Skip to content

Commit 3026932

Browse files
BitsHostBitsHost
committed
up
1 parent dbd3d41 commit 3026932

File tree

4 files changed

+304
-2
lines changed

4 files changed

+304
-2
lines changed

‎.gitignore‎

Lines changed: 19 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,25 @@
1+
# Dependencies
12
/vendor/
3+
/composer.lock
4+
5+
# Configuration files (contain secrets)
26
/config/db.php
37
/config/api.php
8+
/config/api.local.php
49
/.env
10+
11+
# Logs and storage
12+
/storage/
13+
/logs/
14+
*.log
15+
16+
# Testing artifacts
17+
jwt_token.txt
18+
*.token
19+
test_*.txt
20+
secrets_*.txt
21+
22+
# IDE and OS
523
.DS_Store
624
.idea/
7-
/tests/output/
8-
/composer.lock
25+
/tests/output/

‎README.md‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -91,6 +91,36 @@ return [
9191

9292
---
9393

94+
## 🔒 Security Setup (Production)
95+
96+
⚠️ **IMPORTANT:** This framework ships with **example credentials for development**.
97+
You **MUST** change these before deploying to production!
98+
99+
### Quick Security Setup:
100+
101+
```bash
102+
# 1. Generate secure secrets (JWT secret + API keys)
103+
php scripts/generate_secrets.php
104+
105+
# 2. Update config/api.php with generated secrets
106+
107+
# 3. Create admin user in database
108+
php scripts/create_user.php admin admin@yoursite.com YourSecurePassword123! admin
109+
```
110+
111+
### What to Change:
112+
113+
- [ ] `jwt_secret` - Generate with: `php scripts/generate_jwt_secret.php`
114+
- [ ] `api_keys` - Use long random strings (64+ characters)
115+
- [ ] Default admin password in `sql/create_api_users.sql`
116+
- [ ] Database credentials in `config/db.php`
117+
118+
📖 **Full security guide:** [docs/AUTHENTICATION.md](docs/AUTHENTICATION.md)
119+
120+
---
121+
122+
---
123+
94124
## 🔐 Authentication Modes
95125

96126
- **No auth:** `'auth_enabled' => false`

‎scripts/generate_jwt_secret.php‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,72 @@
1+
<?php
2+
/**
3+
* JWT Secret Generator
4+
*
5+
* Generates a cryptographically secure random secret for JWT token signing.
6+
* Use this to create a unique secret for your production environment.
7+
*
8+
* Usage:
9+
* php scripts/generate_jwt_secret.php
10+
*
11+
* @package PHP-CRUD-API-Generator
12+
* @version 1.0.0
13+
*/
14+
15+
echo "\n";
16+
echo "========================================\n";
17+
echo " JWT SECRET GENERATOR\n";
18+
echo "========================================\n";
19+
echo "\n";
20+
21+
// Generate 64-character hexadecimal secret (32 bytes = 256 bits)
22+
$secret = bin2hex(random_bytes(32));
23+
24+
echo "✅ Generated secure JWT secret:\n";
25+
echo "\n";
26+
echo " " . $secret . "\n";
27+
echo "\n";
28+
echo "========================================\n";
29+
echo "\n";
30+
31+
echo "📋 How to use:\n";
32+
echo "\n";
33+
echo "1. Copy the secret above\n";
34+
echo "\n";
35+
echo "2. Open: config/api.php\n";
36+
echo "\n";
37+
echo "3. Replace this line:\n";
38+
echo " 'jwt_secret' => 'YourSuperSecretKeyChangeMe',\n";
39+
echo "\n";
40+
echo "4. With:\n";
41+
echo " 'jwt_secret' => '" . $secret . "',\n";
42+
echo "\n";
43+
echo "========================================\n";
44+
echo "\n";
45+
46+
echo "⚠️ SECURITY NOTES:\n";
47+
echo "\n";
48+
echo "• Keep this secret PRIVATE (never commit to Git)\n";
49+
echo "• Use different secrets for dev/staging/production\n";
50+
echo "• Generate a new secret if compromised\n";
51+
echo "• Changing the secret invalidates all existing tokens\n";
52+
echo "\n";
53+
54+
echo "💡 TIP: For environment variables (.env file):\n";
55+
echo " JWT_SECRET=" . $secret . "\n";
56+
echo "\n";
57+
58+
// Option: Save to file
59+
echo "📁 Save to file? (y/n): ";
60+
$handle = fopen("php://stdin", "r");
61+
$line = trim(fgets($handle));
62+
63+
if (strtolower($line) === 'y') {
64+
$filename = 'jwt_secret_' . date('Y-m-d_His') . '.txt';
65+
file_put_contents($filename, $secret);
66+
echo "✅ Saved to: " . $filename . "\n";
67+
echo "⚠️ Remember to delete this file after updating your config!\n";
68+
echo "\n";
69+
}
70+
71+
echo "Done! 🎉\n";
72+
echo "\n";

