.all([
    prisma.order.findMany({
      where,
      include: {
        template: { select: { title: true, previewUrl: true, category: true } },
        conversation: { select: { id: true, isOpen: true } }
      },
      orderBy: { createdAt: 'desc' },
      take: limit,
      skip: (page - 1) * limit,
    }),
    prisma.order.count({ where })
  ])
  return { orders, total, totalPages: Math.ceil(total / limit) }
}

// Admin: تغيير حالة الطلب
export async function updateOrderStatus(orderId, newStatus, adminId) {
  const order = await prisma.order.findUnique({
    where: { id: orderId },
    include: { conversation: true }
  })
  if (!order) throw new AppError('الطلب غير موجود', 404, 'ORDER_NOT_FOUND')

  const updated = await prisma.order.update({
    where: { id: orderId },
    data:  { status: newStatus }
  })

  // لما الطلب يتقبل → رسالة تلقائية للعميل
  if (newStatus === 'ACCEPTED') {
    await createConversationWithWelcome(orderId, order.userId, adminId)
  }

  return updated
}

10. Chat Module + Socket.IO

10.1 Chat Service

// src/modules/chat/chat.service.js
import { prisma } from '../../config/database.js'
import { AppError } from '../../lib/AppError.js'

export async function createConversationWithWelcome(orderId, clientId, adminId) {
  // لو موجودة بالفعل → return existing
  const existing = await prisma.conversation.findUnique({ where: { orderId } })
  if (existing) return existing

  const conversation = await prisma.conversation.create({
    data: {
      orderId,
      isOpen: true,
      messages: {
        create: {
          senderId: adminId,
          content:  'مرحباً! تم قبول طلبك وسيتواصل معك فريقنا قريباً لمناقشة التفاصيل. 🎉',
        }
      }
    },
    include: { messages: true }
  })

  return conversation
}

export async function getConversationMessages(conversationId, userId, userRole, { cursor, limit = 20 }) {
  // Verify access
  const conv = await prisma.conversation.findUnique({
    where: { id: conversationId },
    include: { order: { select: { userId: true } } }
  })
  if (!conv) throw new AppError('المحادثة غير موجودة', 404, 'CONVERSATION_NOT_FOUND')

  const isAdmin = ['ADMIN', 'SUPPORT'].includes(userRole)
  if (!isAdmin && conv.order.userId !== userId) {
    throw new AppError('ليس لديك صلاحية الوصول لهذه المحادثة', 403, 'FORBIDDEN')
  }

  const messages = await prisma.message.findMany({
    where: { conversationId },
    include: { sender: { select: { firstName: true, lastName: true, avatarUrl: true, role: true } } },
    orderBy: { createdAt: 'asc' },
    take: limit,
    ...(cursor && { cursor: { id: cursor }, skip: 1 })
  })

  return messages
}

export async function saveMessage(conversationId, senderId, content) {
  // Verify conversation is open
  const conv = await prisma.conversation.findUnique({ where: { id: conversationId } })
  if (!conv?.isOpen) throw new AppError('المحادثة مغلقة', 403, 'CONVERSATION_CLOSED')

  const message = await prisma.message.create({
    data: { conversationId, senderId, content },
    include: { sender: { select: { firstName: true, lastName: true, avatarUrl: true, role: true } } }
  })

  return message
}

10.2 Socket.IO Gateway

// src/modules/chat/chat.gateway.js
import { verifySocketToken } from '../../lib/jwt.js'
import { prisma } from '../../config/database.js'
import { saveMessage } from './chat.service.js'

export function setupChatGateway(io) {
  io.use(async (socket, next) => {
    const token = socket.handshake.auth.token
    const decoded = await verifySocketToken(token)
    if (!decoded) return next(new Error('Unauthorized'))

    // Attach user to socket
    const user = await prisma.user.findUnique({
      where: { id: decoded.sub },
      select: { id: true, firstName: true, lastName: true, role: true, avatarUrl: true }
    })
    if (!user) return next(new Error('User not found'))

    socket.user = user
    next()
  })

  io.on('connection', (socket) => {
    console.log(`🔌 User connected: ${socket.user.id}`)

