- Hash driver read from HASH_DRIVER (argon2id in production); bcrypt
hashes still verify and are rehashed on successful admin/client login
since the JWT guard and guard->validate() never rehash on their own.
- Client registration uses Hash::make instead of bcrypt(), which always
forced bcrypt regardless of the configured driver.
- SignRSA now encrypts with Crypt (AES-256-CBC + HMAC, APP_KEY) instead
of 3DES in ECB mode without IV. Legacy 3DES values are still readable
via RSA_KEY/RSA_PUBLIC until `secrets:reencrypt` migrates them;
RSA_PRIVATE is no longer used.
- LegacyPortalImporter stored module_vmware.password in plaintext; it is
now encrypted, and a migration encrypts existing plaintext rows.
Deploy: php artisan migrate, then secrets:reencrypt --dry-run and
secrets:reencrypt; remove RSA_* from env once it exits 0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Implemented DomainCollection, DomainDetailResource, DomainNSCollection, DomainNSResource, and DomainResource for handling DNS domain and record data.
- Created VpsServiceCollection and VpsServiceResource for VPS service management.
- Added DnsManagerNS and DnsManagerUser models to represent DNS records and user associations.
- Developed AdminZoneDnsSqlImporter for importing DNS data from SQL dumps, including customer and DNS domain records.
- Added migration scripts to update the customers table with new fields and sync foreign key references for DNS tables.
- Created a migration preview document outlining the mapping and schema changes for the admin zone DNS import.
