Wian Drs
90 lines
4.7 KiB
PHP
90 lines
4.7 KiB
PHP
<?php
|
|
|
|
namespace App\Services\Encryption;
|
|
|
|
use App\Models\Tenant;
|
|
use App\Models\TenantEncryptionKey;
|
|
use Illuminate\Support\Facades\Crypt;
|
|
use Illuminate\Support\Facades\DB;
|
|
use RuntimeException;
|
|
|
|
class TenantEnvelopeEncryption
|
|
{
|
|
private const PREFIX = 'radiq:v1:';
|
|
|
|
public function ensureKey(int $tenantId, ?int $actorId = null): TenantEncryptionKey
|
|
{
|
|
return TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->where('is_active', true)->first()
|
|
?? $this->createKey($tenantId, null, $actorId);
|
|
}
|
|
|
|
public function encrypt(int $tenantId, string $plaintext, ?TenantEncryptionKey $key = null): string
|
|
{
|
|
$key ??= $this->ensureKey($tenantId);
|
|
$dek = Crypt::decryptString($key->wrapped_key);
|
|
$nonce = random_bytes(12);
|
|
$tag = '';
|
|
$ciphertext = openssl_encrypt($plaintext, 'aes-256-gcm', $dek, OPENSSL_RAW_DATA, $nonce, $tag, (string) $tenantId);
|
|
if ($ciphertext === false) {
|
|
throw new RuntimeException('ENCRYPTION_FAILED');
|
|
}
|
|
|
|
return self::PREFIX.$key->id.':'.base64_encode($nonce).':'.base64_encode($tag).':'.base64_encode($ciphertext);
|
|
}
|
|
|
|
public function decrypt(int $tenantId, string $payload): string
|
|
{
|
|
if (! str_starts_with($payload, self::PREFIX)) {
|
|
return Crypt::decryptString($payload);
|
|
}
|
|
$parts = explode(':', $payload, 6);
|
|
if (count($parts) !== 6) {
|
|
throw new RuntimeException('INVALID_ENCRYPTED_PAYLOAD');
|
|
}
|
|
$key = TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->findOrFail((int) $parts[2]);
|
|
$dek = Crypt::decryptString($key->wrapped_key);
|
|
$plaintext = openssl_decrypt(base64_decode($parts[5], true), 'aes-256-gcm', $dek, OPENSSL_RAW_DATA, base64_decode($parts[3], true), base64_decode($parts[4], true), (string) $tenantId);
|
|
if ($plaintext === false) {
|
|
throw new RuntimeException('DECRYPTION_FAILED');
|
|
}
|
|
|
|
return $plaintext;
|
|
}
|
|
|
|
public function rotate(int $tenantId, ?string $manualKey, int $actorId): TenantEncryptionKey
|
|
{
|
|
return DB::transaction(function () use ($tenantId, $manualKey, $actorId): TenantEncryptionKey {
|
|
Tenant::whereKey($tenantId)->lockForUpdate()->firstOrFail();
|
|
$oldKeys = TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->lockForUpdate()->get();
|
|
$newKey = $this->createKey($tenantId, $manualKey, $actorId, ($oldKeys->max('version') ?? 0) + 1);
|
|
foreach (DB::table('device_credentials')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'password', 'enable_password']) as $credential) {
|
|
DB::table('device_credentials')->where('id', $credential->id)->update([
|
|
'password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $credential->password), $newKey),
|
|
'enable_password' => $credential->enable_password === null ? null : $this->encrypt($tenantId, $this->decrypt($tenantId, $credential->enable_password), $newKey),
|
|
'updated_at' => now(),
|
|
]);
|
|
}
|
|
foreach (DB::table('tenant_device_settings')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'base_password']) as $setting) {
|
|
DB::table('tenant_device_settings')->where('id', $setting->id)->update(['base_password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $setting->base_password), $newKey), 'updated_at' => now()]);
|
|
}
|
|
foreach (DB::table('device_access_users')->where('tenant_id', $tenantId)->lockForUpdate()->get(['id', 'password']) as $accessUser) {
|
|
DB::table('device_access_users')->where('id', $accessUser->id)->update(['password' => $this->encrypt($tenantId, $this->decrypt($tenantId, $accessUser->password), $newKey), 'updated_at' => now()]);
|
|
}
|
|
TenantEncryptionKey::withoutGlobalScope('tenant')->where('tenant_id', $tenantId)->where('id', '!=', $newKey->id)->where('is_active', true)->update(['is_active' => false, 'retired_at' => now()]);
|
|
|
|
return $newKey;
|
|
});
|
|
}
|
|
|
|
private function createKey(int $tenantId, ?string $manualKey, ?int $actorId, int $version = 1): TenantEncryptionKey
|
|
{
|
|
$tenant = Tenant::findOrFail($tenantId);
|
|
$dek = $manualKey === null ? random_bytes(32) : hash_hkdf('sha256', $manualKey, 32, 'RADIQ-NDM:'.$tenant->uuid);
|
|
|
|
return TenantEncryptionKey::withoutGlobalScope('tenant')->create([
|
|
'tenant_id' => $tenantId, 'version' => $version, 'wrapped_key' => Crypt::encryptString($dek),
|
|
'is_active' => true, 'source' => $manualKey === null ? 'generated' : 'manual', 'created_by' => $actorId,
|
|
]);
|
|
}
|
|
}
|