Drupal7 Password Hasher Laravel Package

Technical Evaluation

Architecture Fit

• Use Case Alignment: The package is a niche solution for Drupal 7 password hashing compatibility, targeting non-Drupal projects requiring legacy Drupal 7 user account imports. It aligns with projects needing backward compatibility for authentication systems.
• PSR-4 Compliance: Ensures seamless integration with modern PHP/Laravel ecosystems, avoiding autoloading conflicts.
• Limited Scope: Focuses solely on password hashing (no broader auth/DB integration), reducing architectural coupling.

Integration Feasibility

• Laravel Compatibility:
  • Works with Laravel’s HashInterface (if wrapped in a custom facade) or as a standalone utility.
  • No native Laravel service provider or Eloquent hooks, requiring manual binding.
• Dependencies:
  • Lightweight (only PHP core + Drupal 7’s user_pass() logic).
  • No external DB dependencies (pure hashing logic).

Technical Risk

• Security:
  • Drupal 7’s hashing (SHA-512 + salt) is not modern (e.g., no Argon2/Bcrypt). Risk if used for new user hashing.
  • Mitigation: Restrict to legacy import only; use Laravel’s default hasher (Hash::make()) for new users.
• Deprecation:
  • Drupal 7 EOL (2023). Future-proofing may require rewrites if Drupal 8/9+ hashing diverges.
• Edge Cases:
  • Salt handling must match Drupal 7’s $account->pass format (e.g., :$salt:$hash).
  • No built-in password verification helpers (must implement manually).

Key Questions

1. Why Drupal 7? Is this for a one-time migration or ongoing legacy support?
2. Hashing Strategy:
   • Will new users use this hasher, or only imported Drupal 7 users?
   • How will salt generation/validation be handled in Laravel’s auth system?
3. Testing:
   • Are there existing Drupal 7 hashed passwords to validate against?
   • How will password reset flows (e.g., tokens) interact with this hasher?
4. Alternatives:
   • Could hautelook/phpass (more maintained) or Laravel’s Hash facade suffice?
   • Is there a plan to upgrade to Drupal 9’s hashing (e.g., password_hash())?

Integration Approach

Stack Fit

• Laravel Integration Points:
  • Custom Hash Driver: Extend Laravel’s Hash facade to delegate Drupal 7 hashes to this package.
  • Auth Service Provider: Override retrieveByCredentials() to handle legacy hashes.
  • Migration Tool: Use during user import (e.g., in a UserSeeder or console command).
• Non-Auth Use Cases:
  • API endpoints for legacy system interop (e.g., /auth/drupal7/login).

Migration Path

1. Phase 1: Isolation
   • Add package via Composer (composer require selfsimilar/drupal7_password_hasher).
   • Create a wrapper class (e.g., Drupal7PasswordHasher) to abstract the package.
   • Example:

     use Selfsimilar\Drupal7PasswordHasher\Drupal7PasswordHasher as DrupalHasher;
     
     class LaravelDrupalHasher implements HashInterface {
         public function make($value, array $options = []): string {
             return DrupalHasher::hash($value);
         }
         // Implement verify(), needs(), etc.
     }
     

2. Phase 2: Auth Integration
   • Bind the wrapper to Laravel’s container:

     $this->app->bind(HashInterface::class, function ($app) {
         return new LaravelDrupalHasher();
     });
     

   • Conditional Logic: Use middleware or a trait to route legacy hashes to the Drupal hasher.
3. Phase 3: Migration Tool
   • Build a console command to rehash imported users:

     User::where('imported_from', 'drupal7')->each(function ($user) {
         $user->password = DrupalHasher::hash($user->plain_password);
         $user->save();
     });
     

Compatibility

• Laravel Versions: Tested on PHP 7.4+ (Drupal 7’s min requirement). May need polyfills for older Laravel versions.
• Database: No schema changes required; works with existing users.password fields.
• Dependencies: Conflicts unlikely unless another package uses Drupal 7’s user module.

Sequencing

1. Spike: Validate 1–2 sample Drupal 7 hashes against the package.
2. Wrapper: Build the Laravel-compatible abstraction.
3. Auth Flow: Integrate into login/registration (e.g., via custom guard).
4. Migration: Batch-rehash users during off-peak hours.
5. Deprecation: Plan to remove after all Drupal 7 users are migrated.

Operational Impact

Maintenance

• Low Effort:
  • Package has no active maintenance; bugs require forking or patching.
  • Documentation is minimal (assume reverse-engineering Drupal 7’s user_pass()).
• Upgrade Path:
  • If Drupal 8/9 hashing standards change, the wrapper may need updates.

Support

• Debugging:
  • Complexity arises from manual salt/format handling. Log raw hashes for troubleshooting.
  • Example debug helper:

    function isDrupal7Hash(string $hash): bool {
        return strpos($hash, ':') !== false; // Drupal 7 format: :$salt:$hash
    }
    

• User Impact:
  • Password resets may fail if tokens aren’t Drupal 7-compatible (e.g., user_pass_reset()).

Scaling

• Performance:
  • Hashing is CPU-bound but lightweight. No scaling concerns unless processing millions of users.
  • Consider batching during migration.
• Concurrency:
  • Stateless hashing; no locks needed for parallel imports.

Failure Modes

Ramp-Up

• Team Skills:
  • Requires familiarity with Laravel’s auth system and Drupal 7’s hashing quirks.
  • Pair with a backend dev for initial integration.
• Onboarding:
  • Document:
    • Hash format differences (e.g., :$salt:$hash vs. Laravel’s argon2id$...).
    • Migration steps and rollback procedures.
• Training:
  • Demo the wrapper class and auth flow for QA/testers.
  • Highlight security risks of mixing hashers.