From a3b7e9055c2376c580d2dd5ae6d5bfe281b4dc59 Mon Sep 17 00:00:00 2001
From: keyhan <k.tahvilpour@greenweb.ir>
Date: Wed, 17 Jun 2026 12:34:43 +0330
Subject: [PATCH] feat(admin): create users by mobile number instead of email

Admin user management now creates accounts with a required mobile
number and an optional contact email, matching mobile-only auth.
Admin-created accounts are pre-verified (phoneVerified) so the user
can sign in by password immediately. The user list and search now
include phone.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 backend/src/users/users.controller.ts         |  9 ++++--
 backend/src/users/users.service.ts            | 30 +++++++++++++++----
 .../app/[lang]/dashboard/admin/users/page.tsx | 27 +++++++++++++----
 frontend/src/i18n/dictionaries/en.ts          |  6 +++-
 frontend/src/i18n/dictionaries/fa.ts          |  6 +++-
 5 files changed, 63 insertions(+), 15 deletions(-)

diff --git a/backend/src/users/users.controller.ts b/backend/src/users/users.controller.ts
index e49cbe2..da11549 100644
--- a/backend/src/users/users.controller.ts
+++ b/backend/src/users/users.controller.ts
@@ -19,8 +19,8 @@ import { Roles } from '../common/decorators/roles.decorator';
 import { UserRole } from '../common/enums';
 
 class AdminCreateUserDto {
-  @IsEmail()
-  email: string;
+  @IsString()
+  phone: string;
 
   @IsString()
   @MinLength(8)
@@ -35,6 +35,11 @@ class AdminCreateUserDto {
   @MinLength(1)
   lastName: string;
 
+  // Optional contact email (not a login identifier).
+  @IsOptional()
+  @IsEmail()
+  email?: string;
+
   @IsOptional()
   @IsEnum(UserRole)
   role?: UserRole;
diff --git a/backend/src/users/users.service.ts b/backend/src/users/users.service.ts
index 0ddc451..0b08429 100644
--- a/backend/src/users/users.service.ts
+++ b/backend/src/users/users.service.ts
@@ -11,6 +11,7 @@ import { Repository, ILike } from 'typeorm';
 import * as bcrypt from 'bcrypt';
 import { User } from './entities/user.entity';
 import { UserRole } from '../common/enums';
+import { normalizeIranMobile } from '../common/phone.util';
 
 @Injectable()
 export class UsersService {
@@ -31,21 +32,37 @@ export class UsersService {
    * Admin create user — hashes password, checks duplicate email
    */
   async adminCreate(data: {
-    email: string;
+    phone: string;
     password: string;
     firstName: string;
     lastName: string;
+    email?: string;
     role?: UserRole;
   }): Promise<Omit<User, 'password'>> {
-    const existing = await this.findByEmail(data.email);
-    if (existing) {
-      throw new ConflictException('Email already registered');
+    const phone = normalizeIranMobile(data.phone);
+    if (!phone) {
+      throw new BadRequestException('Invalid mobile number');
     }
+    if (await this.findByPhone(phone)) {
+      throw new ConflictException('Mobile number already registered');
+    }
+
+    const email = data.email ? data.email.trim().toLowerCase() : null;
+    if (email && (await this.findByEmail(email))) {
+      throw new ConflictException('Email already in use');
+    }
+
     const hashedPassword = await bcrypt.hash(data.password, 12);
     const user = await this.create({
-      ...data,
+      phone,
+      email,
+      firstName: data.firstName,
+      lastName: data.lastName,
       password: hashedPassword,
       role: data.role || UserRole.USER,
+      // Admin-created accounts are trusted — the phone is pre-verified so the
+      // user can sign in by password immediately, no OTP step.
+      phoneVerified: true,
     });
     const { password, ...result } = user;
     return result as Omit<User, 'password'>;
@@ -81,6 +98,7 @@ export class UsersService {
   async findAll(search?: string): Promise<any[]> {
     const where = search
       ? [
+          { phone: ILike(`%${search}%`) },
           { email: ILike(`%${search}%`) },
           { firstName: ILike(`%${search}%`) },
           { lastName: ILike(`%${search}%`) },
@@ -91,6 +109,7 @@ export class UsersService {
       where,
       select: {
         id: true,
+        phone: true,
         email: true,
         firstName: true,
         lastName: true,
@@ -105,6 +124,7 @@ export class UsersService {
 
