Hamza-AyedandClaude Opus 5
6802026dbd
Searching encrypted columns currently works only because encryptData() is AES-CBC with a fixed IV, i.e. deterministic. That determinism is what leaks equality and shared prefixes, and it is why moving storage to AES-GCM would break every lookup. This separates the two concerns. - core/Security/BlindIndex.php: HMAC-SHA256 over a normalised value, keyed by a secret pepper. Phone numbers have a small keyspace, so a bare SHA-256 would be reversible by enumeration; the pepper lives in the environment, not the database. The scope string includes table and field so the same number does not produce a matching index across tables. Normalisation unifies local/international phone forms, lowercases emails and folds Arabic alef/ya/ta-marbuta and diacritics for names. - migrations/: nullable *_bidx columns plus indexes, and the missing adminUser.status/approved_by/approved_at columns that admin approvals need. - scripts/backfill_blind_index.php: restartable, batched, --dry-run capable, touches only index columns. - Admin lookups by phone/email now match the index, keeping the old ciphertext comparison in the same query so search keeps working until the backfill runs. bootstrap exposes $blindIndex as null when no pepper is configured. Also: AdminCaptain/getCaptainDetailsById.php selected driver.education, a column absent from this schema. The PDOException was uncaught, so the client received an empty body with HTTP 200 — the "non-JSON response" seen when opening a captain. It now omits the column, catches the error, reports it as JSON, and requires an admin role. Console: opening any sidebar section refetches its data instead of showing what was loaded when the console started. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
41 lines
2.4 KiB
SQL
41 lines
2.4 KiB
SQL
-- ============================================================
|
|
-- Blind index columns for searching encrypted fields
|
|
-- 2026-07-25
|
|
--
|
|
-- تُضاف أعمدة بحث حتمية (HMAC) بجانب الأعمدة المشفّرة، حتى يمكن نقل التخزين
|
|
-- إلى AES-GCM العشوائي دون فقدان القدرة على البحث.
|
|
--
|
|
-- آمنة للتشغيل على قاعدة تعمل: كل الأعمدة NULL افتراضياً ولا يقرأها أي كود
|
|
-- قبل تشغيل سكربت التعبئة.
|
|
-- ============================================================
|
|
|
|
ALTER TABLE `driver`
|
|
ADD COLUMN `phone_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالهاتف',
|
|
ADD COLUMN `email_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالبريد',
|
|
ADD COLUMN `name_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للاسم الكامل بعد التطبيع',
|
|
ADD INDEX `idx_driver_phone_bidx` (`phone_bidx`),
|
|
ADD INDEX `idx_driver_email_bidx` (`email_bidx`),
|
|
ADD INDEX `idx_driver_name_bidx` (`name_bidx`);
|
|
|
|
ALTER TABLE `passengers`
|
|
ADD COLUMN `phone_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالهاتف',
|
|
ADD COLUMN `email_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالبريد',
|
|
ADD COLUMN `name_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للاسم الكامل بعد التطبيع',
|
|
ADD INDEX `idx_passengers_phone_bidx` (`phone_bidx`),
|
|
ADD INDEX `idx_passengers_email_bidx` (`email_bidx`),
|
|
ADD INDEX `idx_passengers_name_bidx` (`name_bidx`);
|
|
|
|
ALTER TABLE `adminUser`
|
|
ADD COLUMN `phone_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالهاتف',
|
|
ADD COLUMN `email_bidx` CHAR(64) NULL DEFAULT NULL COMMENT 'HMAC للبحث بالبريد',
|
|
ADD INDEX `idx_adminuser_phone_bidx` (`phone_bidx`),
|
|
ADD INDEX `idx_adminuser_email_bidx` (`email_bidx`);
|
|
|
|
-- عمود status مفقود في هذا النشر، وبدونه لا يمكن تتبّع موافقات المشرفين
|
|
-- (Admin/Staff/pending.php و auth/approve_admin.php يعتمدان عليه).
|
|
-- القيمة الافتراضية 'active' مقصودة حتى لا تُقفل الحسابات القائمة خارج النظام.
|
|
ALTER TABLE `adminUser`
|
|
ADD COLUMN `status` VARCHAR(20) NOT NULL DEFAULT 'active' COMMENT 'active | pending | suspended | rejected',
|
|
ADD COLUMN `approved_by` VARCHAR(32) NULL DEFAULT NULL,
|
|
ADD COLUMN `approved_at` TIMESTAMP NULL DEFAULT NULL;
|