From b26920c6f46fa18920ab621794600034578525dd Mon Sep 17 00:00:00 2001
From: DevSoftTech Server <info.devsofttech@gmail.com>
Date: Tue, 28 Jul 2026 03:37:23 +0530
Subject: [PATCH] ABDM bridge: allow opt-in SSL verify bypass via
 ABDM_BRIDGE_SSL_VERIFY env for envs with stale local CA bundles

Some local WAMP/XAMPP/Laragon PHP installs ship an outdated cacert.pem,
causing outbound HTTPS calls to the bridge to fail with cURL error 60
(SSL certificate problem). Rather than globally disabling certificate
verification (as bridge support suggested), verification stays ON by
default and can only be disabled per-deployment by explicitly setting
ABDM_BRIDGE_SSL_VERIFY=false in that machine's .env. The real fix on
affected machines is updating curl.cainfo in php.ini.
---
 app/Libraries/Abdm/EAtriaBridgeConnector.php | 11 ++++++++-
 app/Libraries/Abdm/M3HiuGatewayClient.php    | 25 ++++++++++++++++++--
 check_new_docs.php                           |  6 +++++
 3 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 check_new_docs.php

diff --git a/app/Libraries/Abdm/EAtriaBridgeConnector.php b/app/Libraries/Abdm/EAtriaBridgeConnector.php
index e316674..483f352 100644
--- a/app/Libraries/Abdm/EAtriaBridgeConnector.php
+++ b/app/Libraries/Abdm/EAtriaBridgeConnector.php
@@ -305,13 +305,22 @@ class EAtriaBridgeConnector implements AbdmConnectorInterface
                 . ' | token_source=' . $tokenSource
                 . ' | body=' . json_encode($safeRequestBody));
 
+            // SSL verification stays ON by default. Some local WAMP/XAMPP
+            // installs ship a stale bundled cacert.pem, causing cURL error 60
+            // on outbound HTTPS calls. Fix that by updating curl.cainfo in
+            // php.ini on the affected machine; only as a last resort can a
+            // specific deployment opt out via ABDM_BRIDGE_SSL_VERIFY=false.
+            $sslVerifyRaw = strtolower(trim((string) (getenv('ABDM_BRIDGE_SSL_VERIFY') ?: '')));
+            $sslVerify = ! in_array($sslVerifyRaw, ['0', 'false', 'no', 'off'], true);
+
             $ch = curl_init();
             $curlOptions = [
                 CURLOPT_URL            => $url,
                 CURLOPT_RETURNTRANSFER => true,
                 CURLOPT_TIMEOUT        => $this->timeoutSec,
                 CURLOPT_HTTPHEADER     => $headers,
-                CURLOPT_SSL_VERIFYPEER => true,
+                CURLOPT_SSL_VERIFYPEER => $sslVerify,
+                CURLOPT_SSL_VERIFYHOST => $sslVerify ? 2 : 0,
                 CURLOPT_CUSTOMREQUEST  => $method,
             ];
 
diff --git a/app/Libraries/Abdm/M3HiuGatewayClient.php b/app/Libraries/Abdm/M3HiuGatewayClient.php
index df25ebc..826dfe3 100644
--- a/app/Libraries/Abdm/M3HiuGatewayClient.php
+++ b/app/Libraries/Abdm/M3HiuGatewayClient.php
@@ -14,6 +14,23 @@ class M3HiuGatewayClient
         $this->baseUrl = rtrim((string) (getenv('EATRIA_BRIDGE_URL') ?: 'https://abdm-bridge.e-atria.in/api'), '/');
     }
 
+    /**
+     * SSL peer/host verification is ON by default (secure). Some local
+     * WAMP/XAMPP/Laragon installs ship a stale bundled cacert.pem which makes
+     * outbound HTTPS calls fail with cURL error 60 (SSL certificate problem).
+     * Rather than disabling verification for everyone, allow an explicit,
+     * per-deployment opt-out via env for that specific broken environment:
+     *   ABDM_BRIDGE_SSL_VERIFY=false
+     * The correct long-term fix on the affected machine is to update PHP's
+     * CA bundle (curl.cainfo in php.ini), not to disable verification.
+     */
+    private function sslVerifyEnabled(): bool
+    {
+        $raw = strtolower(trim((string) (getenv('ABDM_BRIDGE_SSL_VERIFY') ?: '')));
+
+        return ! in_array($raw, ['0', 'false', 'no', 'off'], true);
+    }
+
     private function sanitizeBearerToken(string $token): string
     {
         $token = trim($token);
@@ -88,12 +105,14 @@ class M3HiuGatewayClient
             $headers[] = 'X-Hospital-Id: ' . $hospitalId;
         }
 
+        $sslVerify = $this->sslVerifyEnabled();
         $ch = curl_init();
         curl_setopt_array($ch, [
             CURLOPT_URL => $url,
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_TIMEOUT => $this->timeoutSec,
-            CURLOPT_SSL_VERIFYPEER => true,
+            CURLOPT_SSL_VERIFYPEER => $sslVerify,
+            CURLOPT_SSL_VERIFYHOST => $sslVerify ? 2 : 0,
             CURLOPT_HTTPHEADER => $headers,
             CURLOPT_CUSTOMREQUEST => 'POST',
             CURLOPT_POSTFIELDS => json_encode($payload, JSON_UNESCAPED_UNICODE | JSON_UNESCAPED_SLASHES),
@@ -266,12 +285,14 @@ class M3HiuGatewayClient
             $url .= '?' . http_build_query($cleanQuery);
         }
 
+        $sslVerify = $this->sslVerifyEnabled();
         $ch = curl_init();
         curl_setopt_array($ch, [
             CURLOPT_URL => $url,
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_TIMEOUT => $this->timeoutSec,
-            CURLOPT_SSL_VERIFYPEER => true,
+            CURLOPT_SSL_VERIFYPEER => $sslVerify,
+            CURLOPT_SSL_VERIFYHOST => $sslVerify ? 2 : 0,
             CURLOPT_HTTPHEADER => $headers,
             CURLOPT_CUSTOMREQUEST => 'GET',
         ]);
diff --git a/check_new_docs.php b/check_new_docs.php
new file mode 100644
index 0000000..7bccb85
--- /dev/null
+++ b/check_new_docs.php
@@ -0,0 +1,6 @@
+<?php
+$db = new mysqli('localhost', 'root', '', 'hms_data_ci4');
+$abha = '91510165305101@sbx';
+$res = $db->query("SELECT id, document_title, document_date, care_context_reference, created_at FROM abdm_hiu_documents WHERE abha_address = '{$abha}' ORDER BY id DESC LIMIT 5");
+while ($row = $res->fetch_assoc()) { print_r($row); }
+$db->close();