Update documentation and configuration for encryption bundle

- Enhanced the description in composer.json to better reflect the bundle's capabilities, including GDPR compliance and key rotation.
- Updated README.md to clarify usage and features, emphasizing support for multiple encryption configurations and integration with Nowo\AnonymizedBundle.
- Improved demo Makefile and entrypoint scripts to streamline key generation and environment variable handling.
- Added support for environment variable-based encryption keys in configuration files, enhancing flexibility for users.
- Updated various templates and forms to reflect changes in encryption handling and improve user experience.

Author: HecFranco

.symfony/recipe/nowo-tech/doctrine-encrypt-bundle/1.0/1.0/config/packages/nowo_doctrine_encrypt.yaml

@@ -9,4 +9,6 @@ nowo_doctrine_encrypt:
         default:
             encryptor_class: Halite   # or Defuse (requires: composer require defuse/php-encryption ^2.1)
             secret_directory_path: '%kernel.project_dir%'
+            # Optional: secret_key_filename: '.my_app.key'   # custom key file name (only when using path)
+            # Optional: secret_key_env_var: '%env(APP_ENCRYPT_KEY)%'   # Symfony resolves at config load; do not set secret_directory_path; run generate-secret-key to get the key
     # Optional: add more configs (e.g. personal_data, financial_data) - see docs/CONFIGURATION.md

README.md

@@ -2,9 +2,9 @@
 
 [![CI](https://github.com/nowo-tech/DoctrineEncryptBundle/actions/workflows/ci.yml/badge.svg)](https://github.com/nowo-tech/DoctrineEncryptBundle/actions/workflows/ci.yml) [![Packagist Version](https://img.shields.io/packagist/v/nowo-tech/doctrine-encrypt-bundle.svg?style=flat)](https://packagist.org/packages/nowo-tech/doctrine-encrypt-bundle) [![Packagist Downloads](https://img.shields.io/packagist/dt/nowo-tech/doctrine-encrypt-bundle.svg)](https://packagist.org/packages/nowo-tech/doctrine-encrypt-bundle) [![License](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE) [![PHP](https://img.shields.io/badge/PHP-8.1%2B-777BB4?logo=php)](https://php.net) [![Symfony](https://img.shields.io/badge/Symfony-7%20%7C%208-000000?logo=symfony)](https://symfony.com) [![GitHub stars](https://img.shields.io/github/stars/nowo-tech/doctrine-encrypt-bundle.svg?style=social&label=Star)](https://github.com/nowo-tech/DoctrineEncryptBundle)
 
-> ⭐ **Found this useful?** [Install from Packagist](https://packagist.org/packages/nowo-tech/doctrine-encrypt-bundle) · Give it a **star** on [GitHub](https://github.com/nowo-tech/DoctrineEncryptBundle) so more developers can find it.
+**Symfony bundle to encrypt Doctrine entity fields at rest** using [Halite](https://github.com/paragonie/halite) or [Defuse](https://github.com/defuse/php-encryption)—audited libraries, no custom crypto. For **Symfony 7 and 8** · PHP 8.1+. Suits **GDPR** and compliance (e.g. Art. 32); supports key rotation and [Nowo\AnonymizedBundle](https://github.com/nowo-tech/AnonymizedBundle) for anonymization and erasure.
 
-**Doctrine Encrypt Bundle** — Encrypt Doctrine entity fields with [Halite](https://github.com/paragonie/halite) or [Defuse](https://github.com/defuse/php-encryption). Uses verified, standardized libraries (no custom crypto). For Symfony 7 and 8 · PHP 8.1+.
+> ⭐ **Found this useful?** [Install from Packagist](https://packagist.org/packages/nowo-tech/doctrine-encrypt-bundle) · Give it a **star** on [GitHub](https://github.com/nowo-tech/DoctrineEncryptBundle) so more developers can find it.
 
 ## Table of contents
 
@@ -33,7 +33,8 @@ Looking for **Doctrine encryption**, **encrypt entity fields**, **Halite Symfony
 - ✅ **Twig filter** `|decrypt` — decrypt in templates; optional config argument: `{{ value|decrypt }}` or `{{ value|decrypt('financial_data') }}`
 - ✅ Works with **embedded entities** and **inheritance**
 - ✅ Console commands: status, generate secret key, encrypt/decrypt database
-- ✅ **Symfony Flex** recipe (register bundle + config; see [Recipe/](Recipe/README.md))
+- ✅ **Key rotation** — decrypt, replace keys, re-encrypt; combinable with [Nowo\AnonymizedBundle](https://github.com/nowo-tech/AnonymizedBundle) for GDPR-compliant anonymization and erasure
+- ✅ **Symfony Flex** recipe (register bundle + config; see [docs/INSTALLATION.md](docs/INSTALLATION.md))
 - ✅ Compatible with **Symfony 7 and 8** and **Doctrine ORM 2.x and 3.x**
 
