Enhance encryption commands and documentation

- Updated COMMANDS.md to include the new `doctrine:encrypt:rotate-keys` command for key rotation, detailing its options and usage.
- Improved the `doctrine:encrypt:status` command to list encrypted properties along with their effective config names.
- Added a new method in AbstractCommand to retrieve encrypted properties with their config.
- Updated service configuration to inject key paths into relevant commands.
- Adjusted unit tests to reflect changes in output formatting for entity encryption status.

Author: HecFranco

docs/COMMANDS.md

@@ -25,7 +25,7 @@ Get the current database and encryption information:
 php bin/console doctrine:encrypt:status
 ```
 
-This returns the number of entities and the number of properties marked with the `Encrypted` attribute per entity.
+The command lists, for each entity, which properties are encrypted and under which **config** (e.g. `personal_data`, `financial_data`). It then shows a summary (how many entities have encrypted properties and the total encrypted property count) and, at the end, the **configured encryptor configs** in the project (config name, encryptor class such as Halite/Defuse, and which config is the default).
 
 ## Encrypt database
 

src/Command/AbstractCommand.php

@@ -22,7 +22,7 @@ abstract class AbstractCommand extends Command
      * @param AttributeReader            $attributeReader  Reader for Encrypted attributes
      * @param DoctrineEncryptSubscriber  $subscriber       Encrypt/decrypt event subscriber
      * @param EncryptorInterface|null    $defaultEncryptor Used by encrypt/decrypt database commands when using multi-config
-     * @param EncryptorRegistry|null     $encryptorRegistry Used by encrypt/decrypt database commands to resolve config names and encryptors
+     * @param EncryptorRegistry|null    $encryptorRegistry Used by encrypt/decrypt database commands and status command to resolve config names
      */
     public function __construct(
         public EntityManagerInterface $entityManager,
@@ -110,6 +110,27 @@ protected function getEncryptionableProperties($entityMetaData): array
         return $properties;
     }
 
+    /**
+     * Returns encrypted properties with their effective config name (resolves "default" to $defaultConfigName).
+     *
+     * @param object $entityMetaData     Doctrine entity metadata (ClassMetadata)
+     * @param string $defaultConfigName  Default config name (e.g. from EncryptorRegistry::getDefaultName())
+     * @return array<int, array{property: \ReflectionProperty, config: string}>
+     */
+    protected function getEncryptionablePropertiesWithConfig($entityMetaData, string $defaultConfigName): array
+    {
+        $reflectionClass = new \ReflectionClass($entityMetaData->name);
+        $result = [];
+        foreach ($reflectionClass->getProperties() as $property) {
+            $annotation = $this->attributeReader->getPropertyAnnotation($property, Encrypted::class);
+            if ($annotation instanceof Encrypted) {
+                $config = $annotation->config === 'default' ? $defaultConfigName : $annotation->config;
+                $result[] = ['property' => $property, 'config' => $config];
+            }
+        }
+        return $result;
+    }
+
     /**
      * Returns properties marked with Encrypted that belong to the given config.
      * When a property has config "default", it is included if $defaultConfigName === $configName.

src/Command/DoctrineEncryptStatusCommand.php

@@ -2,13 +2,13 @@
 
 namespace Nowo\DoctrineEncryptBundle\Command;
 
+use Nowo\DoctrineEncryptBundle\Encryptors\EncryptorRegistry;
 use Symfony\Component\Console\Attribute\AsCommand;
 use Symfony\Component\Console\Input\InputInterface;
-// attributes
 use Symfony\Component\Console\Output\OutputInterface;
 
 /**
- * Console command that lists entities and the count of encrypted properties per entity.
+ * Console command that lists entities, their encrypted properties with config, and the configured encryptor configs.
  */
 #[AsCommand(
     name: 'doctrine:encrypt:status',
@@ -19,38 +19,100 @@
 class DoctrineEncryptStatusCommand extends AbstractCommand
 {
     /**
-     * Outputs each entity and its encrypted property count, then a total summary.
+     * Config name => [path, encryptor_class]; used to show encryptor class in configured configs.
+     *
+     * @var array<string, array{path: string|null, encryptor_class: string}>
+     */
+    private array $keyPaths;
+
+    /**
+     * @param array<string, array{path: string|null, encryptor_class: string}> $keyPaths
+     */
+    public function __construct(
+        \Doctrine\ORM\EntityManagerInterface $entityManager,
+        \Nowo\DoctrineEncryptBundle\Mapping\AttributeReader $attributeReader,
+        \Nowo\DoctrineEncryptBundle\Subscribers\DoctrineEncryptSubscriber $subscriber,
+        ?\Nowo\DoctrineEncryptBundle\Encryptors\EncryptorInterface $defaultEncryptor = null,
+        ?EncryptorRegistry $encryptorRegistry = null,
+        array $keyPaths = []
+    ) {
+        parent::__construct($entityManager, $attributeReader, $subscriber, $defaultEncryptor, $encryptorRegistry);
+        $this->keyPaths = $keyPaths;
+    }
+
+    /**
+     * Outputs each entity with its encrypted properties and config, then a summary and the configured configs.
      *
      * @param InputInterface  $input  Console input
      * @param OutputInterface $output Console output
      * @return int Command::SUCCESS
      */
     protected function execute(InputInterface $input, OutputInterface $output): int
     {
-        $metaDataArray = $this->entityManager->getMetadataFactory()->getAllMetadata();
+        $defaultConfigName = $this->encryptorRegistry?->getDefaultName() ?? 'default';
 
+        $metaDataArray = $this->entityManager->getMetadataFactory()->getAllMetadata();
+        $entitiesWithEncryption = 0;
         $totalCount = 0;
+
         foreach ($metaDataArray as $metaData) {
             if (isset($metaData->isMappedSuperclass) && $metaData->isMappedSuperclass) {
                 continue;
             }
 
-            $count = 0;
-            $encryptedPropertiesCount = count($this->getEncryptionableProperties($metaData));
-            if ($encryptedPropertiesCount > 0) {
-                $totalCount += $encryptedPropertiesCount;
-                $count += $encryptedPropertiesCount;
-            }
+            $propertiesWithConfig = $this->getEncryptionablePropertiesWithConfig($metaData, $defaultConfigName);
+            $count = count($propertiesWithConfig);
 
             if ($count > 0) {
-                $output->writeln(sprintf('<info>%s</info> has <info>%d</info> properties which are encrypted.', $metaData->name, $count));
+                $entitiesWithEncryption++;
+                $totalCount += $count;
+                $output->writeln(sprintf('<info>%s</info> has <info>%d</info> encrypted property(ies):', $metaData->name, $count));
+                foreach ($propertiesWithConfig as ['property' => $property, 'config' => $config]) {
+                    $output->writeln(sprintf('  - <comment>%s</comment> (config: <comment>%s</comment>)', $property->getName(), $config));
+                }
             } else {
                 $output->writeln(sprintf('<info>%s</info> has no properties which are encrypted.', $metaData->name));
             }
         }
 
         $output->writeln('');
-        $output->writeln(sprintf('<info>%d</info> entities found which are containing <info>%d</info> encrypted properties.', count($metaDataArray), $totalCount));
+        $output->writeln(sprintf(
+            '<info>%d</info> entit(y/ies) with encryption, <info>%d</info> encrypted properties in total (out of <info>%d</info> entities).',
+            $entitiesWithEncryption,
+            $totalCount,
+            count($metaDataArray)
+        ));
+
+        $this->outputConfiguredConfigs($output, $defaultConfigName);
+
         return AbstractCommand::SUCCESS;
     }
+
+    private function outputConfiguredConfigs(OutputInterface $output, string $defaultConfigName): void
+    {
+        $output->writeln('');
+        $output->writeln('<info>Configured encryptor configs:</info>');
+
+        if ($this->encryptorRegistry === null) {
+            $output->writeln('  (registry not available)');
+            return;
+        }
+
+        $configNames = $this->encryptorRegistry->getConfigNames();
+        // Exclude the 'default' alias when there are other configs (so we don't list "default" and "personal_data" when default is personal_data)
+        $namesToShow = array_values(array_filter($configNames, static fn (string $name): bool => $name !== 'default' || count($configNames) === 1));
+
+        if (count($namesToShow) === 0) {
+            $output->writeln('  (none)');
+            return;
+        }
+
+        $keyPaths = $this->keyPaths;
+        foreach ($namesToShow as $name) {
+            $encryptorClass = $keyPaths[$name]['encryptor_class'] ?? null;
+            $label = $encryptorClass ? sprintf('%s (%s)', $name, $encryptorClass) : $name;
+            $defaultLabel = $name === $defaultConfigName ? ' [default]' : '';
+            $output->writeln(sprintf('  - %s%s', $label, $defaultLabel));
+        }
+    }
 }

src/Resources/config/services.yml

@@ -22,6 +22,11 @@ services:
       $kernel: '@kernel'
       $keyPaths: '%nowo_doctrine_encrypt.key_paths%'
 
+  Nowo\DoctrineEncryptBundle\Command\DoctrineEncryptStatusCommand:
+    arguments:
+      $encryptorRegistry: '@nowo_doctrine_encrypt.encryptor_registry'
+      $keyPaths: '%nowo_doctrine_encrypt.key_paths%'
+
   nowo_doctrine_encrypt.encryptor_registry:
     class: Nowo\DoctrineEncryptBundle\Encryptors\EncryptorRegistry
     arguments: [[], 'default']

tests/Unit/Command/DoctrineEncryptStatusCommandTest.php

@@ -86,7 +86,7 @@ public function testExecuteOutputsSummaryWithEntityAndPropertyCounts(): void
 
         $this->assertSame(0, $tester->getStatusCode());
         $display = $tester->getDisplay();
-        $this->assertMatchesRegularExpression('/\d+ entities found which are containing \d+ encrypted properties\./', $display);
+        $this->assertMatchesRegularExpression('/\d+ entit\(y\/ies\) with encryption, \d+ encrypted properties in total/', $display);
     }
 
     public function testExecuteSkipsMappedSuperclassAndOutputsOthers(): void
@@ -137,8 +137,8 @@ public function testExecuteWithNoEntitiesOutputsZeroSummary(): void
 
         $this->assertSame(0, $tester->getStatusCode());
         $display = $tester->getDisplay();
-        $this->assertStringContainsString('0 entities found', $display);
-        $this->assertStringContainsString('0 encrypted properties', $display);
+        $this->assertStringContainsString('0 entit(y/ies) with encryption', $display);
+        $this->assertStringContainsString('0 encrypted properties in total', $display);
     }
 
     public function testExecuteOutputsMultipleEntitiesWithEncryptedProperties(): void
@@ -169,6 +169,6 @@ public function testExecuteOutputsMultipleEntitiesWithEncryptedProperties(): voi
         $display = $tester->getDisplay();
         $this->assertStringContainsString(User::class, $display);
         $this->assertStringContainsString(EntityWithConfigAlias::class, $display);
-        $this->assertMatchesRegularExpression('/\d+ entities found which are containing \d+ encrypted properties\./', $display);
+        $this->assertMatchesRegularExpression('/\d+ entit\(y\/ies\) with encryption, \d+ encrypted properties in total/', $display);
     }
 }