PHP: полный мануал с примерами, функциями и ООП

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $empty = iterator_count($ce->getKeys());
    $id = $ce->createDataKey('local', ['keyAltNames'=>['pickup-code']]);
    $document = $ce->getKey($id);
    $names = kv132AliasList($document);
    $providerName = $document->masterKey->provider;
    $checks = ['empty_at_start'=>$empty === 0, 'uuid'=>$id->getType() === Binary::TYPE_UUID,
        'sixteen_bytes'=>strlen($id->getData()) === 16, 'id_matches'=>$document->_id == $id,
        'label'=>$names === ['pickup-code'], 'provider'=>$providerName === 'local',
        'wrapped_material'=>$document->keyMaterial instanceof Binary];
    $rows = [['Ключей до выдачи',$empty], ['Подтип BSON идентификатора',$id->getType()],
        ['Имя для приложения',$names[0]], ['Провайдер',$providerName]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-first-key', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-first-key: OK', PHP_EOL;

mongodb132-vault-first-key: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $id = $ce->createDataKey('local', ['keyAltNames'=>['returns']]);
    $direct = new ClientEncryption(['keyVaultClient'=>$manager,'keyVaultNamespace'=>$vault,'kmsProviders'=>$provider]);
    $fromFactory = $ce->getKey($id);
    $fromConstructor = $direct->getKeyByAltName('returns');
    $absent = $direct->getKeyByAltName('unknown-role');
    $checks = ['factory_instance'=>$ce instanceof ClientEncryption, 'constructor_instance'=>$direct instanceof ClientEncryption,
        'separate_php_instances'=>$ce !== $direct, 'factory_found'=>$fromFactory->_id == $id,
        'same_record'=>$fromConstructor->_id == $id, 'known_alias'=>kv132AliasList($fromConstructor) === ['returns'], 'absent'=>$absent === null];
    $rows = [['Созданы разные объекты PHP',$ce !== $direct],['Обе ссылки нашли один UUID',$fromFactory->_id == $fromConstructor->_id],
        ['Ключ returns найден',$fromConstructor !== null],['Неизвестное имя найдено',$absent !== null]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-client-options', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-client-options: OK', PHP_EOL;

mongodb132-vault-client-options: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $ce->createDataKey('local', ['keyAltNames'=>['returns']]);
    $ce->createDataKey('local', ['keyAltNames'=>['pickup']]);
    $unlabelled = $ce->createDataKey('local');
    $cursor = $ce->getKeys();
    $roles = [];
    $total = 0;
    $withoutName = 0;
    foreach ($cursor as $document) {
        $total++;
        $names = kv132AliasList($document);
        if (!$names) {$withoutName++;}
        foreach ($names as $label) {$roles[] = $label;}
    }
    sort($roles, SORT_STRING);
    $found = $ce->getKey($unlabelled);
    $checks = ['real_cursor'=>$cursor instanceof MongoDB\Driver\Cursor,'total'=>$total === 3,
        'one_unlabelled'=>$withoutName === 1,'visible_role_names'=>$roles === ['pickup','returns'],
        'uuid_lookup'=>$found->_id == $unlabelled,'no_name_in_record'=>kv132AliasList($found) === []];
    $rows = [['Всего ключей',$total],['Без имени',$withoutName],['Имена в отчёте',implode(', ', $roles)]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-inventory', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-inventory: OK', PHP_EOL;

mongodb132-vault-inventory: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $id = $ce->createDataKey('local', ['keyAltNames'=>['dispatch-v1']]);
    $beforeAdd = $ce->addKeyAltName($id,'dispatch-v2');
    $oldDuring = $ce->getKeyByAltName('dispatch-v1');
    $newDuring = $ce->getKeyByAltName('dispatch-v2');
    $beforeRemove = $ce->removeKeyAltName($id,'dispatch-v1');
    $after = $ce->getKey($id);
    $checks = ['old_returned_on_add'=>kv132AliasList($beforeAdd) === ['dispatch-v1'],
        'both_during'=>$oldDuring->_id == $newDuring->_id, 'same_dek'=>$newDuring->_id == $id,
        'old_returned_on_remove'=>kv132AliasList($beforeRemove) === ['dispatch-v1','dispatch-v2'],
        'old_missing'=>$ce->getKeyByAltName('dispatch-v1') === null,
        'only_new_name'=>kv132AliasList($after) === ['dispatch-v2']];
    $rows = [['До добавления',implode(', ',kv132AliasList($beforeAdd))],
        ['В переходный период',implode(', ',kv132AliasList($beforeRemove))],['После перехода',implode(', ',kv132AliasList($after))],
        ['UUID сохранился',$after->_id == $id]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-alias-rename', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-alias-rename: OK', PHP_EOL;

