28867963370

Committed 07 Jul 2026 12:58PM UTC coverage: 89.588% (-0.004%) from 89.592%

Build # 28867963370

Build Type

push

github

Committed by

web-flow

Commit Message

feat: add `encrypted` casts for model fields and entities (#10357)

* feat(model): add encrypted casting

- Add encrypted DataCaster support for Model fields and Entity properties.
- Store encrypted values as Base64-encoded ciphertext using the Encryption service.
- Document storage, validation, query, serialization, and key rotation caveats.
- Add focused tests for encryption, decryption, nullable values, previous keys, and invalid payloads.

Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com>

* fix: cs

Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com>

* refactor: use service helper for encrypted cast

Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com>

---------

Signed-off-by: memleakd <121398829+memleakd@users.noreply.github.com>

Coverage Stats

29 of 32 new or added lines in 3 files covered. (90.63%)

25279 of 28217 relevant lines covered (89.59%)

230.29 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

76.92

/system/DataCaster/Cast/EncryptedCast.php

<?php

declare(strict_types=1);

/**
 * This file is part of CodeIgniter 4 framework.
 *
 * (c) CodeIgniter Foundation <admin@codeigniter.com>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace CodeIgniter\DataCaster\Cast;

use CodeIgniter\DataCaster\Exceptions\CastException;
use SensitiveParameter;

/**
 * Class EncryptedCast
 *
 * (PHP) [string --> encrypted string] --> (DB driver) --> (DB column) string
 *       [       <-- string          ] <-- (DB driver) <-- (DB column) encrypted string
 */
class EncryptedCast extends BaseCast
{
    public static function get(
        #[SensitiveParameter]
        mixed $value,
        array $params = [],
        ?object $helper = null,
    ): ?string {
        if ($value === null) {
            return null;
        }

        if (! is_string($value)) {
            throw CastException::forInvalidEncryptedValueType();
        }

        $decoded = base64_decode($value, true);

        if ($decoded === false) {
            throw CastException::forInvalidEncryptedPayload();
        }

        return service('encrypter')->decrypt($decoded);
    }

    public static function set(
        #[SensitiveParameter]
        mixed $value,
        array $params = [],
        ?object $helper = null,
    ): ?string {
        if ($value === null) {
            return null;
        }

        if (! is_string($value)) {
            throw CastException::forInvalidEncryptedValueType();
        }

        return base64_encode(service('encrypter')->encrypt($value));
    }
}

1	<?php
2
3	declare(strict_types=1);
4
5	/**
6	* This file is part of CodeIgniter 4 framework.
7	*
8	* (c) CodeIgniter Foundation <admin@codeigniter.com>
9	*
10	* For the full copyright and license information, please view
11	* the LICENSE file that was distributed with this source code.
12	*/
13
14	namespace CodeIgniter\DataCaster\Cast;
15
16	use CodeIgniter\DataCaster\Exceptions\CastException;
17	use SensitiveParameter;
18
19	/**
20	* Class EncryptedCast
21	*
22	* (PHP) [string --> encrypted string] --> (DB driver) --> (DB column) string
23	* [ <-- string ] <-- (DB driver) <-- (DB column) encrypted string
24	*/
25	class EncryptedCast extends BaseCast
26	{
27	public static function get(
28	#[SensitiveParameter]
29	mixed $value,
30	array $params = [],
31	?object $helper = null,
32	): ?string {
33	if ($value === null) {	6✔
NEW 34	return null;	×
35	}
36
37	if (! is_string($value)) {	6✔
NEW 38	throw CastException::forInvalidEncryptedValueType();	×
39	}
40
41	$decoded = base64_decode($value, true);	6✔
42
43	if ($decoded === false) {	6✔
44	throw CastException::forInvalidEncryptedPayload();	1✔
45	}
46
47	return service('encrypter')->decrypt($decoded);	5✔
48	}
49
50	public static function set(
51	#[SensitiveParameter]
52	mixed $value,
53	array $params = [],
54	?object $helper = null,
55	): ?string {
56	if ($value === null) {	4✔
NEW 57	return null;	×
58	}
59
60	if (! is_string($value)) {	4✔
61	throw CastException::forInvalidEncryptedValueType();	1✔
62	}
63
64	return base64_encode(service('encrypter')->encrypt($value));	3✔
65	}
66	}

codeigniter4 / CodeIgniter4 / 28867963370

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous