update rm deadcode

2026-09-27 11:42:40 +07:00
parent 82a71244ca
commit 3af59bd9c5
129 changed files with 5194 additions and 2698 deletions
@@ -0,0 +1,94 @@
+<?php
+
+namespace Tests\Feature\Console;
+
+use App\Http\Facade\SignRSA;
+use Illuminate\Encryption\Encrypter;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use Tests\TestCase;
+
+class ReencryptSecretsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    protected function setUp(): void
+    {
+        parent::setUp();
+
+        DB::table('infra_management')->delete();
+    }
+
+    public function test_rotating_keys_re_encrypts_rsa_and_app_key_columns(): void
+    {
+        [$oldRsa, $newRsa] = [$this->rsaConfig(), $this->rsaConfig()];
+        [$oldAppKey, $newAppKey] = [$this->appKey(), $this->appKey()];
+
+        $this->useKeys($oldRsa, $oldAppKey);
+        $vcenterId = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
+        $dnsServerId = DB::table('dns_manager_servers')->insertGetId([
+            'name' => 'ns1', 'ip_address' => '10.0.0.1', 'username' => 'admin', 'password' => Crypt::encryptString('plesk-secret'),
+        ]);
+        DB::table('setting')->insert(['key' => 'smtp', 'value' => json_encode(['host' => 'smtp', 'password' => SignRSA::EncryptFunc('smtp-secret')])]);
+
+        $this->useKeys($newRsa, $newAppKey, previousRsa: $oldRsa, previousAppKey: $oldAppKey);
+        $this->artisan('secrets:reencrypt')->assertSuccessful();
+
+        $this->useKeys($newRsa, $newAppKey);
+        $this->assertSame('vc-secret', SignRSA::DecryptFunc(DB::table('module_vcenter')->where('id', $vcenterId)->value('password')));
+        $this->assertSame('plesk-secret', Crypt::decryptString(DB::table('dns_manager_servers')->where('id', $dnsServerId)->value('password')));
+        $smtp = json_decode(DB::table('setting')->where('key', 'smtp')->value('value'), true);
+        $this->assertSame('smtp-secret', SignRSA::DecryptFunc($smtp['password']));
+        $this->assertSame('smtp', $smtp['host']);
+    }
+
+    public function test_dry_run_changes_nothing_and_undecryptable_rows_fail_the_command(): void
+    {
+        $this->useKeys($this->rsaConfig(), $this->appKey());
+        $id = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
+        $original = DB::table('module_vcenter')->where('id', $id)->value('password');
+
+        $this->artisan('secrets:reencrypt --dry-run')->assertSuccessful();
+        $this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));
+
+        $this->useKeys($this->rsaConfig(), $this->appKey());
+        $this->artisan('secrets:reencrypt')->assertFailed();
+        $this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));
+    }
+
+    private function useKeys(array $rsa, string $appKey, ?array $previousRsa = null, ?string $previousAppKey = null): void
+    {
+        config([
+            'rsa.key' => $rsa['key'],
+            'rsa.public' => $rsa['public'],
+            'rsa.private' => $rsa['private'],
+            'rsa.previous_key' => $previousRsa['key'] ?? null,
+            'rsa.previous_public' => $previousRsa['public'] ?? null,
+            'app.key' => $appKey,
+            'app.previous_keys' => $previousAppKey ? [$previousAppKey] : [],
+        ]);
+
+        $this->app->forgetInstance('encrypter');
+        $this->app->forgetInstance(\App\Http\Services\SignRSA::class);
+        Crypt::clearResolvedInstance('encrypter');
+        SignRSA::clearResolvedInstance(\App\Http\Services\SignRSA::class);
+    }
+
+    private function rsaConfig(): array
+    {
+        $pair = openssl_pkey_new(['private_key_bits' => 2048]);
+        openssl_pkey_export($pair, $private);
+
+        return [
+            'key' => base64_encode(random_bytes(24)),
+            'public' => openssl_pkey_get_details($pair)['key'],
+            'private' => $private,
+        ];
+    }
+
+    private function appKey(): string
+    {
+        return 'base64:' . base64_encode(Encrypter::generateKey('AES-256-CBC'));
+    }
+}