No description
Find a file
Claude dede803632
security: fix O(n) timing attack in findByToken (#9)
Add a SHA-256 token_hash lookup column to workspace_invitations so that
findByToken and findPendingByToken can locate the candidate row with a
single indexed SQL query instead of loading up to 1000 rows and running
bcrypt against each one sequentially.

The bcrypt hash in the token column is still verified after the O(1)
lookup, preserving the existing security guarantee while eliminating
both the timing side-channel and the performance bottleneck.

Changes:
- Migration to add nullable indexed token_hash column
- Model booted() creating/updating events compute SHA-256 alongside bcrypt
- findByToken/findPendingByToken rewritten to WHERE token_hash then Hash::check
- HashInvitationTokens command updated to populate token_hash for existing rows

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-24 13:06:01 +00:00
.forgejo/workflows fix(ci): install zip in release workflow 2026-02-27 17:44:02 +00:00
.gemini Initial commit 2026-01-26 21:03:15 +00:00
.github monorepo sepration 2026-01-27 00:31:43 +00:00
changelog/2026 docs: add February 2026 discovery scan changelog 2026-02-20 16:42:24 +00:00
Concerns security: fix P1 items for rate limiting, auth, SSRF and workspace validation 2026-01-29 13:19:27 +00:00
Console/Commands security: fix O(n) timing attack in findByToken (#9) 2026-03-24 13:06:01 +00:00
Contracts refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Controllers fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
Database fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
docs security: encrypt 2FA secrets and hash invitation tokens 2026-01-29 12:20:53 +00:00
Enums fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
Events chore: fix pint code style and add test config 2026-02-23 03:50:04 +00:00
Exceptions security: fix P1 items for rate limiting, auth, SSRF and workspace validation 2026-01-29 13:19:27 +00:00
Features refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Jobs refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Lang/en_GB fix: namespace to Core\Mod\Tenant, restructure package 2026-01-27 00:58:42 +00:00
Listeners refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Mail fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
Middleware security: fix P1 items for rate limiting, auth, SSRF and workspace validation 2026-01-29 13:19:27 +00:00
Migrations security: fix O(n) timing attack in findByToken (#9) 2026-03-24 13:06:01 +00:00
Models security: fix O(n) timing attack in findByToken (#9) 2026-03-24 13:06:01 +00:00
Notifications security: encrypt 2FA secrets and hash invitation tokens 2026-01-29 12:20:53 +00:00
Routes fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
Rules refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Scopes refactor: rename namespace from Core\Mod\Tenant to Core\Tenant 2026-01-27 16:30:46 +00:00
Services fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
tests fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
View fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
.editorconfig Initial commit 2026-01-26 21:03:15 +00:00
.gitattributes Initial commit 2026-01-26 21:03:15 +00:00
.gitignore chore: add .core/ and .idea/ to .gitignore 2026-03-15 10:17:51 +00:00
AGENTS.md Initial commit 2026-01-26 21:03:15 +00:00
Boot.php fix(tenant): add strict_types and fix PSR-12 compliance across all PHP files 2026-03-17 09:11:54 +00:00
CLAUDE.md docs: add CLAUDE.md project instructions 2026-03-13 13:38:03 +00:00
cliff.toml Initial commit 2026-01-26 21:03:15 +00:00
composer.json feat: rename package to lthn/php-tenant for Packagist 2026-03-09 18:00:17 +00:00
FINDINGS.md docs(phase-0): environment assessment, architecture review, and findings 2026-02-20 16:08:46 +00:00
GEMINI.md Initial commit 2026-01-26 21:03:15 +00:00
LICENSE Initial commit 2026-01-26 21:03:15 +00:00
phpunit.xml chore: fix pint code style and add test config 2026-02-23 03:50:04 +00:00
README.md feat: rename package to lthn/php-tenant for Packagist 2026-03-09 18:00:17 +00:00
TODO.md docs(phase-0): environment assessment, architecture review, and findings 2026-02-20 16:08:46 +00:00

Core Tenant

CI PHP Version Laravel License

Multi-tenancy module for the Core PHP Framework providing users, workspaces, and entitlements.

Features

  • Users & Authentication - User management with 2FA support
  • Workspaces - Multi-tenant workspace boundaries
  • Entitlements - Feature access, packages, and usage tracking
  • Account Management - User settings, account deletion
  • Referrals - Referral system support
  • Usage Alerts - Configurable usage threshold alerts

Requirements

  • PHP 8.2+
  • Laravel 11.x or 12.x
  • Core PHP Framework (lthn/php)

Installation

composer require lthn/php-tenant

The service provider will be auto-discovered.

Run migrations:

php artisan migrate

Usage

Workspace Management

use Core\Mod\Tenant\Services\WorkspaceManager;
use Core\Mod\Tenant\Services\WorkspaceService;

// Get current workspace
$workspace = app(WorkspaceManager::class)->current();

// Create a new workspace
$workspace = app(WorkspaceService::class)->create([
    'name' => 'My Workspace',
    'owner_id' => $user->id,
]);

Entitlements

use Core\Mod\Tenant\Services\EntitlementService;

$entitlements = app(EntitlementService::class);

// Check if workspace has access to a feature
if ($entitlements->hasAccess($workspace, 'premium_feature')) {
    // Feature is enabled
}

// Check usage limits
$usage = $entitlements->getUsage($workspace, 'api_calls');

Middleware

The module provides middleware for workspace-based access control:

// In your routes
Route::middleware('workspace.permission:manage-users')->group(function () {
    // Routes requiring manage-users permission
});

Models

Model Description
User Application users
Workspace Tenant workspace boundaries
WorkspaceMember Workspace membership with roles
Entitlement Feature/package entitlements
UsageRecord Usage tracking records
Referral Referral tracking

Events

The module fires events for key actions:

  • WorkspaceCreated
  • WorkspaceMemberAdded
  • WorkspaceMemberRemoved
  • EntitlementChanged
  • UsageAlertTriggered

Artisan Commands

# Refresh user statistics
php artisan tenant:refresh-user-stats

# Process scheduled account deletions
php artisan tenant:process-deletions

# Check usage alerts
php artisan tenant:check-usage-alerts

# Reset billing cycles
php artisan tenant:reset-billing-cycles

Configuration

The module uses the Core PHP configuration system. Key settings can be configured per-workspace or system-wide.

Documentation

License

EUPL-1.2 (European Union Public Licence)