mongodb132-vault-alias-rename: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $packing = $ce->createDataKey('local', ['keyAltNames'=>['packing']]);
    $billing = $ce->createDataKey('local', ['keyAltNames'=>['billing']]);
    $duplicate = false;
    try {
        $ce->addKeyAltName($billing,'packing');
    } catch (MongoDB\Driver\Exception\RuntimeException $error) {
        if ($error->getCode() !== 11000 && !str_contains($error->getMessage(),'E11000')) {
            throw $error;
        }
        $duplicate = true;
    }
    $holder = $ce->getKeyByAltName('packing');
    $bill = $ce->getKey($billing);
    $indexes = kv132Command($manager,$db,['listIndexes'=>$vaultName]);
    $altIndex = array_values(array_filter($indexes,fn($i)=>$i['name'] === 'unique_alt_names'))[0];
    $checks = ['duplicate_rejected'=>$duplicate,'owner_retained'=>$holder->_id == $packing,
        'second_key_unmodified'=>kv132AliasList($bill) === ['billing'], 'two_vault_keys'=>iterator_count($ce->getKeys()) === 2,
        'unique_index'=>$altIndex['unique'] === true,
        'only_named_documents'=>$altIndex['partialFilterExpression']['keyAltNames']['$exists'] === true];
    $rows = [['Второе назначение отклонено',$duplicate],['packing остался у первого ключа',$holder->_id == $packing],
        ['Имя второго ключа',implode(', ',kv132AliasList($bill))],['Индекс уникален',$altIndex['unique']]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-unique-names', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-unique-names: OK', PHP_EOL;

mongodb132-vault-unique-names: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $id = $ce->createDataKey('local', ['keyAltNames'=>['legacy-note']]);
    $protected = kv132Cipher($ce,$id);
    $previous = $ce->removeKeyAltName($id,'legacy-note');
    $now = $ce->getKey($id);
    $byName = $ce->getKeyByAltName('legacy-note');
    $fresh = kv132Fresh($uri,$vault,$master);
    $opened = $fresh->decrypt($protected) === 'учебный талон R-7';
    $checks = ['was_named'=>kv132AliasList($previous) === ['legacy-note'], 'lookup_empty'=>$byName === null,
        'still_present'=>$now->_id == $id,'no_names_left'=>kv132AliasList($now) === [],
        'same_one_key'=>iterator_count($fresh->getKeys()) === 1,'fresh_decryption'=>$opened];
    $rows = [['Снятое имя',implode(', ',kv132AliasList($previous))],['Имён осталось',count(kv132AliasList($now))],
        ['Доступен по UUID',$now->_id == $id],['Ранее зашифрованное поле читается',$opened]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 1;
kv132Report('mongodb132-vault-last-name', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-last-name: OK', PHP_EOL;

mongodb132-vault-last-name: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $dataNs = kv132Create($manager,$db,$owned);
    $id = $ce->createDataKey('local', ['keyAltNames'=>['dispatch']]);
    $other = $ce->createDataKey('local', ['keyAltNames'=>['keep']]);
    $oldEnvelope = $ce->getKey($id)->keyMaterial;
    $otherEnvelope = $ce->getKey($other)->keyMaterial;
    $protected = kv132Cipher($ce,$id);
    kv132Insert($manager,$dataNs,[['_id'=>'R-7','protected'=>$protected]]);
    $result = $ce->rewrapManyDataKey(['_id'=>$id]);
    $after = $ce->getKey($id);
    $stored = kv132Read($manager,$dataNs,['_id'=>'R-7'],['_id'=>0,'protected'=>1])[0]['protected'];
    $fresh = kv132Fresh($uri,$vault,$master);
    $opened = $fresh->decrypt($stored) === 'учебный талон R-7';
    $noMatch = $ce->rewrapManyDataKey(['keyAltNames'=>'not-assigned']);
    $checks = ['matched_result'=>isset($result->bulkWriteResult), 'uuid_preserved'=>$after->_id == $id,
        'target_wrapped_again'=>$after->keyMaterial != $oldEnvelope,
        'other_unchanged'=>$ce->getKey($other)->keyMaterial == $otherEnvelope,
        'field_unchanged'=>$stored == $protected, 'cold_read'=>$opened,
        'no_match_result'=>($noMatch->bulkWriteResult ?? null) === null];
    $rows = [['Есть результат записи по фильтру',isset($result->bulkWriteResult)],['UUID сохранился',$after->_id == $id],
        ['Другой ключ остался прежним',$checks['other_unchanged']],['Шифротекст записи остался прежним',$stored == $protected],
        ['Новый клиент прочитал старый талон',$opened]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 2;
kv132Report('mongodb132-vault-rewrap-one', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-rewrap-one: OK', PHP_EOL;

mongodb132-vault-rewrap-one: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.

