bao/portal-api
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(security): argon2id password hashing and AES for SignRSA secrets

Browse Source 
- Hash driver read from HASH_DRIVER (argon2id in production); bcrypt
  hashes still verify and are rehashed on successful admin/client login
  since the JWT guard and guard->validate() never rehash on their own.
- Client registration uses Hash::make instead of bcrypt(), which always
  forced bcrypt regardless of the configured driver.
- SignRSA now encrypts with Crypt (AES-256-CBC + HMAC, APP_KEY) instead
  of 3DES in ECB mode without IV. Legacy 3DES values are still readable
  via RSA_KEY/RSA_PUBLIC until `secrets:reencrypt` migrates them;
  RSA_PRIVATE is no longer used.
- LegacyPortalImporter stored module_vmware.password in plaintext; it is
  now encrypted, and a migration encrypts existing plaintext rows.

Deploy: php artisan migrate, then secrets:reencrypt --dry-run and
secrets:reencrypt; remove RSA_* from env once it exits 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
baodev0
2026-10-15 19:56:38 +07:00
co-authored by Claude Opus 5.5
parent 0bfb3bb49c
commit ea5697cb81
11 changed files with 166 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Console/Commands/ReencryptSecrets.php
+1 -1
View File
@@ -16,7 +16,7 @@ class ReencryptSecrets extends Command
{
protected $signature = 'secrets:reencrypt {--dry-run}';
protected $description = 'Re-encrypt stored secrets with the current APP_KEY and RSA_KEY (old values are read via APP_PREVIOUS_KEYS / RSA_PREVIOUS_*)';
protected $description = 'Re-encrypt stored secrets with the current APP_KEY (old values are read via APP_PREVIOUS_KEYS; legacy 3DES SignRSA values via RSA_KEY/RSA_PUBLIC and RSA_PREVIOUS_*)';
private const RSA_COLUMNS = [
['module_vcenter', 'password'],