Skip to content

Commit fd27ff0

Browse files
alcaeusGromNaN
alcaeus
authored and
GromNaN
committed
[Encryption] Improve diagnostic command
1 parent e568073 commit fd27ff0

File tree

14 files changed

+493
-191
lines changed

14 files changed

+493
-191
lines changed

‎.github/workflows/composer-lint.yml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ on:
1010
push:
1111
branches:
1212
- "*.x"
13+
- "feature/*"
1314
paths:
1415
- "composer.json"
1516

‎config/command.php

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
use Doctrine\Bundle\MongoDBBundle\Command\ConnectionDiagnosticCommand;
77
use Doctrine\Bundle\MongoDBBundle\Command\CreateSchemaDoctrineODMCommand;
88
use Doctrine\Bundle\MongoDBBundle\Command\DropSchemaDoctrineODMCommand;
9+
use Doctrine\Bundle\MongoDBBundle\Command\DumpEncryptedFieldsMapCommand;
910
use Doctrine\Bundle\MongoDBBundle\Command\GenerateHydratorsDoctrineODMCommand;
1011
use Doctrine\Bundle\MongoDBBundle\Command\GenerateProxiesDoctrineODMCommand;
1112
use Doctrine\Bundle\MongoDBBundle\Command\InfoDoctrineODMCommand;
@@ -27,6 +28,10 @@
2728
->tag('console.command', ['command' => 'doctrine:mongodb:connection:diagnostic'])
2829
->args([tagged_locator('doctrine_mongodb.connection_diagnostic', 'name')])
2930

31+
->set('doctrine_mongodb.odm.command.dump_encrypted_fields_map', DumpEncryptedFieldsMapCommand::class)
32+
->tag('console.command', ['command' => 'doctrine:mongodb:dump-encrypted-fields-map'])
33+
->args([tagged_locator('doctrine_mongodb.odm.document_manager', 'name')])
34+
3035
->set('doctrine_mongodb.odm.command.create_schema', CreateSchemaDoctrineODMCommand::class)
3136
->tag('console.command', ['command' => 'doctrine:mongodb:schema:create'])
3237

‎docs/encryption.rst

Lines changed: 63 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -76,10 +76,23 @@ Example of configuration for AWS
7676
key: "arn:aws:kms:eu-west-1:123456789012:key/abcd1234-12ab-34cd-56ef-1234567890ab"
7777
7878
79-
Queryable Encryption (QE)
80-
-------------------------
79+
Encrypted Fields Map
80+
--------------------
8181

82-
Queryable Encryption (QE) allows you to run queries on encrypted fields. To use QE, you may need to provide an ``encryptedFieldsMap`` or use a schema map, depending on your driver and use case.
82+
You can configure which fields are encrypted in each collection by specifying the
83+
``autoEncryption.encryptedFieldsMap`` option in the connection configuration.
84+
This setting is **recommended** for improved security and performance.
85+
86+
- If the connection ``encryptedFieldsMap`` object contains a key for the specified
87+
collection, the client uses that object to perform automatic Queryable Encryption,
88+
rather than using the remote schema. At minimum, the local rules must encrypt
89+
all fields that the remote schema does.
90+
91+
- If the connection ``encryptedFieldsMap`` object doesn't contain a key for the
92+
specified collection, the client downloads the server-side remote schema for
93+
the collection and uses it instead.
94+
95+
For more details, see the official MongoDB documentation: `Encrypted Fields and Enabled Queries <https://www.mongodb.com/docs/manual/core/queryable-encryption/fundamentals/encrypt-and-query/>`_.
8396

8497
.. tabs::
8598

@@ -133,6 +146,51 @@ Queryable Encryption (QE) allows you to run queries on encrypted fields. To use
133146
]);
134147
};
135148
149+
Automatic Encryption Shared Library
150+
-----------------------------------
151+
152+
To use automatic encryption, the MongoDB PHP driver requires the `Automatic Encryption Shared Library`_.
153+
154+
If the driver is not able to find the library, you can specify its path using the ``cryptSharedLibPath`` extra option in your connection configuration.
155+
156+
.. tabs::
157+
158+
.. group-tab:: YAML
159+
160+
.. code-block:: yaml
161+
162+
doctrine_mongodb:
163+
connections:
164+
default:
165+
autoEncryption:
166+
extraOptions:
167+
cryptSharedLibPath: '%kernel.project_dir%/bin/mongo_crypt_v1.so'
168+
169+
.. group-tab:: XML
170+
171+
.. code-block:: xml
172+
173+
<doctrine:connection>
174+
<doctrine:autoEncryption>
175+
<doctrine:extraOptions cryptSharedLibPath="%kernel.project_dir%/bin/mongo_crypt_v1.so" />
176+
</doctrine:autoEncryption>
177+
</doctrine:connection>
178+
179+
.. group-tab:: PHP
180+
181+
.. code-block:: php
182+
183+
use Symfony\Config\DoctrineMongodbConfig;
184+
185+
return static function (DoctrineMongodbConfig $config): void {
186+
$config->connection('default')
187+
->autoEncryption([
188+
'extraOptions' => [
189+
'cryptSharedLibPath' => '%kernel.project_dir%/bin/mongo_crypt_v1.so',
190+
],
191+
]);
192+
};
193+
136194
TLS Options
137195
-----------
138196

