# Phase 2 Delivery — Identity, Access & Notification Core

Version: `0.2.0`  
Date: `2026-08-15`

## Implemented

### Identity
- mobile OTP with 6-digit cryptographically random codes;
- HMAC-only OTP storage; raw OTP never stored in DB;
- 120-second default expiry;
- per-challenge attempt limit;
- per-mobile and per-IP request throttles;
- verification throttling;
- resend cooldown;
- Persian/Arabic digit normalization;
- first-login user creation;
- mobile verification timestamp;
- onboarding through User Service;
- persistent database sessions;
- login/logout Audit Log records.

### User management
- admin list with pagination;
- search by name, mobile and national code;
- status/role filters preserved in query string;
- create and edit;
- active/inactive/suspended states;
- status changes terminate all sessions;
- role assignment through User Service;
- changing mobile resets its verified timestamp;
- last-active-Super-Admin protection.

### RBAC
- granular permissions;
- system roles retained;
- custom roles can be created;
- role slugs are stable after creation;
- system roles cannot be deleted;
- Super Admin permission set cannot be restricted;
- role changes are audited.

### Sessions
- device/browser display without an external parser dependency;
- user can terminate one or all other sessions;
- authorized admin can terminate user sessions;
- session termination is audited with a hash of the session identifier.

### SMS
- central SmsService;
- SmsGateway driver contract;
- Mida fast API adapter;
- encrypted username/password;
- read-only SMS permissions do not decrypt or expose gateway credentials;
- fixed HTTPS host allow-list for Mida to reduce SSRF exposure;
- no automatic network retry for message sends to avoid duplicate OTPs;
- connection timeout is reported as `unknown` rather than blindly retried;
- response parser supports JSON, positive IDs, HTML/text, Persian digits,
  success/error tokens and legacy non-empty successful Mida responses;
- editable OTP template;
- redacted SMS logs: OTP values are not stored in logs;
- real test-send action;
- CLI configuration command.

### Notification Core
- `notification_events` represents the business event;
- `notification_deliveries` stores each delivery channel independently;
- aggregate event states: pending / processing / sent / partial / failed / unknown;
- `database` and `sms` channels implemented;
- future Push and Bale channels can join without changing caller business logic;
- user inbox and read state;
- admin delivery history;
- admin can send database/SMS notifications to a user.

### Audit
Admin UI can filter and inspect Audit records including before/after/metadata.
Technical logs remain separate.

## Migrations
- `2026_08_15_000007_extend_identity_for_phase_two.php`
- `2026_08_15_000008_create_sms_core.php`
- `2026_08_15_000009_create_notification_core.php`
- `2026_08_15_000010_seed_phase_two_access.php`

## New physical tables
- `sms_gateways`
- `sms_templates`
- `sms_logs`
- `notification_events`
- `notification_deliveries`

The `users` and `otp_challenges` tables are extended without replacing existing
records.

## Not implemented in this phase
Wallet, payment, service catalog, inquiry providers, billable inquiry execution,
pricing and accounting are not mocked. They remain later phases.

## Next dependency-correct phase
Phase 3: Service Catalog + Multi Provider.