 ## Installation
@@ -144,7 +145,7 @@ Values are encrypted on persist/update and decrypted on load. For **programmatic
 | [**Usage**](docs/USAGE.md) | Encrypted attribute, embedded entities, inheritance |
 | [**Example**](docs/EXAMPLE.md) | Full example: entity, fixtures, controller, template |
 | [**Commands**](docs/COMMANDS.md) | Status, generate key, encrypt/decrypt database |
-| [**Key rotation**](docs/KEY_ROTATION.md) | Strategy to change keys: backup, decrypt, replace keys, re-encrypt |
+| [**Key rotation**](docs/KEY_ROTATION.md) | Strategy to change keys: backup, decrypt, replace keys, re-encrypt. Supports GDPR compliance; combinable with Nowo\AnonymizedBundle. |
 | [**Demo**](docs/DEMO.md) | Demo projects (Symfony 7/8) and how to run them |
 | [**Changelog**](docs/CHANGELOG.md) | Version history |
 | [**Upgrading**](docs/UPGRADING.md) | Upgrade notes between versions |

composer.json

@@ -1,22 +1,28 @@
 {
   "name": "nowo-tech/doctrine-encrypt-bundle",
-  "description": "Encrypt Symfony 7|8 entity fields with Halite or Defuse (verified libraries).",
+  "description": "Encrypt Doctrine entity fields at rest with Halite or Defuse. Symfony 7|8 bundle for field-level encryption, GDPR-friendly, multiple keys, key rotation.",
   "type": "symfony-bundle",
   "license": "MIT",
   "keywords": [
     "doctrine",
     "symfony",
-    "halite",
-    "defuse",
+    "symfony-bundle",
+    "encryption",
     "encrypt",
     "decrypt",
-    "entity"
+    "halite",
+    "defuse",
+    "entity",
+    "field-level encryption",
+    "data-at-rest",
+    "gdpr",
+    "key rotation"
   ],
   "homepage": "https://github.com/nowo-tech/DoctrineEncryptBundle",
   "support": {
     "issues": "https://github.com/nowo-tech/DoctrineEncryptBundle/issues",
     "source": "https://github.com/nowo-tech/DoctrineEncryptBundle",
-    "docs": "https://github.com/nowo-tech/DoctrineEncryptBundle/tree/main/docs"
+    "docs": "https://github.com/nowo-tech/DoctrineEncryptBundle/blob/master/docs/INSTALLATION.md"
   },
   "authors": [
     {

demo/README.md

@@ -30,12 +30,12 @@ Luego abre en el navegador la URL que se indique (ej. `http://localhost:8008`).
 - **down** – Para los contenedores.
 - **build** – Reconstruye la imagen sin caché.
 - **install** – `composer install` en el contenedor (usa el bundle desde `/var/doctrine-encrypt-bundle`).
-- **setup** – install + `doctrine:database:create` + `doctrine:schema:update` + `doctrine:encrypt:generate-secret-key`.
+- **setup** – install + `doctrine:database:create` + `doctrine:schema:update` + `doctrine:encrypt:generate-secret-key` (crea archivos de clave y añade `APP_ENCRYPT_KEY` a `.env` si no existe).
 - **shell** – Abre una shell en el contenedor PHP.
 - **logs** – Muestra los logs del contenedor.
 - **db-create** – Crea la base SQLite.
 - **db-schema** – Actualiza el schema Doctrine.
-- **key** – Genera la clave secreta de cifrado (Halite).
+- **key** – Genera claves: `personal_data` usa `APP_ENCRYPT_KEY` (se imprime y debe añadirse a `.env`); `financial_data` usa el archivo `.demo_financial.key`.
 - **cache-clear** – Limpia la caché de Symfony.
 - **update-bundle** – Actualiza el bundle desde el path montado y limpia caché.
 - **test** – Ejecuta los tests de la demo (si existen).

demo/symfony7/.env.example

@@ -1,8 +1,8 @@
 APP_ENV=dev
 APP_SECRET=change-me-in-production
 
-# Doctrine Encrypt Bundle: Halite | Defuse | Sodium | OpenSSL
-APP_ENCRYPTOR=Halite
+# Doctrine Encrypt Bundle (personal_data config; generated on first make up / entrypoint)
+APP_ENCRYPT_KEY=
 
