illuma-law / laravel-vault-cipher

v0.1.5 2026-10-23 14:03 UTC

Requires

• php: ^8.3
• ercsctt/laravel-file-encryption: ^1.1
• illuminate/contracts: ^11.0||^12.0||^13.0
• illuminate/database: ^11.0||^12.0||^13.0
• illuminate/support: ^11.0||^12.0||^13.0
• spatie/laravel-package-tools: ^1.16

Requires (Dev)

• larastan/larastan: ^3.1
• laravel/pint: ^1.21
• mrpunyapal/peststan: ^0.2.12
• nunomaduro/collision: ^8.6
• orchestra/testbench: ^10.1
• pestphp/pest: ^4.0
• pestphp/pest-plugin-arch: ^4.0
• pestphp/pest-plugin-laravel: ^4.0
• phpstan/extension-installer: ^1.4
• phpstan/phpstan-deprecation-rules: ^2.0
• phpstan/phpstan-phpunit: ^2.0
• spatie/laravel-ray: ^1.39

MIT

• illuma-law

Published on Packagist.org on 2026-10-23 14:03 UTC

README

Encrypt strings and files with tenant-specific keys in Laravel applications. You provide the key storage and lookup implementation; the package supplies the encryption manager, streaming file support, and Eloquent casts.

Requires PHP 8.3+ and Laravel 11, 12, or 13.

Install

composer require illuma-law/laravel-vault-cipher
php artisan vendor:publish --tag=vault-cipher-config

Configure a key provider

Implement TenantKeyProvider to look up each tenant's key from your secure key store. This example assumes the key is encrypted in a Tenant model using Laravel's application key; use a dedicated KMS or vault when appropriate.

namespace App\Security;

use App\Models\Tenant;
use IllumaLaw\VaultCipher\Contracts\TenantKeyProvider;

final class DatabaseTenantKeyProvider implements TenantKeyProvider
{
    public function getKey(int|string $tenantId): string
    {
        $encryptedKey = Tenant::query()->findOrFail($tenantId)->encrypted_data_key;

        return decrypt($encryptedKey);
    }
}

Set the provider class in config/vault-cipher.php:

'key_provider' => App\Security\DatabaseTenantKeyProvider::class,

Generate compatible keys with VaultKeyGenerator::generate() and store them securely for their tenant.

Encrypt strings and files

use IllumaLaw\VaultCipher\Facades\TenantEncryptionManager;

$encrypted = TenantEncryptionManager::encryptString($tenantId, 'private text');
$plainText = TenantEncryptionManager::decryptString($tenantId, $encrypted);

TenantEncryptionManager::store($tenantId, 'contracts/agreement.pdf', $contents);
$contents = TenantEncryptionManager::get($tenantId, 'contracts/agreement.pdf');

File operations use the configured filesystem disk by default. You can pass a disk explicitly or use usingDecryptedTempPath() to process a temporary plaintext file that is cleaned up after the callback.

For Eloquent attributes, use TenantEncrypted or TenantEncryptedArray and implement TenantCipherable to provide the model's tenant ID.

Test

composer test
composer analyse
vendor/bin/pint --test

MIT licensed. See LICENSE.