    // Join personal room
    socket.join(`user:${socket.user.id}`)

    socket.on('join_conversation', async (conversationId) => {
      // Verify access before joining room
      try {
        const conv = await prisma.conversation.findUnique({
          where: { id: conversationId },
          include: { order: { select: { userId: true } } }
        })
        if (!conv) return

        const isAdmin = ['ADMIN', 'SUPPORT'].includes(socket.user.role)
        const isOwner = conv.order.userId === socket.user.id

        if (isAdmin || isOwner) {
          socket.join(`conv:${conversationId}`)
          socket.emit('joined_conversation', { conversationId })
        }
      } catch (err) {
        socket.emit('error', { message: 'خطأ في الانضمام للمحادثة' })
      }
    })

    socket.on('send_message', async ({ conversationId, content }) => {
      try {
        // Input validation
        if (!content?.trim() || content.length > 2000) {
          return socket.emit('error', { message: 'رسالة غير صحيحة' })
        }

        const message = await saveMessage(conversationId, socket.user.id, content.trim())

        // Emit to all in the conversation room
        io.to(`conv:${conversationId}`).emit('new_message', message)

        // Notify the other party (push notification style)
        const conv = await prisma.conversation.findUnique({
          where: { id: conversationId },
          include: { order: { select: { userId: true } } }
        })
        const targetUserId = socket.user.role === 'CLIENT' ? null : conv?.order.userId
        if (targetUserId) {
          io.to(`user:${targetUserId}`).emit('message_notification', {
            conversationId,
            senderName: `${socket.user.firstName} ${socket.user.lastName}`,
            preview: content.slice(0, 50)
          })
        }
      } catch (err) {
        socket.emit('error', { message: err.message })
      }
    })

    socket.on('mark_read', async ({ conversationId }) => {
      await prisma.message.updateMany({
        where: { conversationId, isRead: false, senderId: { not: socket.user.id } },
        data:  { isRead: true }
      })
      io.to(`conv:${conversationId}`).emit('messages_read', { conversationId, readBy: socket.user.id })
    })

    socket.on('disconnect', () => {
      console.log(`🔌 User disconnected: ${socket.user.id}`)
    })
  })
}

11. App.js + Server.js

// src/app.js
import express from 'express'
import helmet from 'helmet'
import cors from 'cors'
import cookieParser from 'cookie-parser'
import compression from 'compression'
import morgan from 'morgan'
import { config } from './config/index.js'
import { generalLimiter } from './middleware/rateLimiter.js'
import { errorHandler } from './middleware/errorHandler.js'

// Routes
import authRoutes      from './modules/auth/auth.routes.js'
import usersRoutes     from './modules/users/users.routes.js'
import templatesRoutes from './modules/templates/templates.routes.js'
import ordersRoutes    from './modules/orders/orders.routes.js'
import chatRoutes      from './modules/chat/chat.routes.js'
import adminRoutes     from './modules/admin/admin.routes.js'
import landingRoutes   from './modules/landing/landing.routes.js'

const app = express()

// ─── Security Headers ───────────────────────────────────
app.use(helmet({
  crossOriginEmbedderPolicy: false,
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      imgSrc: ["'self'", 'data:', 'res.cloudinary.com'],
      connectSrc: ["'self'", config.CLIENT_URL],
    }
  }
}))

// ─── CORS ────────────────────────────────────────────────
app.use(cors({
  origin: (origin, callback) => {
    const allowed = [config.CLIENT_URL, 'http://localhost:5173']
    if (!origin || allowed.includes(origin)) callback(null, true)
    else callback(new Error('Not allowed by CORS'))
  },
  credentials: true,
  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
}))

// ─── Body Parsing ────────────────────────────────────────
app.use(express.json({ limit: '10kb' }))        // منع large JSON payloads
app.use(express.urlencoded({ extended: false }))
app.use(cookieParser())
app.use(compression())

// ─── Logging ─────────────────────────────────────────────
if (config.NODE_ENV !== 'test') {
  app.use(morgan(config.NODE_ENV === 'development' ? 'dev' : 'combined'))
}

// ─── Rate Limiting ───────────────────────────────────────
app.use('/api', generalLimiter)

// ─── Health Check ────────────────────────────────────────
app.get('/health', (req, res) => res.json({ status: 'ok', timestamp: new Date().toISOString() }))

// ─── Routes ──────────────────────────────────────────────
app.use('/api/auth',      authRoutes)
app.use('/api/users',     usersRoutes)
app.use('/api/templates', templatesRoutes)
app.use('/api/orders',    ordersRoutes)
app.use('/api/chat',      chatRoutes)
app.use('/api/admin',     adminRoutes)
app.use('/api/landing',   landingRoutes)

// ─── 404 Handler ─────────────────────────────────────────
app.use('*', (req, res) => {
  res.status(404).json({ error: 'المسار غير موجود', code: 'ROUTE_NOT_FOUND' })
})

