feat: implement server-side validation for mobile numbers and national codes across multiple endpoints

src/Admin/Controller/AdminApiController.php

@@ -4,6 +4,7 @@ namespace App\Admin\Controller;
 
 use App\Appointment\Entity\Appointment;
 use App\Auth\Entity\User;
+use App\Shared\Service\InputValidator;
 use App\Location\Entity\City;
 use App\Clinic\Entity\Clinic;
 use App\Doctor\Entity\Doctor;
@@ -381,12 +382,15 @@ class AdminApiController extends BaseController
     public function createDoctor(Request $request): JsonResponse
     {
         $data   = json_decode($request->getContent(), true) ?? [];
-        $mobile = trim((string) ($data['mobile'] ?? ''));
+        $mobile = InputValidator::toEnglishDigits(trim((string) ($data['mobile'] ?? '')));
         $name   = trim((string) ($data['name'] ?? ''));
 
         if ($mobile === '' || $name === '') {
             return $this->error('VALIDATION', 'موبایل و نام الزامی هستند', 422);
         }
+        if (!InputValidator::isValidIranMobile($mobile)) {
+            return $this->error('VALIDATION', 'شماره موبایل نامعتبر است', 422, 'mobile');
+        }
 
         $user = $this->em->getRepository(User::class)->findOneBy(['mobileNumber' => $mobile]);
         if (!$user) {
@@ -491,12 +495,15 @@ class AdminApiController extends BaseController
     public function createClinic(Request $request): JsonResponse
     {
         $data   = json_decode($request->getContent(), true) ?? [];
-        $mobile = trim((string) ($data['owner_mobile'] ?? ''));
+        $mobile = InputValidator::toEnglishDigits(trim((string) ($data['owner_mobile'] ?? '')));
         $name   = trim((string) ($data['name'] ?? ''));
 
         if ($mobile === '') {
             return $this->error('VALIDATION', 'شماره موبایل الزامی است', 422);
         }
+        if (!InputValidator::isValidIranMobile($mobile)) {
+            return $this->error('VALIDATION', 'شماره موبایل نامعتبر است', 422, 'owner_mobile');
+        }
         if ($name === '') {
             return $this->error('VALIDATION', 'نام کلینیک الزامی است', 422);
         }

src/Blog/Controller/BlogController.php

@@ -174,8 +174,11 @@ class BlogController extends BaseController
     public function create(Request $request, #[CurrentUser] User $user): JsonResponse
     {
         $data  = json_decode($request->getContent(), true) ?? [];
-        $title = trim($data['title'] ?? '');
-        $body  = trim($data['body'] ?? '');
+        if ((isset($data['title']) && !is_string($data['title'])) || (isset($data['body']) && !is_string($data['body']))) {
+            return $this->error(ErrorCodes::ERR_VALIDATION_002, 'title و body باید رشته باشند', 422);
+        }
+        $title = trim((string) ($data['title'] ?? ''));
+        $body  = trim((string) ($data['body'] ?? ''));
 
         if (empty($title) || empty($body)) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'title و body الزامی است', 422);

src/Representation/Controller/RepresentationActionController.php

@@ -9,6 +9,7 @@ use App\Doctor\Entity\Doctor;
 use App\Specialty\Entity\Specialty;
 use App\Representation\Repository\RepresentationRepository;
 use App\Shared\Constant\ErrorCodes;
+use App\Shared\Service\InputValidator;
 use App\Shared\Controller\BaseController;
 use Doctrine\ORM\EntityManagerInterface;
 use OpenApi\Attributes as OA;
@@ -79,12 +80,15 @@ class RepresentationActionController extends BaseController
     public function createDoctor(Request $request, #[CurrentUser] User $user): JsonResponse
     {
         $data   = json_decode($request->getContent(), true) ?? [];
-        $mobile = trim((string) ($data['mobile'] ?? ''));
+        $mobile = InputValidator::toEnglishDigits(trim((string) ($data['mobile'] ?? '')));
         $name   = trim((string) ($data['name'] ?? ''));
 
         if ($mobile === '' || $name === '') {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'موبایل و نام الزامی هستند', 422);
         }
+        if (!InputValidator::isValidIranMobile($mobile)) {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'شماره موبایل نامعتبر است', 422, 'mobile');
+        }
 
