Add #381 Add hash ids instead of actual ID for model routes [WIP]

.env.example

@@ -12,6 +12,11 @@ APP_DEBUG=false
 # Use `php artisan key:generate` to generate a random key.
 APP_KEY=ChangeMeBy32KeyLengthOrGenerated
 
+# Prevent information leakage by referring to IDs with hashIds instead of
+# the actual IDs used in the database.
+HASH_SALT=ChangeMeBy20+KeyLength
+HASH_LENGTH=18
+
 # The URL of your application.
 APP_URL=http://localhost
 

Dockerfile

@@ -30,6 +30,8 @@ RUN apk update && apk upgrade; \
         php7-mysqli php7-pdo_mysql \
         #- pgsql
         php7-pgsql php7-pdo_pgsql \
+        #- vinkla/hashids
+        php7-bcmath \
         #- sentry/sentry
         php7-curl; \
     # Create apache2 dir needed for httpd

app/Activity.php

@@ -3,6 +3,7 @@
 namespace App;
 
 use Carbon\Carbon;
+use App\Traits\Hasher;
 use App\Traits\Journalable;
 use Illuminate\Database\Eloquent\Model;
 use App\Interfaces\IsJournalableInterface;
@@ -17,6 +18,7 @@
 class Activity extends Model implements IsJournalableInterface
 {
     use Journalable;
+    use Hasher;
 
     /**
      * The table associated with the model.

app/Contact.php

@@ -3,6 +3,7 @@
 namespace App;
 
 use DB;
+use App\Traits\Hasher;
 use App\Traits\Searchable;
 use Illuminate\Support\Collection;
 use Illuminate\Database\Eloquent\Model;
@@ -21,6 +22,7 @@
 class Contact extends Model
 {
     use Searchable;
+    use Hasher;
 
     protected $dates = [
         'last_talked_to',

app/Debt.php

@@ -2,6 +2,7 @@
 
 namespace App;
 
+use App\Traits\Hasher;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Builder;
 
@@ -14,6 +15,7 @@
  */
 class Debt extends Model
 {
+    use Hasher;
     /**
      * The attributes that aren't mass assignable.
      *

app/Helpers/IdHasher.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Helpers;
+
+use Vinkla\Hashids\Facades\Hashids;
+
+class IdHasher
+{
+    /**
+     * Prefix for ids.
+     *
+     * @var string
+     */
+    protected $prefix;
+
+    /**
+     * Create a new IdHasher.
+     *
+     * @param string|null $prefix
+     */
+    public function __construct($prefix = null)
+    {
+        $this->prefix = $prefix ?? config('hashids.default_prefix');
+    }
+
+    public function encodeId($id)
+    {
+        return $this->prefix.Hashids::encode($id);
+    }
+
+    public function decodeId($hash)
+    {
+        if (starts_with($hash, $this->prefix)) {
+            $result = Hashids::decode(str_after($hash, $this->prefix));
+
+            return $result[0]; // result is always an array due to quirk in Hashids libary
+        } else {
+            return $hash;
+        }
+    }
+}

app/Http/Controllers/ActivitiesController.php

@@ -68,7 +68,7 @@ public function store(ActivitiesRequest $request, Contact $contact)
         // Log a journal entry
         (new JournalEntry)->add($activity);
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.activities_add_success'));
     }
 
@@ -153,7 +153,7 @@ public function update(ActivitiesRequest $request, Activity $activity, Contact $
             $newContact->logEvent('activity', $activity->id, 'create');
         }
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.activities_update_success'));
     }
 
@@ -174,7 +174,7 @@ public function destroy(Contact $contact, Activity $activity)
 
         $contact->calculateActivitiesStatistics();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.activities_delete_success'));
     }
 }

app/Http/Controllers/Contacts/CallsController.php

@@ -32,7 +32,7 @@ public function store(CallsRequest $request, Contact $contact)
 
         $contact->updateLastCalledInfo($call);
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.calls_add_success'));
     }
 
@@ -58,7 +58,7 @@ public function destroy(Contact $contact, Call $call)
             $contact->save();
         }
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.call_delete_success'));
     }
 }

app/Http/Controllers/Contacts/DebtController.php

@@ -57,7 +57,7 @@ public function store(DebtRequest $request, Contact $contact)
 
         $contact->logEvent('debt', $debt->id, 'create');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.debt_add_success'));
     }
 
@@ -111,7 +111,7 @@ public function update(DebtRequest $request, Contact $contact, Debt $debt)
 
         $contact->logEvent('debt', $debt->id, 'update');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.debt_edit_success'));
     }
 
@@ -128,7 +128,7 @@ public function destroy(Contact $contact, Debt $debt)
 
         $contact->events()->forObject($debt)->get()->each->delete();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.debt_delete_success'));
     }
 }

app/Http/Controllers/Contacts/GiftsController.php

@@ -23,6 +23,7 @@ public function get(Contact $contact)
 
         foreach ($gifts as $gift) {
             $data = [
+                'contact_hash' => $contact->hashID(),
                 'id' => $gift->id,
                 'name' => $gift->name,
                 'is_for' => $gift->recipient_name,
@@ -105,7 +106,7 @@ public function store(GiftsRequest $request, Contact $contact)
 
         $contact->logEvent('gift', $gift->id, 'create');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.gifts_add_success'));
     }
 
@@ -154,7 +155,7 @@ public function update(GiftsRequest $request, Contact $contact, Gift $gift)
 
