95 lines
3.9 KiB
PHP
95 lines
3.9 KiB
PHP
<?php
|
|
|
|
namespace Tests\Feature\Console;
|
|
|
|
use App\Http\Facade\SignRSA;
|
|
use Illuminate\Encryption\Encrypter;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\Crypt;
|
|
use Illuminate\Support\Facades\DB;
|
|
use Tests\TestCase;
|
|
|
|
class ReencryptSecretsTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
DB::table('infra_management')->delete();
|
|
}
|
|
|
|
public function test_rotating_keys_re_encrypts_rsa_and_app_key_columns(): void
|
|
{
|
|
[$oldRsa, $newRsa] = [$this->rsaConfig(), $this->rsaConfig()];
|
|
[$oldAppKey, $newAppKey] = [$this->appKey(), $this->appKey()];
|
|
|
|
$this->useKeys($oldRsa, $oldAppKey);
|
|
$vcenterId = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
|
|
$dnsServerId = DB::table('dns_manager_servers')->insertGetId([
|
|
'name' => 'ns1', 'ip_address' => '10.0.0.1', 'username' => 'admin', 'password' => Crypt::encryptString('plesk-secret'),
|
|
]);
|
|
DB::table('setting')->insert(['key' => 'smtp', 'value' => json_encode(['host' => 'smtp', 'password' => SignRSA::EncryptFunc('smtp-secret')])]);
|
|
|
|
$this->useKeys($newRsa, $newAppKey, previousRsa: $oldRsa, previousAppKey: $oldAppKey);
|
|
$this->artisan('secrets:reencrypt')->assertSuccessful();
|
|
|
|
$this->useKeys($newRsa, $newAppKey);
|
|
$this->assertSame('vc-secret', SignRSA::DecryptFunc(DB::table('module_vcenter')->where('id', $vcenterId)->value('password')));
|
|
$this->assertSame('plesk-secret', Crypt::decryptString(DB::table('dns_manager_servers')->where('id', $dnsServerId)->value('password')));
|
|
$smtp = json_decode(DB::table('setting')->where('key', 'smtp')->value('value'), true);
|
|
$this->assertSame('smtp-secret', SignRSA::DecryptFunc($smtp['password']));
|
|
$this->assertSame('smtp', $smtp['host']);
|
|
}
|
|
|
|
public function test_dry_run_changes_nothing_and_undecryptable_rows_fail_the_command(): void
|
|
{
|
|
$this->useKeys($this->rsaConfig(), $this->appKey());
|
|
$id = DB::table('module_vcenter')->insertGetId(['password' => SignRSA::EncryptFunc('vc-secret')]);
|
|
$original = DB::table('module_vcenter')->where('id', $id)->value('password');
|
|
|
|
$this->artisan('secrets:reencrypt --dry-run')->assertSuccessful();
|
|
$this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));
|
|
|
|
$this->useKeys($this->rsaConfig(), $this->appKey());
|
|
$this->artisan('secrets:reencrypt')->assertFailed();
|
|
$this->assertSame($original, DB::table('module_vcenter')->where('id', $id)->value('password'));
|
|
}
|
|
|
|
private function useKeys(array $rsa, string $appKey, ?array $previousRsa = null, ?string $previousAppKey = null): void
|
|
{
|
|
config([
|
|
'rsa.key' => $rsa['key'],
|
|
'rsa.public' => $rsa['public'],
|
|
'rsa.private' => $rsa['private'],
|
|
'rsa.previous_key' => $previousRsa['key'] ?? null,
|
|
'rsa.previous_public' => $previousRsa['public'] ?? null,
|
|
'app.key' => $appKey,
|
|
'app.previous_keys' => $previousAppKey ? [$previousAppKey] : [],
|
|
]);
|
|
|
|
$this->app->forgetInstance('encrypter');
|
|
$this->app->forgetInstance(\App\Http\Services\SignRSA::class);
|
|
Crypt::clearResolvedInstance('encrypter');
|
|
SignRSA::clearResolvedInstance(\App\Http\Services\SignRSA::class);
|
|
}
|
|
|
|
private function rsaConfig(): array
|
|
{
|
|
$pair = openssl_pkey_new(['private_key_bits' => 2048]);
|
|
openssl_pkey_export($pair, $private);
|
|
|
|
return [
|
|
'key' => base64_encode(random_bytes(24)),
|
|
'public' => openssl_pkey_get_details($pair)['key'],
|
|
'private' => $private,
|
|
];
|
|
}
|
|
|
|
private function appKey(): string
|
|
{
|
|
return 'base64:' . base64_encode(Encrypter::generateKey('AES-256-CBC'));
|
|
}
|
|
}
|