Skip to content

Commit cf132b5

Browse files
HecFrancoHecFranco
committed
Enhance encryption bundle features and documentation
- Added `doctrine:encrypt:rotate-keys` command for full key rotation, including optional backup and confirmation prompts. - Updated `doctrine:encrypt:status` to list encrypted properties and their configurations. - Improved documentation across multiple files, including COMMANDS.md, INSTALLATION.md, and KEY_ROTATION.md, to reflect new features and usage instructions. - Enhanced Makefile in demo projects to include new commands for key rotation. - Updated .env.example files to clarify the usage of APP_ENCRYPT_KEY for configuration. - Adjusted configuration files to support batch size options for encryption commands.
1 parent fa7cf81 commit cf132b5

41 files changed

Lines changed: 1733 additions & 188 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.gitignore‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,26 @@
1+
# IDE / editor
12
.idea/
3+
4+
# Dependencies
25
/vendor
36

7+
# Environment and secrets
48
.env
9+
10+
# Cache (code style, PHPUnit)
511
.php-cs-fixer.cache
612
.phpunit.cache
713
.phpunit.result.cache
14+
15+
# Test coverage
816
coverage.xml
917
coverage/
18+
19+
# Runtime and build output
1020
var/
1121
public/bundles/
1222
public/css/
1323
public/js/
1424
public/images/
1525
public/favicon.ico
1626
public/robots.txt
17-

‎.symfony/recipe/nowo-tech/doctrine-encrypt-bundle/1.0/1.0/config/packages/nowo_doctrine_encrypt.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55

66
nowo_doctrine_encrypt:
77
default_config: default
8+
# batch_size: 5 # optional; default batch for doctrine:decrypt:database and doctrine:encrypt:database (raw SQL)
89
configs:
910
default:
1011
encryptor_class: Halite # or Defuse (requires: composer require defuse/php-encryption ^2.1)

‎README.md‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,11 @@ Looking for **Doctrine encryption**, **encrypt entity fields**, **Halite Symfony
3333
- ✅ **MaskUtil** — mask sensitive values in PHP (e.g. show only last N chars); usable in services
3434
- ✅ **Twig filters** — `|decrypt` (decrypt in templates; optional config: `{{ value|decrypt }}` or `{{ value|decrypt('financial_data') }}`) and `|mask` (mask for display: `{{ value|mask(4) }}` or `{{ value|decrypt|mask(4) }}`)
3535
- ✅ Works with **embedded entities** and **inheritance**
36-
- ✅ Console commands: status, generate secret key, encrypt/decrypt database
37-
- ✅ **Key rotation** — decrypt, replace keys, re-encrypt; combinable with [Nowo\AnonymizedBundle](https://github.com/nowo-tech/AnonymizedBundle) for GDPR-compliant anonymization and erasure
36+
- ✅ Console commands: status, generate secret key, encrypt/decrypt database, **rotate keys** (backup, decrypt, change keys, re-encrypt with confirmations)
37+
- ✅ **Key rotation** — one command or manual steps; combinable with [Nowo\AnonymizedBundle](https://github.com/nowo-tech/AnonymizedBundle) for GDPR-compliant anonymization and erasure
3838
- ✅ **Symfony Flex** recipe (register bundle + config; see [docs/INSTALLATION.md](docs/INSTALLATION.md))
3939
- ✅ Compatible with **Symfony 7 and 8** and **Doctrine ORM 2.x and 3.x**
40+
- ✅ Compatible with **FrankenPHP** (runtime and worker mode; see [Installation → FrankenPHP](docs/INSTALLATION.md#frankenphp-runtime-and-worker-mode))
4041

4142
## Installation
4243

@@ -141,11 +142,11 @@ Values are encrypted on persist/update and decrypted on load. For **programmatic
141142

