Conversation
Demonstrates the new #[AsDatabaseType] attribute from DoctrineBundle that registers DBAL types as Symfony services with per-connection TypeRegistry, without touching the global static type registry.
#[AsDatabaseType]
…Type Uses a key from APP_EMAIL_ENCRYPTION_KEY env var (generated automatically on composer install via bin/generate-env-keys if missing). The nonce is derived deterministically from the key and plaintext so the same email always produces the same ciphertext, allowing DB lookups to work.
The test database must be encrypted with the key from .env.test (APP_EMAIL_ENCRYPTION_KEY=000...000) so that CI can decrypt emails and authenticate users in functional tests.
Note that fixtures must be reloaded when the encryption key changes, and how to regenerate the test database.
Using 'now + Ns' tied comment dates to the fixture-load instant and stored them in the local timezone, causing DESC-order failures on UTC CI runners (fixture comments appeared newer than the test comment, which was created in UTC). Anchor comment dates to the post's publishedAt instead, so they are always deterministic, well in the past, and ordered correctly regardless of the server timezone.
d3f009c to
f0f1c64
Compare
HMAC-SHA256 is the correct construction here: the key is the cryptographic secret and the message is the plaintext. A plain hash(key || message) is susceptible to length-extension attacks and does not use the key as intended.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Demonstrates the new
#[AsDatabaseType]attribute from DoctrineBundle that registers DBAL types as Symfony services with a per-connectionTypeRegistry.EncryptedEmailType: a custom DBAL type that storesUser::$emailencrypted in the database using deterministic AES-256-GCMAPP_EMAIL_ENCRYPTION_KEYenvironment variable, injected into the type via#[Autowire(env: 'APP_EMAIL_ENCRYPTION_KEY')].env.localoncomposer installviabin/generate-env-keys#[AsDatabaseType(name: EncryptedEmailType::NAME)]— nodoctrine.dbal.typesconfig neededWarning
This is for demonstration purposes only. Production-grade field-level encryption requires more advanced techniques for key management (key rotation, envelope encryption, HSM/KMS integration, etc.). This example intentionally keeps it simple to focus on the
#[AsDatabaseType]feature.Important
Key rotation requires reloading fixtures. The encryption key is generated once on
composer install. If you regenerate it (e.g. by deleting.env.local), you must reload fixtures to re-encrypt the database with the new key:The test database (
data/database_test.sqlite) uses the fixed zero key from.env.test. Regenerate it after changing fixtures or encryption logic:How it works
Dependencies
This demo depends on PRs in 3 repositories:
TypeRegistrytoConfigurationand use it in all internal type resolution doctrine/dbal#7342Type::*calls with instance-basedTypeRegistrylookups doctrine/orm#12421#[AsDatabaseType]attribute to register DBAL types as Symfony services doctrine/DoctrineBundle#2221