PR-2: TenantKey Model & KEK Management #53
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Implement TenantKey Eloquent model for per-tenant key management - KEK (Key Encryption Key) generation with secure file permissions (0600) - DEK (Data Encryption Key) and idx_key wrapped with KEK using libsodium XChaCha20-Poly1305 - Encrypt/decrypt methods with DEK for sensitive data - HMAC-SHA256 blind index generation with idx_key - Custom base64 accessors for PostgreSQL BYTEA columns - 12 comprehensive Feature tests (10 passing, 2 intermittent due to test isolation) - PHPStan level max compliant - PSR-12 compliant Resolves #50
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR introduces a TenantKey model to manage per-tenant envelope encryption keys using a Key Encryption Key (KEK) architecture. The implementation includes cryptographic key generation, wrapping/unwrapping, data encryption/decryption, and blind index generation for searchable encrypted fields.
Key Changes:
- Added
TenantKeymodel with envelope encryption capabilities (KEK wrapping DEK and index keys) - Implemented cryptographic operations using libsodium for secure key management
- Added comprehensive test suite covering key generation, encryption/decryption, and blind indexing
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
app/Models/TenantKey.php |
New model implementing envelope encryption with KEK/DEK architecture, providing encryption, decryption, and blind index generation methods |
tests/Feature/TenantKeyTest.php |
Comprehensive test suite covering KEK generation, envelope key operations, encryption/decryption, and blind index functionality |
toHaveLength() expectation was failing with binary strings from base64_decode. Using strlen() is more reliable for binary data length checks.
kevalyq
force-pushed
the
feat/pr2-tenant-kek-management
branch
from
4afdf99 to
e982ee0
Compare
- Enable timestamps with UPDATED_AT = null for created_at only - Use casts() method instead of property (Laravel 11 convention) - Extract KEK cleanup to helper method in tests - Fix toHaveLength() to strlen()->toBe() for binary data
Use base64_decode() strict mode to validate data integrity and throw RuntimeException on invalid base64
…llback - Replace empty string fallback with RuntimeException when attribute value is not string - Ensures cryptographic operations fail loudly on invalid data - Use sodium_crypto_secretbox_keygen() for DEK and idx_key generation (more explicit)
This was referenced Nov 1, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves #50
Summary
Implements the
TenantKeyEloquent model for per-tenant envelope encryption key management using libsodium XChaCha20-Poly1305. Includes KEK (Key Encryption Key) generation with secure file permissions, DEK (Data Encryption Key) and idx_key wrapping, and comprehensive encryption/blind index functionality.Changes
TenantKey Model (~325 LOC):
storage/app/keys/kek.keywith 0600 permissionssodium_memzero()for securityFeature Tests (~179 LOC):
Technical Details
sodium_crypto_secretbox(XChaCha20-Poly1305)sodium_crypto_secretbox_keygen()SODIUM_CRYPTO_SECRETBOX_NONCEBYTES)Quality
Notes
Two tests ("unwraps idx_key correctly", "generates consistent blind index") pass individually but fail intermittently in full suite. This appears to be a test isolation issue with parallel execution, not a functional bug. CI may have different timing and pass.