// ─── Global Error Handler (MUST be last) ─────────────────
app.use(errorHandler)

export default app

// src/server.js
import { createServer } from 'http'
import { Server as SocketIOServer } from 'socket.io'
import app from './app.js'
import { connectDB } from './config/database.js'
import { redis } from './config/redis.js'
import { setupChatGateway } from './modules/chat/chat.gateway.js'
import { config } from './config/index.js'

async function bootstrap() {
  // Connect DB
  await connectDB()

  // Create HTTP server
  const httpServer = createServer(app)

  // Setup Socket.IO
  const io = new SocketIOServer(httpServer, {
    cors: { origin: config.CLIENT_URL, credentials: true },
    transports: ['websocket', 'polling'],
  })
  setupChatGateway(io)

  // Start server
  httpServer.listen(config.PORT, () => {
    console.log(`🚀 Server running on port ${config.PORT}`)
    console.log(`🌍 Environment: ${config.NODE_ENV}`)
  })

  // Graceful shutdown
  const shutdown = async (signal) => {
    console.log(`\n${signal} received. Shutting down gracefully...`)
    httpServer.close(async () => {
      await prisma.$disconnect()
      await redis.quit()
      console.log('✅ Server closed.')
      process.exit(0)
    })
    setTimeout(() => process.exit(1), 10000)  // Force exit after 10s
  }

  process.on('SIGTERM', () => shutdown('SIGTERM'))
  process.on('SIGINT',  () => shutdown('SIGINT'))

  // Unhandled rejections
  process.on('unhandledRejection', (reason) => {
    console.error('💥 Unhandled Rejection:', reason)
    shutdown('UNHANDLED_REJECTION')
  })
}

bootstrap()

12. Admin Routes الكاملة

// src/modules/admin/admin.routes.js
import { Router } from 'express'
import { authenticate, requireSupport, requireAdmin } from '../../middleware/auth.js'
import * as ctrl from './admin.controller.js'

const router = Router()

// كل الـ admin routes محمية بـ authenticate + requireSupport/requireAdmin
router.use(authenticate)

// Overview
router.get('/stats', requireAdmin, ctrl.getStats)

// Orders
router.get('/orders',                   requireSupport, ctrl.getAllOrders)
router.get('/orders/:id',               requireSupport, ctrl.getOrderById)
router.patch('/orders/:id/status',      requireSupport, ctrl.updateOrderStatus)
router.post('/orders/:id/conversation', requireSupport, ctrl.openConversation)

// Templates (Admin only — مش Support)
router.get('/templates',                requireAdmin, ctrl.getAllTemplates)
router.post('/templates',               requireAdmin, uploadTemplateImage, ctrl.createTemplate)
router.put('/templates/:id',            requireAdmin, ctrl.updateTemplate)
router.delete('/templates/:id',         requireAdmin, ctrl.deleteTemplate)
router.patch('/templates/:id/publish',  requireAdmin, ctrl.togglePublish)

// Landing Content
router.get('/landing',            requireAdmin, ctrl.getLandingContent)
router.put('/landing/:section',   requireAdmin, ctrl.updateLandingSection)

// Users
router.get('/users',      requireAdmin, ctrl.getUsers)
router.get('/users/:id',  requireAdmin, ctrl.getUserById)

// Conversations
router.get('/conversations', requireSupport, ctrl.getConversations)

export default router

13. PostgreSQL Performance

13.1 Connection Pooling

// DATABASE_URL مع PgBouncer في الـ production:
// postgresql://user:pass@pgbouncer:6432/designflow?pgbouncer=true&connection_limit=5

// أو باستخدام Prisma's built-in pooling:
// DATABASE_URL="postgresql://...?connection_limit=10&pool_timeout=20&connect_timeout=10"

13.2 Indexes Strategy

-- الـ indexes الموجودة في الـ schema كافية للـ queries العادية
-- لكن في الـ production راجع slow query log وأضف indexes حسب الحاجة

-- مثال: لو بتـquery orders بـ userId + status كتير:
-- هو موجود بالفعل في الـ schema كـ @@index([userId]) و @@index([status])

-- لـ full-text search على الـ templates:
CREATE INDEX idx_templates_search ON templates USING gin(to_tsvector('english', title || ' ' || description));