<?php
declare(strict_types=1);
use MongoDB\BSON\Binary;
use MongoDB\Driver\{ClientEncryption, Command, Manager, ReadPreference, Server};
use MongoDB\Driver\Exception\EncryptionException;
require __DIR__.'/kv132-helper.php';

// Keep driver messages, arguments and key documents outside public output.
set_exception_handler(static function(Throwable $error): void {
    fwrite(STDERR, 'Vault example failed: '.$error::class.PHP_EOL);
    exit(1);
});
if (!in_array(strtolower((string)ini_get('mongodb.debug')), ['', '0', 'off', 'no', 'false'], true)) {
    throw new RuntimeException('Disable MongoDB debug tracing for this lab');
}
$settings = kv132Settings();
$uri = $settings['uri'];
$db = $settings['database'];
$manager = new Manager($uri, ['serverSelectionTimeoutMS'=>1500, 'connectTimeoutMS'=>500, 'socketTimeoutMS'=>3000]);
$server = $manager->selectServer(new ReadPreference(ReadPreference::PRIMARY));
if ($server->getType() !== Server::TYPE_STANDALONE) {
    throw new RuntimeException('Use a dedicated standalone server');
}
$runtime = ['php'=>PHP_VERSION,'extension'=>phpversion('mongodb'),
    'server'=>kv132Command($manager,$db,['buildInfo'=>1])[0]['version'],
    'execution'=>'database','observed_host'=>$server->getHost(),'observed_port'=>$server->getPort()];
$owned = [];
try {
    $vault = kv132Create($manager, $db, $owned);
    $vaultName = $owned[0];
    kv132Command($manager,$db,['createIndexes'=>$vaultName, 'indexes'=>[[
        'name'=>'unique_alt_names', 'key'=>['keyAltNames'=>1], 'unique'=>true,
        'partialFilterExpression'=>['keyAltNames'=>['$exists'=>true]],
    ]]],true);
    $master = new Binary(random_bytes(96), Binary::TYPE_GENERIC);
    $provider = ['local'=>['key'=>$master]];
    $ce = $manager->createClientEncryption(['keyVaultNamespace'=>$vault, 'kmsProviders'=>$provider]);
    $dataNs = kv132Create($manager,$db,$owned);
    $id = $ce->createDataKey('local', ['keyAltNames'=>['training-only']]);
    $protected = kv132Cipher($ce,$id);
    kv132Insert($manager,$dataNs,[['_id'=>'R-7','protected'=>$protected]]);
    $before = kv132Fresh($uri,$vault,$master)->decrypt($protected) === 'учебный талон R-7';
    $result = $ce->deleteKey($id);
    $missing = $ce->getKey($id) === null;
    $docs = kv132Read($manager,$dataNs,['_id'=>'R-7'],['_id'=>0,'protected'=>1]);
    $fresh = kv132Fresh($uri,$vault,$master);
    $refused = false;
    try {
        $fresh->decrypt($docs[0]['protected']);
    } catch (EncryptionException $error) {
        $refused = true;
    }
    $again = $ce->deleteKey($id);
    $checks = ['opened_before'=>$before, 'deleted_one'=>(int)$result->deletedCount === 1,
        'id_missing'=>$missing,'business_document_remains'=>count($docs) === 1 && $docs[0]['protected'] == $protected,
        'failed_on_fresh_client'=>$refused,'delete_again_zero'=>(int)$again->deletedCount === 0];
    $rows = [['До удаления талон читается',$before],['Удалено документов DEK',(int)$result->deletedCount],
        ['Талон в бизнес-коллекции остался',count($docs) === 1],['Свежему клиенту не удалось открыть поле',$refused],
        ['Повторно удалено',(int)$again->deletedCount]];
} finally {
    foreach (array_reverse($owned) as $collection) {
        kv132Command($manager,$db,['drop'=>$collection],true);
    }
}
$removed = true;
foreach ($owned as $collection) {
    if (kv132Exists($manager,$db,$collection)) {$removed = false;}
}
$checks['owned_collections_removed'] = $removed && count($owned) === 2;
kv132Report('mongodb132-vault-retire-test-key', ['Что проверили', 'Результат'], $rows, $checks, $runtime);
echo 'mongodb132-vault-retire-test-key: OK', PHP_EOL;

mongodb132-vault-retire-test-key: OK

Работа с собственным временным хранилищем и локальным учебным CMK. На страницу попадают только разрешённые поля и результаты сравнений.