142143
| Document | Description |
143144
|----------|-------------|
144-
| [**Installation**](docs/INSTALLATION.md) | Requirements, Flex and manual install, secret key, IDE (optional) |
145+
| [**Installation**](docs/INSTALLATION.md) | Requirements, Flex and manual install, secret key, **FrankenPHP (runtime & worker)**, IDE (optional) |
145146
| [**Configuration**](docs/CONFIGURATION.md) | All options and defaults |
146147
| [**Usage**](docs/USAGE.md) | Encrypted attribute, EncryptUtil, MaskUtil, Twig filters (decrypt, mask), embedded entities, inheritance |
147148
| [**Example**](docs/EXAMPLE.md) | Full example: entity, fixtures, controller, template |
148-
| [**Commands**](docs/COMMANDS.md) | Status, generate key, encrypt/decrypt database |
149+
| [**Commands**](docs/COMMANDS.md) | Status (per-entity properties and configs), generate key, encrypt/decrypt database, rotate keys |
149150
| [**Key rotation**](docs/KEY_ROTATION.md) | Strategy to change keys: backup, decrypt, replace keys, re-encrypt. Supports GDPR compliance; combinable with Nowo\AnonymizedBundle. |
150151
| [**Demo**](docs/DEMO.md) | Demo projects (Symfony 7/8) and how to run them |
151152
| [**Changelog**](docs/CHANGELOG.md) | Version history |

‎demo/symfony7/.env.example‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
APP_ENV=dev
22
APP_SECRET=change-me-in-production
33

4-
# Doctrine Encrypt Bundle (personal_data config; generated on first make up / entrypoint)
5-
APP_ENCRYPT_KEY=
6-
74
###> doctrine/doctrine-bundle ###
85
DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
96
###< doctrine/doctrine-bundle ###
@@ -19,3 +16,6 @@ APP_SHARE_DIR=var/share
1916
# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
2017
DEFAULT_URI=http://localhost
2118
###< symfony/routing ###
19+
20+
# Doctrine Encrypt Bundle (personal_data config; generated on first make up / entrypoint)
21+
APP_ENCRYPT_KEY=

‎demo/symfony7/Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ SERVICE_PHP := php
77

88
.PHONY: help up down build install shell logs setup db-create db-schema key fixtures cache-clear update-bundle test encrypt-status encrypt-database decrypt-database ensure-up
99
.PHONY: encrypt-database-all decrypt-database-all encrypt-database-personal_data decrypt-database-personal_data encrypt-database-financial_data decrypt-database-financial_data encrypt-database-env_var decrypt-database-env_var
10+
.PHONY: rotate-keys rotate-keys-backup
1011

1112
help:
1213
@echo "Doctrine Encrypt Bundle Demo - Symfony 7"
@@ -33,6 +34,8 @@ help:
3334
@echo " make decrypt-database-personal_data Decrypt: config personal_data"
3435
@echo " make decrypt-database-financial_data Decrypt: config financial_data"
3536
@echo " make decrypt-database-env_var Decrypt: config env_var"
37+
@echo " make rotate-keys Rotate keys: decrypt → change keys → re-encrypt (interactive)"
38+
@echo " make rotate-keys-backup Same with --backup (DB + keys to var/encrypt_rotation_backup_*)"
3639
@echo " make cache-clear Clear Symfony cache"
3740
@echo " make update-bundle Update bundle from path repo"
3841
@echo " make test Run tests"
@@ -116,6 +119,14 @@ decrypt-database-financial_data: ensure-up
116119
decrypt-database-env_var: ensure-up
117120
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:decrypt:database env_var
118121

122+
# Rotate keys: decrypt → change keys (generate new key files) → re-encrypt. Interactive (confirm each step).
123+
rotate-keys: ensure-up
124+
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:rotate-keys
125+
126+
# Same with backup of DB (SQLite → var/encrypt_rotation_backup_*/database.sqlite.gz) and key files.
127+
rotate-keys-backup: ensure-up
128+
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:rotate-keys --backup
129+
119130
cache-clear: ensure-up
120131
$(COMPOSE) exec -T $(SERVICE_PHP) php bin/console cache:clear
121132

