baodev0andClaude Opus 5.5
ea5697cb81
- Hash driver read from HASH_DRIVER (argon2id in production); bcrypt hashes still verify and are rehashed on successful admin/client login since the JWT guard and guard->validate() never rehash on their own. - Client registration uses Hash::make instead of bcrypt(), which always forced bcrypt regardless of the configured driver. - SignRSA now encrypts with Crypt (AES-256-CBC + HMAC, APP_KEY) instead of 3DES in ECB mode without IV. Legacy 3DES values are still readable via RSA_KEY/RSA_PUBLIC until `secrets:reencrypt` migrates them; RSA_PRIVATE is no longer used. - LegacyPortalImporter stored module_vmware.password in plaintext; it is now encrypted, and a migration encrypts existing plaintext rows. Deploy: php artisan migrate, then secrets:reencrypt --dry-run and secrets:reencrypt; remove RSA_* from env once it exits 0. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
69 lines
2.2 KiB
PHP
69 lines
2.2 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature\Auth;
|
|
|
|
use App\Models\Customer;
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Hash;
|
|
use Tests\TestCase;
|
|
|
|
class PasswordRehashTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
private const PASSWORD = 'Secret12345';
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
config(['hashing.driver' => 'argon2id']);
|
|
}
|
|
|
|
public function test_customer_bcrypt_hash_is_upgraded_to_argon2id_on_login(): void
|
|
{
|
|
$customer = Customer::factory()->create([
|
|
'status' => 1,
|
|
'password' => Hash::driver('bcrypt')->make(self::PASSWORD),
|
|
]);
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->postJson('/v1/client/login', ['email' => $customer->email, 'password' => self::PASSWORD])
|
|
->assertOk()
|
|
->assertJsonStructure(['data' => ['token']]);
|
|
|
|
$hash = $customer->fresh()->password;
|
|
$this->assertStringStartsWith('$argon2id$', $hash);
|
|
$this->assertTrue(Hash::check(self::PASSWORD, $hash));
|
|
}
|
|
|
|
public function test_admin_bcrypt_hash_is_upgraded_to_argon2id_on_login(): void
|
|
{
|
|
$admin = User::factory()->create([
|
|
'username' => 'rehash-admin',
|
|
'email' => 'rehash-admin@example.com',
|
|
'password' => Hash::driver('bcrypt')->make(self::PASSWORD),
|
|
]);
|
|
|
|
$this->postJson('/api/v1/administrator/login', ['username' => 'rehash-admin', 'password' => self::PASSWORD])
|
|
->assertOk();
|
|
|
|
$this->assertStringStartsWith('$argon2id$', $admin->fresh()->password);
|
|
}
|
|
|
|
public function test_wrong_password_does_not_rehash(): void
|
|
{
|
|
$bcrypt = Hash::driver('bcrypt')->make(self::PASSWORD);
|
|
$customer = Customer::factory()->create(['status' => 1, 'password' => $bcrypt]);
|
|
|
|
$this->withHeaders(['x-access-token' => $this->buildClientAccessToken()])
|
|
->postJson('/v1/client/login', ['email' => $customer->email, 'password' => 'wrong-password'])
|
|
->assertStatus(422);
|
|
|
|
$this->assertSame($bcrypt, $customer->fresh()->password);
|
|
}
|
|
}
|