feat: Implement file management and authorization features

- Add RequiresPermissionAttribute for gRPC method access control.
- Create IFileManagementService interface for file upload and management.
- Implement AddProductImageCommand and handler for adding product images.
- Implement CreateNewProductsCommand and handler for creating new products with image uploads.
- Implement DeleteProductsCommand and handler for deleting products and their associations.
- Implement RemoveProductImageCommand and handler for removing product images from galleries.
- Implement UpdateProductsCommand and handler for updating product details and images.
- Create GetProductGalleryQuery and handler for retrieving product galleries.
- Implement PermissionService for role-based access control using JWT claims.
- Implement FileManagementService for handling file uploads and image optimization.
- Define gRPC service and messages for file management in fms.proto.
- Add FluentValidation for request validation in various commands.
- Create PermissionInterceptor for enforcing permissions on gRPC methods.

src/CMSMicroservice.Application/UserCQ/Commands/VerifyOtpToken/VerifyOtpTokenCommandHandler.cs

@@ -1,26 +1,41 @@
 using CMSMicroservice.Application.Common.Interfaces;
 using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Configuration;
 
 namespace CMSMicroservice.Application.UserCQ.Commands.VerifyOtpToken;
 public class VerifyOtpTokenCommandHandler : IRequestHandler<VerifyOtpTokenCommand, VerifyOtpTokenResponseDto>
 {
     private readonly IApplicationDbContext _context;
     private readonly IGenerateJwtToken _generateJwt;
+    private readonly IHashService _hashService;
+    private readonly IConfiguration _cfg;
 
-    public VerifyOtpTokenCommandHandler(IApplicationDbContext context, IGenerateJwtToken generateJwt)
+    public VerifyOtpTokenCommandHandler(IApplicationDbContext context, IGenerateJwtToken generateJwt,
+        IHashService hashService, IConfiguration cfg)
     {
         _context = context;
         _generateJwt = generateJwt;
+        _hashService = hashService;
+        _cfg = cfg;
     }
 
     public async Task<VerifyOtpTokenResponseDto> Handle(VerifyOtpTokenCommand request, CancellationToken cancellationToken)
     {
         var otpToken = await _context.OtpTokens
             .Where(x => x.Mobile == request.Mobile && x.Purpose == request.Purpose && !x.IsUsed)
-            .OrderByDescending(x => x.Id) // Use Id instead of CreatedAt for now
+            .OrderByDescending(x => x.Id)
             .FirstOrDefaultAsync(cancellationToken);
 
-        if (otpToken == null || !otpToken.IsValid(request.Code))
+        if (otpToken == null)
+            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید نامعتبر است" };
+
+        // Check expiry and usage
+        if (otpToken.IsUsed || DateTime.Now > otpToken.ExpiresAt)
+            return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید منقضی شده است" };
+
+        // Verify using the same HMAC-SHA256 method used during creation
+        var secret = _cfg["Otp:Secret"] ?? throw new InvalidOperationException("Otp:Secret not set");
+        if (!_hashService.VerifyHmacSha256Hex(request.Code, otpToken.CodeHash, secret))
             return new VerifyOtpTokenResponseDto { Success = false, Message = "کد تایید نامعتبر است" };
 
         var user = await _context.Users