‎scripts/generate_secrets.php‎

Lines changed: 183 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,183 @@
1+
<?php
2+
/**
3+
* Security Secrets Generator
4+
*
5+
* Generates all security secrets needed for production deployment:
6+
* - JWT secret (for token signing)
7+
* - API keys (for API key authentication)
8+
* - Database encryption key (optional)
9+
*
10+
* Usage:
11+
* php scripts/generate_secrets.php
12+
*
13+
* @package PHP-CRUD-API-Generator
14+
* @version 1.0.0
15+
*/
16+
17+
echo "\n";
18+
echo "╔════════════════════════════════════════╗\n";
19+
echo "║ SECURITY SECRETS GENERATOR ║\n";
20+
echo "║ PHP-CRUD-API-Generator v1.4.0 ║\n";
21+
echo "╚════════════════════════════════════════╝\n";
22+
echo "\n";
23+
24+
echo "Generating cryptographically secure secrets...\n";
25+
echo "\n";
26+
27+
// Generate secrets
28+
$jwtSecret = bin2hex(random_bytes(32)); // 64-char hex (256-bit)
29+
$apiKey1 = bin2hex(random_bytes(32)); // 64-char hex
30+
$apiKey2 = bin2hex(random_bytes(32)); // 64-char hex
31+
$encryptionKey = bin2hex(random_bytes(32)); // For future use
32+
33+
echo "========================================\n";
34+
echo " GENERATED SECRETS\n";
35+
echo "========================================\n";
36+
echo "\n";
37+
38+
// JWT Secret
39+
echo "1️⃣ JWT SECRET (for token signing):\n";
40+
echo "\n";
41+
echo " " . $jwtSecret . "\n";
42+
echo "\n";
43+
echo " Update in config/api.php:\n";
44+
echo " 'jwt_secret' => '" . $jwtSecret . "',\n";
45+
echo "\n";
46+
47+
// API Keys
48+
echo "========================================\n";
49+
echo "\n";
50+
echo "2️⃣ API KEYS (for API key authentication):\n";
51+
echo "\n";
52+
echo " Key #1: " . $apiKey1 . "\n";
53+
echo " Key #2: " . $apiKey2 . "\n";
54+
echo "\n";
55+
echo " Update in config/api.php:\n";
56+
echo " 'api_keys' => [\n";
57+
echo " '" . $apiKey1 . "',\n";
58+
echo " '" . $apiKey2 . "',\n";
59+
echo " ],\n";
60+
echo "\n";
61+
62+
// Database Encryption Key (optional)
63+
echo "========================================\n";
64+
echo "\n";
65+
echo "3️⃣ DATABASE ENCRYPTION KEY (optional):\n";
66+
echo "\n";
67+
echo " " . $encryptionKey . "\n";
68+
echo "\n";
69+
echo " Use for encrypting sensitive data in database\n";
70+
echo "\n";
71+
72+
// Environment Variables Format
73+
echo "========================================\n";
74+
echo " FOR .env FILE\n";
75+
echo "========================================\n";
76+
echo "\n";
77+
echo "JWT_SECRET=" . $jwtSecret . "\n";
78+
echo "API_KEY_1=" . $apiKey1 . "\n";
79+
echo "API_KEY_2=" . $apiKey2 . "\n";
80+
echo "ENCRYPTION_KEY=" . $encryptionKey . "\n";
81+
echo "\n";
82+
83+
// Security warnings
84+
echo "========================================\n";
85+
echo " ⚠️ SECURITY WARNINGS\n";
86+
echo "========================================\n";
87+
echo "\n";
88+
echo "✓ Keep these secrets PRIVATE and SECURE\n";
89+
echo "✓ Never commit secrets to Git\n";
90+
echo "✓ Use different secrets for dev/staging/production\n";
91+
echo "✓ Store in environment variables or secure vault\n";
92+
echo "✓ Rotate secrets regularly (every 90 days)\n";
93+
echo "✓ Changing JWT secret invalidates all tokens\n";
94+
echo "\n";
95+
96+
// Save option
97+
echo "========================================\n";
98+
echo "\n";
99+
echo "💾 Save secrets to file? (y/n): ";
100+
$handle = fopen("php://stdin", "r");