     return users.map((u) => ({
       id: u.id,
+      phone: u.phone,
       email: u.email,
       firstName: u.firstName,
       lastName: u.lastName,
diff --git a/frontend/src/app/[lang]/dashboard/admin/users/page.tsx b/frontend/src/app/[lang]/dashboard/admin/users/page.tsx
index b330570..c643893 100644
--- a/frontend/src/app/[lang]/dashboard/admin/users/page.tsx
+++ b/frontend/src/app/[lang]/dashboard/admin/users/page.tsx
@@ -31,6 +31,7 @@ export default function AdminUsersPage() {
   const [pwdModalUser, setPwdModalUser] = useState<AdminUser | null>(null);
   const [pwdModalPassword, setPwdModalPassword] = useState('');
   const [form, setForm] = useState({
+    phone: '',
     email: '',
     password: '',
     firstName: '',
@@ -50,7 +51,7 @@ export default function AdminUsersPage() {
       queryClient.invalidateQueries({ queryKey: ['admin-users'] });
       notify.success(u.createdSuccess);
       setShowForm(false);
-      setForm({ email: '', password: '', firstName: '', lastName: '', role: 'user' });
+      setForm({ phone: '', email: '', password: '', firstName: '', lastName: '', role: 'user' });
     },
     onError: (err: any) => {
       notify.error(err, u.createFailed);
@@ -141,10 +142,22 @@ export default function AdminUsersPage() {
               />
             </div>
             <div>
-              <label className="block text-sm font-medium text-gray-700 mb-1">{u.email}</label>
+              <label className="block text-sm font-medium text-gray-700 mb-1">{u.phone}</label>
+              <input
+                className="input-field"
+                type="tel"
+                dir="ltr"
+                placeholder={u.phonePlaceholder}
+                value={form.phone}
+                onChange={(e) => setForm({ ...form, phone: e.target.value })}
+              />
+            </div>
+            <div>
+              <label className="block text-sm font-medium text-gray-700 mb-1">{u.emailOptional}</label>
               <input
                 className="input-field"
                 type="email"
+                dir="ltr"
                 placeholder={u.emailPlaceholder}
                 value={form.email}
                 onChange={(e) => setForm({ ...form, email: e.target.value })}
@@ -179,7 +192,7 @@ export default function AdminUsersPage() {
           </div>
           <button
             onClick={() => createUser.mutate(form)}
-            disabled={!form.email || !form.password || !form.firstName || !form.lastName || createUser.isPending}
+            disabled={!form.phone || !form.password || !form.firstName || !form.lastName || createUser.isPending}
             className="btn-primary disabled:opacity-50"
           >
             {createUser.isPending ? <><Clock className="w-4 h-4 inline animate-spin" /> {u.creating}</> : u.createUser}
@@ -224,6 +237,7 @@ export default function AdminUsersPage() {
               <thead className="bg-gray-50/80">
                 <tr>
                   <th className="px-6 py-3.5 text-left rtl:text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">{u.colUser}</th>
+                  <th className="px-6 py-3.5 text-left rtl:text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">{u.colPhone}</th>
                   <th className="px-6 py-3.5 text-left rtl:text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">{u.colEmail}</th>
                   <th className="px-6 py-3.5 text-left rtl:text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">{u.colRole}</th>
                   <th className="px-6 py-3.5 text-left rtl:text-right text-xs font-semibold text-gray-500 uppercase tracking-wider">{u.colStatus}</th>
@@ -238,7 +252,8 @@ export default function AdminUsersPage() {
                     <td className="px-6 py-4 text-sm font-medium text-gray-900">
                       {user.firstName} {user.lastName}
