update

app/Http/Resources/Api/Client/ClientResource.php

@@ -4,6 +4,8 @@ namespace App\Http\Resources\Api\Client;
 
 use Illuminate\Http\Request;
 use Illuminate\Http\Resources\Json\JsonResource;
+use Illuminate\Support\Facades\URL;
+use Illuminate\Support\Str;
 
 class ClientResource extends JsonResource
 {
@@ -31,9 +33,9 @@ class ClientResource extends JsonResource
                 'date' => $this->created_at ? $this->created_at->format('Y-m-d H:i:s') : null,
                 'company' => $this->company ?? '',
                 'avatar' => $this->avatar,
-                'cmnd_before' => $this->front_identity_number,
-                'cmnd_after' => $this->back_identity_number,
-                'cmnd' => $this->identity_number,
+                'cmnd_before' => $this->cccdUrl('front', $this->front_identity_number),
+                'cmnd_after' => $this->cccdUrl('back', $this->back_identity_number),
+                'cmnd' => $this->identity_number ? Str::mask($this->identity_number, '*', 0, -4) : null,
                 'fb_link' => null,
                 'active_2fa' => 0,
                 'off_mail_marketing' => $this->off_mail_marketing,
@@ -57,4 +59,18 @@ class ClientResource extends JsonResource
             ]
         ];
     }
+
+    /**
+     * Ảnh CCCD trên disk private → URL ký tương đối (/v1/client/cccd/...), hết hạn 60 phút.
+     */
+    private function cccdUrl(string $side, ?string $path): string
+    {
+        if (!$path) {
+            return '';
+        }
+
+        // Giá trị import từ portal cũ (/uploads/... trên host cũ) cũng chỉ trả URL ký — không lộ đường dẫn gốc;
+        // route trả 404 cho chúng vì file không có trên disk private. Vẫn khác rỗng để hasCccd giữ nguyên hành vi.
+        return URL::temporarySignedRoute('api.client.cccd', now()->addHour(), ['customer' => $this->id, 'side' => $side], false);
+    }
 }