Initial commit device-management

2026-08-25 09:42:00 +07:00
commit 1e80be180e
1159 changed files with 149545 additions and 0 deletions
@@ -0,0 +1,89 @@
+<?php
+
+namespace App\Services\Encryption;
+
+use App\Models\Tenant;
+use App\Models\TenantEncryptionKey;
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\DB;
+use RuntimeException;
+
+class TenantEnvelopeEncryption
+{
+    private const PREFIX = 'radiq:v1:';
+
+    public function ensureKey(int $tenantId, ?int $actorId = null): TenantEncryptionKey
+    {
+        return TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->where('is_active', true)->first()
+            ?? $this->createKey($tenantId, null, $actorId);
+    }
+
+    public function encrypt(int $tenantId, string $plaintext, ?TenantEncryptionKey $key = null): string
+    {
+        $key ??= $this->ensureKey($tenantId);
+        $dek = Crypt::decryptString($key->wrapped_key);
+        $nonce = random_bytes(12);
+        $tag = '';
+        $ciphertext = openssl_encrypt($plaintext, 'aes-256-gcm', $dek, OPENSSL_RAW_DATA, $nonce, $tag, (string) $tenantId);
+        if ($ciphertext === false) {
+            throw new RuntimeException('ENCRYPTION_FAILED');
+        }
+
+        return self::PREFIX.$key->id.':'.base64_encode($nonce).':'.base64_encode($tag).':'.base64_encode($ciphertext);
+    }
+
+    public function decrypt(int $tenantId, string $payload): string
+    {
+        if (! str_starts_with($payload, self::PREFIX)) {
+            return Crypt::decryptString($payload);
+        }
+        $parts = explode(':', $payload, 6);
+        if (count($parts) !== 6) {
+            throw new RuntimeException('INVALID_ENCRYPTED_PAYLOAD');
+        }
+        $key = TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->findOrFail((int) $parts[2]);
+        $dek = Crypt::decryptString($key->wrapped_key);
+        $plaintext = openssl_decrypt(base64_decode($parts[5], true), 'aes-256-gcm', $dek, OPENSSL_RAW_DATA, base64_decode($parts[3], true), base64_decode($parts[4], true), (string) $tenantId);
+        if ($plaintext === false) {
+            throw new RuntimeException('DECRYPTION_FAILED');
+        }
+
+        return $plaintext;
+    }
+
+    public function rotate(int $tenantId, ?string $manualKey, int $actorId): TenantEncryptionKey
+    {
+        return DB::transaction(function () use ($tenantId, $manualKey, $actorId): TenantEncryptionKey {
+            Tenant::whereKey($tenantId)->lockForUpdate()->firstOrFail();
+            $oldKeys = TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->lockForUpdate()->get();
+            $newKey = $this->createKey($tenantId, $manualKey, $actorId, ($oldKeys->max('version') ?? 0) + 1);
+            foreach (DB::table('device_credentials')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'password', 'enable_password']) as $credential) {
+                DB::table('device_credentials')->where('id', $credential->id)->update([
+                    'password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $credential->password), $newKey),
+                    'enable_password' => $credential->enable_password === null ? null : $this->encrypt($tenantId, $this->decrypt($tenantId, $credential->enable_password), $newKey),
+                    'updated_at' => now(),
+                ]);
+            }
+            foreach (DB::table('tenant_device_settings')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'base_password']) as $setting) {
+                DB::table('tenant_device_settings')->where('id', $setting->id)->update(['base_password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $setting->base_password), $newKey), 'updated_at' => now()]);
+            }
+            foreach (DB::table('device_access_users')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'password']) as $accessUser) {
+                DB::table('device_access_users')->where('id', $accessUser->id)->update(['password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $accessUser->password), $newKey), 'updated_at' => now()]);
+            }
+            TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->where('id', '!=', $newKey->id)->where('is_active', true)->update(['is_active' => false, 'retired_at' => now()]);
+
+            return $newKey;
+        });
+    }
+
+    private function createKey(int $tenantId, ?string $manualKey, ?int $actorId, int $version = 1): TenantEncryptionKey
+    {
+        $tenant = Tenant::findOrFail($tenantId);
+        $dek = $manualKey === null ? random_bytes(32) : hash_hkdf('sha256', $manualKey, 32, 'RADIQ-NDM:'.$tenant->uuid);
+
+        return TenantEncryptionKey::withoutGlobalScope('tenant')->create([
+            'tenant_id' => $tenantId, 'version' => $version, 'wrapped_key' => Crypt::encryptString($dek),
+            'is_active' => true, 'source' => $manualKey === null ? 'generated' : 'manual', 'created_by' => $actorId,
+        ]);
+    }
+}