update rm deadcode

2026-09-27 11:42:40 +07:00
parent 82a71244ca
commit 3af59bd9c5
129 changed files with 5194 additions and 2698 deletions
@@ -0,0 +1,126 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Console\Commands;
+
+use App\Http\Facade\SignRSA;
+use Illuminate\Console\Command;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use Illuminate\Support\Facades\Schema;
+use RuntimeException;
+use Throwable;
+
+class ReencryptSecrets extends Command
+{
+    protected $signature = 'secrets:reencrypt {--dry-run}';
+
+    protected $description = 'Re-encrypt stored secrets with the current APP_KEY and RSA_KEY (old values are read via APP_PREVIOUS_KEYS / RSA_PREVIOUS_*)';
+
+    private const RSA_COLUMNS = [
+        ['module_vcenter', 'password'],
+        ['infra_management', 'password'],
+        ['module_hosting', 'password'],
+        ['module_hosting_server', 'password'],
+        ['module_dns_server', 'password'],
+        ['module_vmware', 'password'],
+        ['reinstall_logs', 'password'],
+    ];
+
+    private const APP_KEY_COLUMNS = [
+        ['dns_manager_servers', 'password'],
+        ['module_hosting_plesk_clients', 'password'],
+        ['module_vmware', 'plain_password'],
+        ['reinstall_logs', 'plain_password'],
+    ];
+
+    public function handle(): int
+    {
+        $failed = 0;
+
+        foreach (self::RSA_COLUMNS as [$table, $column]) {
+            $failed += $this->reencryptColumn($table, $column, fn (string $value) => SignRSA::EncryptFunc($this->decryptRsa($value)));
+        }
+
+        foreach (self::APP_KEY_COLUMNS as [$table, $column]) {
+            $failed += $this->reencryptColumn($table, $column, fn (string $value) => Crypt::encryptString(Crypt::decryptString($value)));
+        }
+
+        $failed += $this->reencryptSmtpSetting();
+
+        return $failed === 0 ? self::SUCCESS : self::FAILURE;
+    }
+
+    private function reencryptColumn(string $table, string $column, callable $reencrypt): int
+    {
+        if (!Schema::hasColumn($table, $column)) {
+            $this->warn("{$table}.{$column}: column not found, skipped");
+
+            return 0;
+        }
+
+        $updated = 0;
+        $failed = 0;
+
+        DB::table($table)
+            ->select(['id', $column])
+            ->whereNotNull($column)
+            ->where($column, '!=', '')
+            ->chunkById(200, function ($rows) use ($table, $column, $reencrypt, &$updated, &$failed) {
+                foreach ($rows as $row) {
+                    try {
+                        $value = $reencrypt((string) $row->{$column});
+                    } catch (Throwable) {
+                        $failed++;
+                        $this->warn("{$table}#{$row->id}.{$column}: cannot decrypt with current or previous key");
+                        continue;
+                    }
+
+                    if (!$this->option('dry-run')) {
+                        DB::table($table)->where('id', $row->id)->update([$column => $value]);
+                    }
+                    $updated++;
+                }
+            });
+
+        $this->info("{$table}.{$column}: {$updated} re-encrypted, {$failed} failed");
+
+        return $failed;
+    }
+
+    private function reencryptSmtpSetting(): int
+    {
+        $setting = DB::table('setting')->where('key', 'smtp')->first();
+        $smtp = $setting ? json_decode((string) $setting->value, true) : null;
+
+        if (empty($smtp['password'])) {
+            return 0;
+        }
+
+        try {
+            $smtp['password'] = SignRSA::EncryptFunc($this->decryptRsa($smtp['password']));
+        } catch (Throwable) {
+            $this->warn('setting[smtp].password: cannot decrypt with current or previous key');
+
+            return 1;
+        }
+
+        if (!$this->option('dry-run')) {
+            DB::table('setting')->where('key', 'smtp')->update(['value' => json_encode($smtp)]);
+        }
+        $this->info('setting[smtp].password: re-encrypted');
+
+        return 0;
+    }
+
+    private function decryptRsa(string $value): string
+    {
+        $plain = SignRSA::DecryptFunc($value);
+        if ($plain === '') {
+            throw new RuntimeException('RSA decrypt failed');
+        }
+
+        return $plain;
+    }
+}