Add backwards-compatible encryption to provider configuration data

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 All notable changes to the package will be documented in this file.
 
+## v1.3.6 - 2023-02-09
+
+- Add backwards-compatible encryption to provider configuration data
+
 ## v1.3.5 - 2023-02-06
 
 - Fix a crash in form-group view component when a non-array value is passed

app/Models/ProviderConfiguration.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Models\Traits\Encryption;
 use Illuminate\Database\Eloquent\Builder;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Support\Facades\App;
@@ -35,9 +36,7 @@
  */
 class ProviderConfiguration extends Model
 {
-    protected $casts = [
-        'data' => 'json',
-    ];
+    use Encryption;
 
     /**
      * @param Builder $query
@@ -82,4 +81,14 @@ public function getProvider(): ?ProviderRegister
 
         return $category->getProvider($this->provider_code);
     }
+
+    public function getDataAttribute($value): ?array
+    {
+        return $this->decrypt($this->fromJson($value));
+    }
+
+    public function setDataAttribute($data): void
+    {
+        $this->attributes['data'] = $this->castAttributeAsJson('data', $this->encrypt($data));
+    }
 }

app/Models/Traits/Encryption.php

@@ -0,0 +1,66 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\Traits;
+
+use Illuminate\Contracts\Encryption\DecryptException;
+
+/**
+ * Recursively encrypts and decrypts data.
+ */
+trait Encryption
+{
+    /**
+     * Recursively encrypts the given data.
+     *
+     * @param mixed $data
+     *
+     * @return mixed
+     */
+    public function encrypt($data)
+    {
+        if (is_iterable($data)) {
+            foreach ($data as $key => $value) {
+                $data[$key] = $this->encrypt($value);
+            }
+
+            return $data;
+        }
+
+        if (!is_string($data) || is_numeric($data) || empty($data)) {
+            return $data;
+        }
+
+        return encrypt($data);
+    }
+
+    /**
+     * Recursively decrypts the given data.
+     *
+     * @param mixed $data
+     *
+     * @return mixed
+     */
+    public function decrypt($data)
+    {
+        if (is_iterable($data)) {
+            foreach ($data as $key => $value) {
+                $data[$key] = $this->decrypt($value);
+            }
+
+            return $data;
+        }
+
+        if (!is_string($data) || is_numeric($data) || empty($data)) {
+            return $data;
+        }
+
+        try {
+            return decrypt($data);
+        } catch (DecryptException $e) {
+            // If the payload cannot be decrypted, assume it was already plaintext.
+            return $data;
+        }
+    }
+}

database/migrations/2023_02_09_102747_encrypt_provider_configuration_data.php

@@ -0,0 +1,93 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class EncryptProviderConfigurationData extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        foreach (DB::table('provider_configurations')->get() as $providerConfiguration) {
+            DB::table('provider_configurations')
+                ->where('id', $providerConfiguration->id)
+                ->update([
+                    'data' => json_encode($this->encrypt(json_decode($providerConfiguration->data, true))),
+                ]);
+        }
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        foreach (DB::table('provider_configurations')->get() as $providerConfiguration) {
+            DB::table('provider_configurations')
+                ->where('id', $providerConfiguration->id)
+                ->update([
+                    'data' => json_encode($this->decrypt(json_decode($providerConfiguration->data, true))),
+                ]);
+        }
+    }
+
+    /**
+     * Recursively encrypts the given data.
+     *
+     * @param mixed $data
+     *
+     * @return mixed
+     */
+    public function encrypt($data)
+    {
+        if (is_iterable($data)) {
+            foreach ($data as $key => $value) {
+                $data[$key] = $this->encrypt($value);
+            }
+
+            return $data;
+        }
+
+        if (!is_string($data) || is_numeric($data) || empty($data)) {
+            return $data;
+        }
+
+        return encrypt($data);
+    }
+
+    /**
+     * Recursively decrypts the given data.
+     *
+     * @param mixed $data
+     *
+     * @return mixed
+     */
+    public function decrypt($data)
+    {
+        if (is_iterable($data)) {
+            foreach ($data as $key => $value) {
+                $data[$key] = $this->decrypt($value);
+            }
+
+            return $data;
+        }
+
+        if (!is_string($data) || is_numeric($data) || empty($data)) {
+            return $data;
+        }
+
+        try {
+            return decrypt($data);
+        } catch (DecryptException $e) {
+            // If the payload cannot be decrypted, assume it was already plaintext.
+            return $data;
+        }
+    }
+}