@@ -221,3 +279,5 @@ Further Reading
221279
- `MongoDB CSFLE documentation <https://www.mongodb.com/docs/manual/core/csfle/>`_
222280
- `MongoDB PHP driver Manager::__construct <https://www.php.net/manual/en/mongodb-driver-manager.construct.php>`_
223281
- :doc:`config`
282+
283+
.. _`Automatic Encryption Shared Library`: https://www.mongodb.com/docs/manual/core/queryable-encryption/install-library/

‎phpstan-baseline.neon

Lines changed: 0 additions & 48 deletions
Original file line numberDiff line numberDiff line change
@@ -36,12 +36,6 @@ parameters:
3636
count: 1
3737
path: src/CacheWarmer/ProxyCacheWarmer.php
3838

39-
-
40-
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\CacheWarmer\\ProxyCacheWarmer\:\:getClassesForProxyGeneration\(\) return type with generic class Doctrine\\ODM\\MongoDB\\Mapping\\ClassMetadata does not specify its types\: T$#'
41-
identifier: missingType.generics
42-
count: 1
43-
path: src/CacheWarmer/ProxyCacheWarmer.php
44-
4539
-
4640
message: '#^Parameter \#1 \$application of static method Doctrine\\Bundle\\MongoDBBundle\\Command\\DoctrineODMCommand\:\:setApplicationDocumentManager\(\) expects Symfony\\Bundle\\FrameworkBundle\\Console\\Application, Symfony\\Component\\Console\\Application\|null given\.$#'
4741
identifier: argument.type
@@ -120,42 +114,12 @@ parameters:
120114
count: 1
121115
path: src/Command/UpdateSchemaDoctrineODMCommand.php
122116

123-
-
124-
message: '#^Expression on left side of \?\? is not nullable\.$#'
125-
identifier: nullCoalesce.expr
126-
count: 1
127-
path: src/DataCollector/ConnectionDiagnostic.php
128-
129117
-
130118
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\DataCollector\\ConnectionDiagnostic\:\:__construct\(\) has parameter \$driverOptions with no value type specified in iterable type array\.$#'
131119
identifier: missingType.iterableValue
132120
count: 1
133121
path: src/DataCollector/ConnectionDiagnostic.php
134122

135-
-
136-
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\DataCollector\\ConnectionDiagnostic\:\:getAutoEncryptionInfo\(\) return type has no value type specified in iterable type array\.$#'
137-
identifier: missingType.iterableValue
138-
count: 1
139-
path: src/DataCollector/ConnectionDiagnostic.php
140-
141-
-
142-
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\DataCollector\\ConnectionDiagnostic\:\:getPhpExtensionInfo\(\) return type has no value type specified in iterable type array\.$#'
143-
identifier: missingType.iterableValue
144-
count: 1
145-
path: src/DataCollector/ConnectionDiagnostic.php
146-
147-
-
148-
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\DataCollector\\ConnectionDiagnostic\:\:getServerInfo\(\) return type has no value type specified in iterable type array\.$#'
149-
identifier: missingType.iterableValue
150-
count: 1
151-
path: src/DataCollector/ConnectionDiagnostic.php
152-
153-
-
154-
message: '#^Unreachable statement \- code above always terminates\.$#'
155-
identifier: deadCode.unreachable
156-
count: 1
157-
path: src/DataCollector/ConnectionDiagnostic.php
158-
159123
-
160124
message: '#^Cannot cast array\|bool\|float\|int\|string\|UnitEnum\|null to string\.$#'
161125
identifier: cast.string
@@ -372,12 +336,6 @@ parameters:
372336
count: 1
373337
path: src/Form/ChoiceList/MongoDBQueryBuilderLoader.php
374338

375-
-
376-
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\Form\\DoctrineMongoDBTypeGuesser\:\:getMetadata\(\) return type with generic class Doctrine\\ODM\\MongoDB\\Mapping\\ClassMetadata does not specify its types\: T$#'
377-
identifier: missingType.generics
378-
count: 1
379-
path: src/Form/DoctrineMongoDBTypeGuesser.php
380-
381339
-
382340
message: '#^Method Doctrine\\Bundle\\MongoDBBundle\\Form\\DoctrineMongoDBTypeGuesser\:\:getMetadata\(\) should return array\{Doctrine\\ODM\\MongoDB\\Mapping\\ClassMetadata, string\}\|null but returns array\{Doctrine\\Persistence\\Mapping\\ClassMetadata\<object\>, string\}\.$#'
383341
identifier: return.type
@@ -420,12 +378,6 @@ parameters:
420378
count: 1
421379
path: src/Form/DoctrineMongoDBTypeGuesser.php
422380

423-
-
424-
message: '#^Property Doctrine\\Bundle\\MongoDBBundle\\Form\\DoctrineMongoDBTypeGuesser\:\:\$cache with generic class Doctrine\\ODM\\MongoDB\\Mapping\\ClassMetadata does not specify its types\: T$#'
425-
identifier: missingType.generics
426-
count: 1
427-
path: src/Form/DoctrineMongoDBTypeGuesser.php
428-
429381
-
430382
message: '#^Unable to resolve the template type T in call to method Doctrine\\Persistence\\ObjectManager\:\:getClassMetadata\(\)$#'
431383
identifier: argument.templateType

‎phpstan.neon.dist

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,7 @@ parameters:
88
- config
99
- src
1010
- tests
11+
12+
ignoreErrors:
13+
- message: '# with generic class Doctrine\\ODM\\MongoDB\\Mapping\\ClassMetadata#'
14+
identifier: missingType.generics

0 commit comments

Comments
 (0)