                     </td>
-                    <td className="px-6 py-4 text-sm text-gray-600">{user.email}</td>
+                    <td className="px-6 py-4 text-sm text-gray-600" dir="ltr">{user.phone || '—'}</td>
+                    <td className="px-6 py-4 text-sm text-gray-600" dir="ltr">{user.email || '—'}</td>
                     <td className="px-6 py-4">
                       {isAdmin ? (
                         <Select
@@ -306,7 +321,7 @@ export default function AdminUsersPage() {
                 <div className="flex items-center justify-between">
                   <div>
                     <h3 className="font-semibold text-gray-900">{user.firstName} {user.lastName}</h3>
-                    <p className="text-sm text-gray-500">{user.email}</p>
+                    <p className="text-sm text-gray-500" dir="ltr">{user.phone || user.email || '—'}</p>
                   </div>
                   <span className={`badge ${user.isActive ? 'badge-green' : 'badge-red'}`}>
                     {user.isActive ? u.active : u.inactive}
@@ -375,7 +390,7 @@ export default function AdminUsersPage() {
               <strong>
                 {pwdModalUser.firstName} {pwdModalUser.lastName}
               </strong>{' '}
-              ({pwdModalUser.email})
+              (<span dir="ltr">{pwdModalUser.phone || pwdModalUser.email}</span>)
             </p>
             <input
               type="password"
diff --git a/frontend/src/i18n/dictionaries/en.ts b/frontend/src/i18n/dictionaries/en.ts
index 2868c49..1309e76 100644
--- a/frontend/src/i18n/dictionaries/en.ts
+++ b/frontend/src/i18n/dictionaries/en.ts
@@ -754,20 +754,24 @@ const en: Dictionary = {
       createNewUser: 'Create New User',
       firstName: 'First Name',
       lastName: 'Last Name',
+      phone: 'Mobile number',
       email: 'Email',
+      emailOptional: 'Email (optional)',
       password: 'Password',
       firstNamePlaceholder: 'John',
       lastNamePlaceholder: 'Doe',
+      phonePlaceholder: '09123456789',
       emailPlaceholder: 'john@example.com',
       passwordMin: 'Min 8 characters',
       role: 'Role',
       roles: { user: 'User', admin: 'Admin', technical: 'Technical', sales: 'Sales' },
       creating: 'Creating...',
       createUser: 'Create User',
-      searchPlaceholder: 'Search by name or email...',
+      searchPlaceholder: 'Search by name, mobile or email...',
       noUsersSearch: 'No users found matching your search.',
       noUsers: 'No users yet.',
       colUser: 'User',
+      colPhone: 'Mobile',
       colEmail: 'Email',
       colRole: 'Role',
       colStatus: 'Status',
diff --git a/frontend/src/i18n/dictionaries/fa.ts b/frontend/src/i18n/dictionaries/fa.ts
index 54094f5..b4117bc 100644
--- a/frontend/src/i18n/dictionaries/fa.ts
+++ b/frontend/src/i18n/dictionaries/fa.ts
@@ -753,20 +753,24 @@ const fa = {
       createNewUser: 'ساخت کاربر جدید',
       firstName: 'نام',
       lastName: 'نام خانوادگی',
+      phone: 'شماره موبایل',
       email: 'ایمیل',
+      emailOptional: 'ایمیل (اختیاری)',
       password: 'رمز عبور',
       firstNamePlaceholder: 'مثلاً علی',
       lastNamePlaceholder: 'مثلاً رضایی',
+      phonePlaceholder: '09123456789',
       emailPlaceholder: 'name@example.com',
       passwordMin: 'حداقل ۸ کاراکتر',
       role: 'نقش',
       roles: { user: 'کاربر', admin: 'مدیر', technical: 'فنی', sales: 'فروش' },
       creating: 'در حال ساخت…',
       createUser: 'ساخت کاربر',
-      searchPlaceholder: 'جستجو بر اساس نام یا ایمیل…',
+      searchPlaceholder: 'جستجو بر اساس نام، موبایل یا ایمیل…',
       noUsersSearch: 'کاربری مطابق جستجو پیدا نشد.',
       noUsers: 'هنوز کاربری نیست.',
       colUser: 'کاربر',
+      colPhone: 'موبایل',
       colEmail: 'ایمیل',
       colRole: 'نقش',
       colStatus: 'وضعیت',