101+
$line = trim(fgets($handle));
102+
103+
if (strtolower($line) === 'y') {
104+
$timestamp = date('Y-m-d_His');
105+
$filename = 'secrets_' . $timestamp . '.txt';
106+
107+
$content = "# Generated Security Secrets\n";
108+
$content .= "# Date: " . date('Y-m-d H:i:s') . "\n";
109+
$content .= "# ⚠️ DELETE THIS FILE AFTER COPYING SECRETS!\n";
110+
$content .= "\n";
111+
$content .= "========================================\n";
112+
$content .= "JWT SECRET:\n";
113+
$content .= "========================================\n";
114+
$content .= $jwtSecret . "\n";
115+
$content .= "\n";
116+
$content .= "========================================\n";
117+
$content .= "API KEYS:\n";
118+
$content .= "========================================\n";
119+
$content .= "Key #1: " . $apiKey1 . "\n";
120+
$content .= "Key #2: " . $apiKey2 . "\n";
121+
$content .= "\n";
122+
$content .= "========================================\n";
123+
$content .= "ENCRYPTION KEY:\n";
124+
$content .= "========================================\n";
125+
$content .= $encryptionKey . "\n";
126+
$content .= "\n";
127+
$content .= "========================================\n";
128+
$content .= ".env FORMAT:\n";
129+
$content .= "========================================\n";
130+
$content .= "JWT_SECRET=" . $jwtSecret . "\n";
131+
$content .= "API_KEY_1=" . $apiKey1 . "\n";
132+
$content .= "API_KEY_2=" . $apiKey2 . "\n";
133+
$content .= "ENCRYPTION_KEY=" . $encryptionKey . "\n";
134+
$content .= "\n";
135+
$content .= "========================================\n";
136+
$content .= "config/api.php FORMAT:\n";
137+
$content .= "========================================\n";
138+
$content .= "'jwt_secret' => '" . $jwtSecret . "',\n";
139+
$content .= "'api_keys' => ['" . $apiKey1 . "', '" . $apiKey2 . "'],\n";
140+
$content .= "\n";
141+
142+
file_put_contents($filename, $content);
143+
144+
echo "\n";
145+
echo "✅ Secrets saved to: " . $filename . "\n";
146+
echo "\n";
147+
echo "⚠️ IMPORTANT:\n";
148+
echo " 1. Copy secrets to your config/api.php or .env\n";
149+
echo " 2. DELETE THIS FILE: " . $filename . "\n";
150+
echo " 3. Never commit this file to Git!\n";
151+
echo "\n";
152+
153+
// Add to .gitignore automatically
154+
$gitignorePath = __DIR__ . '/../.gitignore';
155+
if (file_exists($gitignorePath)) {
156+
$gitignoreContent = file_get_contents($gitignorePath);
157+
if (strpos($gitignoreContent, 'secrets_*.txt') === false) {
158+
file_put_contents($gitignorePath, "\n# Generated secrets files\nsecrets_*.txt\n", FILE_APPEND);
159+
echo "✅ Added 'secrets_*.txt' to .gitignore\n";
160+
}
161+
}
162+
} else {
163+
echo "\n";
164+
echo "⚠️ Make sure to copy the secrets above before closing!\n";
165+
}
166+
167+
echo "\n";
168+
echo "========================================\n";
169+
echo " 📚 NEXT STEPS\n";
170+
echo "========================================\n";
171+
echo "\n";
172+
echo "1. Update config/api.php with new secrets\n";
173+
echo "2. Or create .env file with environment variables\n";
174+
echo "3. Test authentication with new secrets\n";
175+
echo "4. Deploy to production\n";
176+
echo "\n";
177+
echo "📖 Documentation:\n";
178+
echo " - docs/AUTHENTICATION.md\n";
179+
echo " - docs/AUTH_QUICK_REFERENCE.md\n";
180+
echo "\n";
181+
182+
echo "Done! 🎉\n";
183+
echo "\n";

0 commit comments

Comments
 (0)