 ###> doctrine/doctrine-bundle ###
 DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"

demo/symfony7/.gitignore

@@ -17,4 +17,5 @@
 .Halite.key
 .Defuse.key
 .Halite.*.key
-.Defuse.*.key
+.Defuse.*.key
+.demo_financial.key

demo/symfony7/Makefile

@@ -6,7 +6,7 @@ COMPOSE := docker-compose -f $(COMPOSE_FILE)
 SERVICE_PHP := php
 
 .PHONY: help up down build install shell logs setup db-create db-schema key fixtures cache-clear update-bundle test encrypt-status encrypt-database decrypt-database ensure-up
-.PHONY: encrypt-database-all decrypt-database-all encrypt-database-personal_data decrypt-database-personal_data encrypt-database-financial_data decrypt-database-financial_data
+.PHONY: encrypt-database-all decrypt-database-all encrypt-database-personal_data decrypt-database-personal_data encrypt-database-financial_data decrypt-database-financial_data encrypt-database-env_var decrypt-database-env_var
 
 help:
 	@echo "Doctrine Encrypt Bundle Demo - Symfony 7"
@@ -25,12 +25,14 @@ help:
 	@echo "  make encrypt-status     List entities and encrypted properties"
 	@echo "  make encrypt-database   Encrypt: all configs (interactive)"
 	@echo "  make encrypt-database-all            Same: all configs"
-	@echo "  make encrypt-database-personal_data  Encrypt: only config personal_data"
-	@echo "  make encrypt-database-financial_data Encrypt: only config financial_data"
+	@echo "  make encrypt-database-personal_data  Encrypt: config personal_data (default path)"
+	@echo "  make encrypt-database-financial_data Encrypt: config financial_data (secret_key_filename)"
+	@echo "  make encrypt-database-env_var       Encrypt: config env_var (%env(APP_ENCRYPT_KEY)%)"
 	@echo "  make decrypt-database   Decrypt: all configs (interactive)"
 	@echo "  make decrypt-database-all            Same: all configs"
-	@echo "  make decrypt-database-personal_data  Decrypt: only config personal_data"
-	@echo "  make decrypt-database-financial_data Decrypt: only config financial_data"
+	@echo "  make decrypt-database-personal_data  Decrypt: config personal_data"
+	@echo "  make decrypt-database-financial_data Decrypt: config financial_data"
+	@echo "  make decrypt-database-env_var       Decrypt: config env_var"
 	@echo "  make cache-clear        Clear Symfony cache"
 	@echo "  make update-bundle      Update bundle from path repo"
 	@echo "  make test               Run tests"
@@ -81,7 +83,7 @@ db-schema: ensure-up
 
 key: ensure-up
 	$(COMPOSE) exec -T $(SERVICE_PHP) php bin/console doctrine:encrypt:generate-secret-key 2>/dev/null || true
-	@echo "Halite key for personal_data generated (or exists). Defuse creates .Defuse.financial_data.key on first use."
+	@echo "Keys: personal_data = .Halite.personal_data.key; financial_data = .demo_financial.key; env_var = APP_ENCRYPT_KEY (.env). Add printed key to .env if APP_ENCRYPT_KEY is empty."
 
 encrypt-status: ensure-up
 	$(COMPOSE) exec -T $(SERVICE_PHP) php bin/console doctrine:encrypt:status
@@ -97,6 +99,9 @@ encrypt-database-personal_data: ensure-up
 encrypt-database-financial_data: ensure-up
 	$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:database financial_data
 
+encrypt-database-env_var: ensure-up
+	$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:database env_var
+
 # Decrypt: all configs (no config argument)
 decrypt-database decrypt-database-all: ensure-up
 	$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:decrypt:database
@@ -108,6 +113,9 @@ decrypt-database-personal_data: ensure-up
 decrypt-database-financial_data: ensure-up
 	$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:decrypt:database financial_data
 