         $contact->logEvent('gift', $gift->id, 'update');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.gifts_update_success'));
     }
 

app/Http/Controllers/Contacts/IntroductionsController.php

@@ -68,7 +68,7 @@ public function update(IntroductionsRequest $request, Contact $contact)
 
         $contact->logEvent('contact', $contact->id, 'update');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.introductions_update_success'));
     }
 
@@ -85,7 +85,7 @@ public function destroy(Contact $contact, Gift $gift)
 
         $contact->events()->forObject($gift)->get()->each->delete();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.gifts_delete_success'));
     }
 }

app/Http/Controllers/Contacts/RelationshipsController.php

@@ -147,7 +147,7 @@ public function store(Request $request, Contact $contact)
             $partner->save();
         }
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.relationship_form_add_success'));
     }
 
@@ -265,7 +265,7 @@ public function update(Request $request, Contact $contact, Contact $otherContact
             $otherContact->save();
         }
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.relationship_form_add_success'));
     }
 
@@ -288,15 +288,13 @@ public function destroy(Contact $contact, Contact $otherContact)
 
         $type = $contact->getRelationshipNatureWith($otherContact);
 
-        $contact->deleteRelationship($otherContact, $type->relationship_type_id);
-
         // the contact is partial - if the relationship is deleted, the partial
         // contact has no reason to exist anymore
         if ($otherContact->is_partial) {
             $otherContact->deleteEverything();
         }
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.relationship_form_deletion_success'));
     }
 }

app/Http/Controllers/Contacts/RemindersController.php

@@ -58,7 +58,7 @@ public function store(RemindersRequest $request, Contact $contact)
 
         $contact->logEvent('reminder', $reminder->id, 'create');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.reminders_create_success'));
     }
 
@@ -114,7 +114,7 @@ public function update(RemindersRequest $request, Contact $contact, Reminder $re
 
         $contact->logEvent('reminder', $reminder->id, 'update');
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.reminders_update_success'));
     }
 
@@ -137,7 +137,7 @@ public function destroy(Contact $contact, $reminderId)
 
         $contact->events()->forObject($reminder)->get()->each->delete();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.reminders_delete_success'));
     }
 }

app/Http/Controllers/ContactsController.php

@@ -155,7 +155,7 @@ public function store(Request $request)
 
         // Did the user press "Save" or "Submit and add another person"
         if (! is_null($request->get('save'))) {
-            return redirect()->route('people.show', ['id' => $contact->id]);
+            return redirect()->route('people.show', ['id' => $contact->hashID()]);
         } else {
             return redirect()->route('people.create')
                             ->with('status', trans('people.people_add_success', ['name' => $contact->getCompleteName(auth()->user()->name_order)]));
@@ -336,7 +336,7 @@ public function update(Request $request, Contact $contact)
 
         $contact->updateGravatar();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.information_edit_success'));
     }
 
@@ -387,7 +387,7 @@ public function updateWork(Request $request, Contact $contact)
 
         $contact->save();
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.work_edit_success'));
     }
 
@@ -417,7 +417,7 @@ public function updateFoodPreferencies(Request $request, Contact $contact)
 
         $contact->updateFoodPreferencies($food);
 
-        return redirect('/people/'.$contact->id)
+        return redirect('/people/'.$contact->hashID())
             ->with('success', trans('people.food_preferencies_add_success'));
     }
 
@@ -461,6 +461,10 @@ public function search(Request $request)
         }
 
         if (count($results) !== 0) {
+            foreach ($results as $key => $result) {
+                $results[$key]->hash = $result->hashID();
+            }
+
             return $results;
         } else {
             return ['noResults' => trans('people.people_search_no_results')];

app/Http/Controllers/DashboardController.php

@@ -28,7 +28,7 @@ public function index()
         $lastUpdatedContacts = $account->contacts()->where('is_partial', false)->latest('updated_at')->limit(10)->get();
         foreach ($lastUpdatedContacts as $contact) {
             $data = [
-                'id' => $contact->id,
+                'id' => $contact->hashID(),
                 'has_avatar' => $contact->has_avatar,
                 'avatar_url' => $contact->getAvatarURL(110),
                 'initials' => $contact->getInitials(),
@@ -86,7 +86,7 @@ public function calls()
                 'id' => $call->id,
                 'called_at' => \App\Helpers\DateHelper::getShortDate($call->called_at),
                 'name' => $call->contact->getIncompleteName(),
-                'contact_id' => $call->contact->id,
+                'contact_id' => $call->contact->hashID(),
             ];
             $callsCollection->push($data);
         }
@@ -110,7 +110,7 @@ public function notes()
                 'created_at' => \App\Helpers\DateHelper::getShortDate($note->created_at),
                 'name' => $note->contact->getIncompleteName(),
                 'contact' => [
-                    'id' => $note->contact->id,
+                    'id' => $note->contact->hashID(),
                     'has_avatar' => $note->contact->has_avatar,
                     'avatar_url' => $note->contact->getAvatarURL(110),
                     'initials' => $note->contact->getInitials(),

app/Http/Resources/Contact/ContactShort.php

@@ -16,6 +16,7 @@ public function toArray($request)
     {
         return [
             'id' => $this->id,
+            'hash_ID' => $this->hashID(),
             'object' => 'contact',
             'first_name' => $this->first_name,
             'last_name' => $this->last_name,