‎demo/symfony7/config/packages/nowo_doctrine_encrypt.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
# Halite and Defuse (requires: composer require defuse/php-encryption ^2.1)
66
nowo_doctrine_encrypt:
77
default_config: personal_data
8+
# batch_size: 5 # optional; default batch for decrypt/encrypt database commands (raw SQL)
89
configs:
910
# 1) No secret_key_filename: default path .Halite.personal_data.key
1011
personal_data:

‎demo/symfony7/docker/frankenphp/Caddyfile‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,9 @@
22
skip_install_trust
33
}
44

5+
# Worker mode: app boots once, handles requests in memory. DoctrineEncryptBundle is compatible
6+
# (no extra config). For production, consider limiting requests per worker when possible; see
7+
# docs/INSTALLATION.md § FrankenPHP.
58
:80 {
69
root * /app/public
710
encode zstd br gzip

‎demo/symfony8/.env.example‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,6 @@
11
APP_ENV=dev
22
APP_SECRET=change-me-in-production
33

4-
# Doctrine Encrypt Bundle (personal_data config uses this; generated on first make up / entrypoint)
5-
APP_ENCRYPT_KEY=
6-
74
###> doctrine/doctrine-bundle ###
85
DATABASE_URL="sqlite:///%kernel.project_dir%/var/data.db"
96
###< doctrine/doctrine-bundle ###
@@ -19,3 +16,6 @@ APP_SHARE_DIR=var/share
1916
# See https://symfony.com/doc/current/routing.html#generating-urls-in-commands
2017
DEFAULT_URI=http://localhost
2118
###< symfony/routing ###
19+
20+
# Doctrine Encrypt Bundle (personal_data config uses this; generated on first make up / entrypoint)
21+
APP_ENCRYPT_KEY=

‎demo/symfony8/Makefile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ SERVICE_PHP := php
77

88
.PHONY: help up down build install shell logs setup db-create db-schema key fixtures cache-clear update-bundle test encrypt-status encrypt-database decrypt-database ensure-up
99
.PHONY: encrypt-database-all decrypt-database-all encrypt-database-personal_data decrypt-database-personal_data encrypt-database-financial_data decrypt-database-financial_data encrypt-database-env_var decrypt-database-env_var
10+
.PHONY: rotate-keys rotate-keys-backup
1011

1112
help:
1213
@echo "Doctrine Encrypt Bundle Demo - Symfony 8"
@@ -33,6 +34,8 @@ help:
3334
@echo " make decrypt-database-personal_data Decrypt: config personal_data"
3435
@echo " make decrypt-database-financial_data Decrypt: config financial_data"
3536
@echo " make decrypt-database-env_var Decrypt: config env_var"
37+
@echo " make rotate-keys Rotate keys: decrypt → change keys → re-encrypt (interactive)"
38+
@echo " make rotate-keys-backup Same with --backup (DB + keys to var/encrypt_rotation_backup_*)"
3639
@echo " make cache-clear Clear Symfony cache"
3740
@echo " make update-bundle Update bundle from path repo"
3841
@echo " make test Run tests"
@@ -116,6 +119,14 @@ decrypt-database-financial_data: ensure-up
116119
decrypt-database-env_var: ensure-up
117120
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:decrypt:database env_var
118121

122+
# Rotate keys: decrypt → change keys (generate new key files) → re-encrypt. Interactive (confirm each step).
123+
rotate-keys: ensure-up
124+
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:rotate-keys
125+
126+
# Same with backup of DB (SQLite → var/encrypt_rotation_backup_*/database.sqlite.gz) and key files.
127+
rotate-keys-backup: ensure-up
128+
$(COMPOSE) exec $(SERVICE_PHP) php bin/console doctrine:encrypt:rotate-keys --backup
129+
119130
cache-clear: ensure-up
120131
$(COMPOSE) exec -T $(SERVICE_PHP) php bin/console cache:clear
121132

‎demo/symfony8/composer.lock‎

Lines changed: 10 additions & 4 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)