+decrypt-database-env_var: ensure-up
+	$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:decrypt:database env_var
+
 cache-clear: ensure-up
 	$(COMPOSE) exec -T $(SERVICE_PHP) php bin/console cache:clear
 

demo/symfony7/config/packages/nowo_doctrine_encrypt.yaml

@@ -1,16 +1,23 @@
-# Single encryptor (default) - uncomment to use only one encryptor:
-# nowo_doctrine_encrypt:
-#   encryptor_class: Halite
-#   secret_directory_path: '%kernel.project_dir%'
-
-# Multiple encryptors (see docs/CONFIGURATION.md) - SecretMessage (default), SensitiveRecord (personal_data + financial_data)
+# Demo: three config variants
+# 1. default_path (personal_data): default key path, no secret_key_filename → .Halite.personal_data.key
+# 2. custom_filename (financial_data): custom secret_key_filename → .demo_financial.key
+# 3. env_var: key from environment; %env(APP_ENCRYPT_KEY)% is resolved by Symfony and the bundle receives the value
 # Halite and Defuse (requires: composer require defuse/php-encryption ^2.1)
 nowo_doctrine_encrypt:
   default_config: personal_data
   configs:
+    # 1) No secret_key_filename: default path .Halite.personal_data.key
     personal_data:
       encryptor_class: Halite
       secret_directory_path: '%kernel.project_dir%'
+
+    # 2) With secret_key_filename: custom filename
     financial_data:
       encryptor_class: Defuse
       secret_directory_path: '%kernel.project_dir%'
+      secret_key_filename: '.demo_financial.key'
+
+    # 3) Key from .env; Symfony resolves %env()% and the bundle receives the value
+    env_var:
+      encryptor_class: Halite
+      secret_key_env_var: '%env(APP_ENCRYPT_KEY)%'

demo/symfony7/docker/entrypoint.sh

@@ -14,11 +14,22 @@ if [ -d /app/vendor ]; then
 	echo "📦 Creating database and schema if needed..."
 	php /app/bin/console doctrine:database:create --if-not-exists --no-interaction 2>/dev/null || true
 	php /app/bin/console doctrine:schema:update --force --no-interaction 2>/dev/null || true
-	echo "📦 Generating encryption secret key if needed..."
-	php /app/bin/console doctrine:encrypt:generate-secret-key 2>/dev/null || true
+	if [ ! -f /app/.env ]; then
+		cp /app/.env.example /app/.env 2>/dev/null || true
+	fi
+	echo "📦 Generating encryption keys (files + env)..."
+	KEYGEN_OUT=$(php /app/bin/console doctrine:encrypt:generate-secret-key 2>/dev/null || true)
+	echo "$KEYGEN_OUT"
+	KEY=$(echo "$KEYGEN_OUT" | grep -E '^[a-f0-9]{100,}$' | head -1)
+	if [ -n "$KEY" ] && ! grep -q '^APP_ENCRYPT_KEY=.' /app/.env 2>/dev/null; then
+		echo "" >> /app/.env
+		echo "# Doctrine Encrypt Bundle - key for personal_data (generated by doctrine:encrypt:generate-secret-key)" >> /app/.env
+		echo "APP_ENCRYPT_KEY=$KEY" >> /app/.env
+		echo "✅ APP_ENCRYPT_KEY added to .env"
+	fi
 	echo "📦 Loading fixtures..."
 	php /app/bin/console doctrine:fixtures:load --no-interaction 2>/dev/null || true
-	echo "✅ Database, key and fixtures ready."
+	echo "✅ Database, keys and fixtures ready."
 fi
 
 exec frankenphp run --config /etc/frankenphp/Caddyfile --adapter caddyfile

demo/symfony7/src/Controller/EncryptUtilDemoController.php

@@ -22,17 +22,17 @@ public function index(EncryptUtil $encryptUtil): Response
         $encryptedDefault = $encryptUtil->encrypt($plainDefault);
         $decryptedDefault = $encryptUtil->decrypt($encryptedDefault);
 
-        // --- Config indicada: personal_data ---
+        // --- Specified config: personal_data ---
         $plainPersonal = 'Secret with personal_data config';
         $encryptedPersonal = $encryptUtil->encrypt($plainPersonal, 'personal_data');
         $decryptedPersonal = $encryptUtil->decrypt($encryptedPersonal, 'personal_data');
 
-        // --- Config indicada: financial_data ---
+        // --- Specified config: financial_data ---
         $plainFinancial = 'Secret with financial_data config';
         $encryptedFinancial = $encryptUtil->encrypt($plainFinancial, 'financial_data');
         $decryptedFinancial = $encryptUtil->decrypt($encryptedFinancial, 'financial_data');
 
-        // --- For Twig filter: default and config indicada (misma y distinta de la default) ---
+        // --- For Twig filter: default and specified config (same and different from default) ---
         $encryptedForTwigDefault = $encryptUtil->encrypt('Decrypted in Twig with |decrypt (default)');
         $encryptedForTwigPersonal = $encryptUtil->encrypt('Decrypted with |decrypt(\'personal_data\')', 'personal_data');
         $encryptedForTwigFinancial = $encryptUtil->encrypt('Decrypted with |decrypt(\'financial_data\')', 'financial_data');