fix(client-service): hide service/vm ids, mask vm password, encrypt module_vmware.password

- detail response drops id and vm.id/vmware_id, password returns *****
- GET client-service/{uuid}/vm-password returns the decrypted password to the owner
- renew accepts service uuid
- EncryptedOrLegacy cast for module_vmware.password
- vps specs: addon ram is stored in MB, convert to GB

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

app/Casts/EncryptedOrLegacy.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Casts;
+
+use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
+use Illuminate\Contracts\Encryption\DecryptException;
+use Illuminate\Support\Facades\Crypt;
+
+class EncryptedOrLegacy implements CastsAttributes
+{
+    public function get($model, string $key, $value, array $attributes)
+    {
+        if ($value === null || $value === '') {
+            return $value;
+        }
+
+        try {
+            return Crypt::decryptString($value);
+        } catch (DecryptException) {
+            return $value;
+        }
+    }
+
+    public function set($model, string $key, $value, array $attributes)
+    {
+        return $value === null || $value === '' ? $value : Crypt::encryptString($value);
+    }
+}

app/Http/Controllers/Api/Client/Service/ServiceController.php

@@ -194,6 +194,22 @@ class ServiceController extends Controller
         ]);
     }
 
+    public function getVmPassword(Request $request, string $uuid)
+    {
+        $service = Service::with('vmware')
+            ->where('uuid', $uuid)
+            ->where('customer_id', $request->user()->id)
+            ->first();
+
+        $vm = $service?->vmware;
+
+        if (!$vm) {
+            return response()->json(['error' => true, 'message' => 'Không tìm thấy dịch vụ'], 404);
+        }
+
+        return response()->json(['error' => false, 'data' => ['password' => $vm->plain_password]]);
+    }
+
     public function getConsoleTicket(Request $request, string $uuid, vCenter $serviceVCenter)
     {
         $customer = $request->user();

app/Http/Controllers/Api/Service/OrderControllerRefactor.php

@@ -361,10 +361,14 @@ class OrderControllerRefactor extends Controller
         ]);
     }
 
-    public function renewService(RenewServiceRequest $request, int $id): JsonResponse
+    public function renewService(RenewServiceRequest $request, string $id): JsonResponse
     {
+        if (! ctype_digit($id)) {
+            $id = (string) \App\Models\Service::where('uuid', $id)->where('customer_id', $request->user()->id)->value('id');
+        }
+
         $result = $this->orderQueryService->renewService(
-            $id,
+            (int) $id,
             $request->user(),
             (int) $request->validated()['months'],
         );

app/Http/Resources/Api/Client/Service/ServiceClientDetailResource.php

@@ -10,6 +10,8 @@ use Illuminate\Support\Facades\Crypt;
 
 class ServiceClientDetailResource extends JsonResource
 {
+    public const MASKED_PASSWORD = '*****';
+
     /** Plesk panel login (persisted, reusable) — separate from the one-time FTP password, which is never stored. */
     private function resolvePleskCredentials($hosting): ?array
     {
@@ -60,7 +62,7 @@ class ServiceClientDetailResource extends JsonResource
         if ($addons->isNotEmpty()) {
             return [
                 'cpu'       => (int) $addons->where('addon_type', 'cpu')->sum('addon_value'),
-                'ram'       => (int) $addons->where('addon_type', 'ram')->sum('addon_value'),
+                'ram'       => round($addons->where('addon_type', 'ram')->sum('addon_value') / 1024, 2),
                 'disk'      => (int) $addons->where('addon_type', 'disk')->sum('addon_value'),
                 'bandwidth' => (int) $addons->where('addon_type', 'bandwidth')->sum('addon_value'),
             ];
@@ -89,7 +91,6 @@ class ServiceClientDetailResource extends JsonResource
         $dnsCancelled = $dnsZone !== null && (int) $dnsZone->is_created === DnsDomain::STATUS_CANCELLED;
 
         return [
-            'id'          => $this->id,
             'uuid'        => $this->uuid,
             'type'        => $this->type,
             'server_name' => $this->server_name,
@@ -115,12 +116,10 @@ class ServiceClientDetailResource extends JsonResource
                 'renewal_options' => \App\Support\RenewalPricing::options($product),
             ] : null,
             'vm' => $vm ? [
-                'id'         => $vm->id,
-                'vmware_id'  => $vm->vmware_id,
                 'ip_address' => $vm->ipAddress?->ip ?? $vm->ip,
                 'hostname'   => $vm->hostname,
                 'username'   => $vm->user,
-                'password'   => $vm->plain_password ?? null,
+                'password'   => $vm->plain_password ? self::MASKED_PASSWORD : null,
                 'port'       => $vm->port,
                 'status'     => $vm->status,
                 'ip'         => $vm->ip ?? null,

app/Http/Resources/Api/Service/VpsServiceResource.php

@@ -14,7 +14,7 @@ class VpsServiceResource extends JsonResource
         if ($addons->isNotEmpty()) {
             return [
                 'cpu'       => (int) $addons->where('addon_type', 'cpu')->sum('addon_value'),
-                'ram'       => (int) $addons->where('addon_type', 'ram')->sum('addon_value'),
+                'ram'       => round($addons->where('addon_type', 'ram')->sum('addon_value') / 1024, 2),
                 'disk'      => (int) $addons->where('addon_type', 'disk')->sum('addon_value'),
                 'bandwidth' => (int) $addons->where('addon_type', 'bandwidth')->sum('addon_value'),
             ];

app/Models/ModuleVmware.php

@@ -39,11 +39,8 @@ class ModuleVmware extends Model
         'disk_gb',
     ];
 
-    // NOTE: password must NOT use 'hashed' cast — it is a VM guest credential
-    // used in plaintext by PowerShell scripts (Invoke-VMScript) via SSH/PowerCLI.
-    // plain_password uses Laravel's 'encrypted' cast (APP_KEY, AES-256-CBC): stored
-    // encrypted at rest, transparently decrypted on read — no code elsewhere changes.
     protected $casts = [
+        'password' => \App\Casts\EncryptedOrLegacy::class,
         'plain_password' => 'encrypted',
     ];
     public function customer()

routes/client.php

@@ -123,6 +123,7 @@ Route::prefix('v1')
                         Route::get('web-design', 'indexWebDesign')->name('web-design.list');
                         Route::get('domain', 'indexDomain')->name('domain.list');
                         Route::get('{uuid}', 'getDetail')->name('detail');
+                        Route::get('{uuid}/vm-password', 'getVmPassword')->middleware('throttle:20,1')->name('vm-password');
                         Route::get('{uuid}/console-ticket', 'getConsoleTicket')->name('console-ticket');
                         Route::get('{uuid}/available-os', 'getAvailableOs')->name('available-os');
                         Route::post('{uuid}/rebuild', 'rebuild')->name('rebuild');