         $doctorUser = $this->em->getRepository(User::class)->findOneBy(['mobileNumber' => $mobile]);
         if (!$doctorUser) {
@@ -154,12 +158,15 @@ class RepresentationActionController extends BaseController
     public function createClinic(Request $request, #[CurrentUser] User $user): JsonResponse
     {
         $data   = json_decode($request->getContent(), true) ?? [];
-        $mobile = trim((string) ($data['owner_mobile'] ?? ''));
+        $mobile = InputValidator::toEnglishDigits(trim((string) ($data['owner_mobile'] ?? '')));
         $name   = trim((string) ($data['name'] ?? ''));
 
         if ($mobile === '') {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'شماره موبایل الزامی است', 422);
         }
+        if (!InputValidator::isValidIranMobile($mobile)) {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'شماره موبایل نامعتبر است', 422, 'owner_mobile');
+        }
         if ($name === '') {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'نام کلینیک الزامی است', 422);
         }

src/Representation/Controller/RepresentationController.php

@@ -9,6 +9,7 @@ use App\Representation\Repository\RepresentationRepository;
 use App\Representation\Service\JalaliDateService;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
+use App\Shared\Service\InputValidator;
 use Doctrine\ORM\EntityManagerInterface;
 use OpenApi\Attributes as OA;
 use Symfony\Component\HttpFoundation\JsonResponse;
@@ -83,13 +84,17 @@ class RepresentationController extends BaseController
     public function create(Request $request): JsonResponse
     {
         $data     = json_decode($request->getContent(), true) ?? [];
-        $mobile   = trim($data['mobile_number'] ?? '');
-        $fullName = trim($data['full_name'] ?? '');
+        $mobile   = InputValidator::toEnglishDigits(trim((string) ($data['mobile_number'] ?? '')));
+        $fullName = trim((string) ($data['full_name'] ?? ''));
 
         if (empty($mobile) || empty($fullName)) {
             return $this->error(ErrorCodes::ERR_VALIDATION_002, 'mobile_number و full_name الزامی است', 422);
         }
 
+        if (!InputValidator::isValidIranMobile($mobile)) {
+            return $this->error(ErrorCodes::ERR_VALIDATION_001, 'شماره موبایل نامعتبر است', 422, 'mobile_number');
+        }
+
         $user = $this->userRepo->findByMobile($mobile);
         if ($user === null) {
             $user = new User($mobile);

src/Shared/Service/InputValidator.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Shared\Service;
+
+/**
+ * اعتبارسنجیِ مشترکِ سمت سرور برای ورودی‌های رایج (موبایل ایران، کد ملی).
+ * معادلِ منطقِ سمت فرانت تا رفتار یکدست بماند.
+ */
+final class InputValidator
+{
+    public static function isValidIranMobile(string $mobile): bool
+    {
+        return (bool) preg_match('/^09\d{9}$/', self::toEnglishDigits($mobile));
+    }
+
+    /** کد ملی ایران: ۱۰ رقم + الگوریتم رقم کنترلی؛ ارقام یکسان نامعتبر. */
+    public static function isValidIranNationalCode(string $code): bool
+    {
+        $code = self::toEnglishDigits($code);
+        if (!preg_match('/^\d{10}$/', $code)) {
+            return false;
+        }
+        if (preg_match('/^(\d)\1{9}$/', $code)) {
+            return false;
+        }
+
+        $check = (int) $code[9];
+        $sum   = 0;
+        for ($i = 0; $i < 9; $i++) {
+            $sum += (int) $code[$i] * (10 - $i);
+        }
+        $r = $sum % 11;
+
+        return $r < 2 ? $check === $r : $check === 11 - $r;
+    }
+
+    public static function toEnglishDigits(string $s): string
+    {
+        return strtr($s, [
+            '۰' => '0', '۱' => '1', '۲' => '2', '۳' => '3', '۴' => '4',
+            '۵' => '5', '۶' => '6', '۷' => '7', '۸' => '8', '۹' => '9',
+            '٠' => '0', '١' => '1', '٢' => '2', '٣' => '3', '٤' => '4',
+            '٥' => '5', '٦' => '6', '٧' => '7', '٨' => '8', '٩' => '9',
+        ]);
+    }
+}

src/UserProfile/Controller/UserProfileController.php

@@ -7,6 +7,7 @@ use App\Auth\Repository\UserRepository;
 use App\Shared\Constant\ErrorCodes;
 use App\Shared\Controller\BaseController;
 use App\Shared\Service\FileValidatorService;
+use App\Shared\Service\InputValidator;
 use App\UserProfile\Entity\UserProfile;
 use App\UserProfile\Repository\UserProfileRepository;
 use Symfony\Component\Uid\Uuid;
@@ -129,6 +130,15 @@ class UserProfileController extends BaseController
         }
 
         $data = json_decode($request->getContent(), true) ?? [];
+
+        if (array_key_exists('national_code', $data) && $data['national_code'] !== null && $data['national_code'] !== '') {
+            $code = InputValidator::toEnglishDigits((string) $data['national_code']);
+            if (!InputValidator::isValidIranNationalCode($code)) {
+                return $this->error(ErrorCodes::ERR_VALIDATION_001, 'کد ملی نامعتبر است', 422, 'national_code');
+            }
+            $data['national_code'] = $code;
+        }
+
         $this->hydrate($profile, $data);
         $this->repository->save($profile);