Update Saqel Platform: 2026-09-08 13:43:36

backend/scripts/backfill_national_id_hash.php

@@ -0,0 +1,34 @@
+<?php
+
+if (PHP_SAPI !== 'cli') {
+    http_response_code(404);
+    exit;
+}
+
+require_once dirname(__DIR__) . '/app/bootstrap.php';
+
+use App\Core\Database;
+use App\Core\Security;
+
+foreach (['students', 'school_rosters'] as $table) {
+    $rows = Database::select("SELECT id, national_id FROM `{$table}` WHERE national_id_hash IS NULL OR national_id_hash = ''");
+    foreach ($rows as $row) {
+        $stored = (string)$row['national_id'];
+        $plain = Security::decrypt($stored);
+        if ($plain === '') {
+            $plain = trim($stored);
+        }
+        if (!preg_match('/^[0-9]{10}$/', $plain)) {
+            throw new RuntimeException("Invalid national ID in {$table} row {$row['id']}; migration stopped.");
+        }
+        Database::query(
+            "UPDATE `{$table}` SET national_id = ?, national_id_hash = ? WHERE id = ?",
+            [Security::encrypt($plain), Security::blindIndex($plain), $row['id']]
+        );
+    }
+}
+
+Database::query("ALTER TABLE students MODIFY national_id_hash CHAR(64) NOT NULL, ADD UNIQUE INDEX uq_students_national_id_hash (national_id_hash)");
+Database::query("ALTER TABLE school_rosters MODIFY national_id_hash CHAR(64) NOT NULL, ADD UNIQUE INDEX uq_school_roster_national_id_hash (school_id, national_id_hash)");
+
+fwrite(STDOUT, "National ID encryption and blind-index migration completed.\n");