-- EXPLAIN ANALYZE لكل query تاقل في الـ production

13.3 Cron: Cleanup Expired Tokens

// src/jobs/cleanup.js — بيشتغل يومياً
import { prisma } from '../config/database.js'

export async function cleanupExpiredTokens() {
  const deleted = await prisma.refreshToken.deleteMany({
    where: { expiresAt: { lt: new Date() } }
  })
  console.log(`🧹 Deleted ${deleted.count} expired refresh tokens`)
}

// في server.js، اشتغل كل 24 ساعة:
// setInterval(cleanupExpiredTokens, 24 * 60 * 60 * 1000)

14. PM2 Production Config

// ecosystem.config.js
module.exports = {
  apps: [{
    name:      'designflow-api',
    script:    'src/server.js',
    instances: 'max',             // استخدم كل الـ CPU cores
    exec_mode: 'cluster',
    max_memory_restart: '512M',
    error_file:  'logs/error.log',
    out_file:    'logs/out.log',
    merge_logs:  true,
    env_production: {
      NODE_ENV: 'production',
      PORT: 5000,
    },
    // Auto restart on crash
    autorestart:    true,
    watch:          false,
    restart_delay:  5000,
  }]
}

15. Nginx Config (Reverse Proxy)

# /etc/nginx/sites-available/designflow

upstream api_backend {
    least_conn;                    # Load balance بين PM2 instances
    server 127.0.0.1:5000;
    keepalive 32;
}

server {
    listen 443 ssl http2;
    server_name api.designflow.com;

    ssl_certificate     /etc/ssl/certs/designflow.crt;
    ssl_certificate_key /etc/ssl/private/designflow.key;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # Security headers (backup لـ helmet)
    add_header X-Frame-Options       "DENY";
    add_header X-Content-Type-Options "nosniff";
    add_header Referrer-Policy       "strict-origin-when-cross-origin";

    # Rate limiting على مستوى Nginx (قبل ما يوصل Express)
    limit_req_zone $binary_remote_addr zone=api:10m rate=30r/m;
    limit_req zone=api burst=20 nodelay;

    location /api {
        proxy_pass         http://api_backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection 'upgrade';
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;

        # Timeouts
        proxy_connect_timeout 60s;
        proxy_read_timeout    60s;
    }

    # Socket.IO
    location /socket.io {
        proxy_pass         http://api_backend;
        proxy_http_version 1.1;
        proxy_set_header   Upgrade $http_upgrade;
        proxy_set_header   Connection "upgrade";
    }

    # Static files (Frontend build)
    location / {
        root /var/www/designflow/client/dist;
        try_files $uri $uri/ /index.html;
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

# HTTP → HTTPS redirect
server {
    listen 80;
    server_name designflow.com api.designflow.com;
    return 301 https://$host$request_uri;
}

16. Security Audit Checklist

Authentication

Passwords hashed بـ bcrypt (rounds=12)
JWT secrets عشوائية وطويلة (64+ chars)
Access tokens قصيرة العمر (15 دقيقة)
Refresh tokens في httpOnly cookies فقط
Refresh token rotation بعد كل استخدام
Token blacklisting عند الـ logout
User enumeration protection (نفس الـ error لـ user غير موجود + password غلط)
Account lockout عند محاولات كثيرة

Input Validation

Zod validation على كل request body
File type validation (MIME check + extension)
File size limits
JSON size limit (10kb)
SQL Injection: Prisma parameterized queries
XSS Prevention: helmet + content validation

Authorization

كل route محمي بـ authenticate middleware
Role-based access control (CLIENT / SUPPORT / ADMIN)
Resource ownership checks (العميل يشوف طلباته بس)
Admin routes مخفية (404 للغير مصرح)

Infrastructure

HTTPS في الـ production
Rate limiting على كل endpoint حساس
CORS محدود بـ allowed origins فقط
Helmet headers
Compression
Graceful shutdown
Error messages لا تكشف stack traces في الـ production
Logs لا تحتوي على passwords أو tokens

17. Checklist قبل إنهاء المرحلة

كل الـ endpoints شغالة بـ Postman/Thunder Client
Auth flow كامل (register → login → refresh → logout)
Template CRUD + cache
Order creation + status update + auto-conversation
Socket.IO chat (من admin → client وعكسه)
Rate limiting شغال (اختبر بـ 10+ requests متتاليين)
JWT blacklisting بعد logout
File upload يشتغل على Cloudinary
Error handler بيمسك كل الأخطاء
Prisma migrations applied
PM2 cluster mode شغال
/health endpoint بيرجع 200

المرحلة الثانية منتهية — انتقل لـ PHASE_3_TESTING.md