Oihana PHP Arango

ArangoMaskingTrait

Compiles the **convenient** masking table and applies it to a dump with the portable PHP masking engine (dump-only — the dump itself is anonymized).

The convenient table uses flat, dotted keys:

[arango.profiles.test-local.masking]
"*"             = "structure"                              # collection mode (default for all)
"users"         = "masked"                                 # collection mode
"users.email"   = "email"                                  # attribute rule (simple masker)
"users.card"    = { type = "xifyFront", unmaskedLength = 4 } # attribute rule (parameterized)

Compilation rules:

  • a key without a dot is a collection name (or *, the default for all collections); its value is a document-level mode (MaskingMode: exclude / structure / masked / full) ;
  • a key with a dot is <collection>.<path> (the first segment is the collection, the rest is the attribute path); its value is a masker name (Masker) or an inline table carrying type plus the masker parameters. The collection mode defaults to masked.

The compiled structure is, per collection: { "type": <mode>, "maskings": [ { "path": <path>, "type": <masker>, … } ] }.

It is then applied to the *.data.json files of a dump by the portable engine (maskDocument(), from the oihana/php-masking library) — which works on any ArangoDB edition (the native --maskings file is Enterprise-only). The PHP engine masks masked collections only; selecting / excluding collections is the job of --collection / the profile selection.

The ArangoDB system attributes (_key, _id, _rev, _from, _to) are kept untouched: this trait owns that identity list (ArangoMaskingTrait::SYSTEM_ATTRIBUTES) and hands it to the (storage-agnostic) engine as the protected attributes.

Table of Contents

Constants

SYSTEM_ATTRIBUTES  : array<string|int, mixed> = [\org\schema\constants\Schema::_KEY, \org\schem...
The top-level ArangoDB system attributes that are never masked — they carry identity / edge references and must survive masking untouched (the same rule `arangodump` applies). Passed to {@see maskDocument()} as the protected attributes.

Methods

compileMaskings()  : array<string, array{type: string, maskings: array>}>
Compiles the convenient masking table into the masking structure (collection name => `{ type, maskings[] }`).
maskDumpDirectory()  : int
Applies the compiled masking to the `*.data.json` files of a dump, in place.
dumpCollectionName()  : string
Resolves the collection name a `*.data.json` file belongs to, by reading the `parameters.name` of its paired `*.structure.json` (falling back to the file-name prefix before the dump hash).
maskingRule()  : array<string, mixed>
Builds — and validates — a single attribute masking rule from a path and its value (a masker name string, or an inline table carrying `type`).

Constants

SYSTEM_ATTRIBUTES

The top-level ArangoDB system attributes that are never masked — they carry identity / edge references and must survive masking untouched (the same rule `arangodump` applies). Passed to {@see maskDocument()} as the protected attributes.

private array<string|int, mixed> SYSTEM_ATTRIBUTES = [\org\schema\constants\Schema::_KEY, \org\schema\constants\Schema::_ID, \org\schema\constants\Schema::_REV, \org\schema\constants\Schema::_FROM, \org\schema\constants\Schema::_TO]

Methods

compileMaskings()

Compiles the convenient masking table into the masking structure (collection name => `{ type, maskings[] }`).

public compileMaskings(array<string|int, mixed> $table) : array<string, array{type: string, maskings: array>}>
Parameters
$table : array<string|int, mixed>

The convenient […masking] table.

Tags
throws
InvalidArgumentException

When a mode or masker is unknown, or a key is malformed.

Return values
array<string, array{type: string, maskings: array>}>

maskDumpDirectory()

Applies the compiled masking to the `*.data.json` files of a dump, in place.

public maskDumpDirectory(string $directory, array<string|int, mixed> $compiled) : int

Each data file is paired with its *.structure.json to resolve the collection name, then matched against the compiled rules (an explicit entry, otherwise the * default). Only masked collections are processed — a non-masked mode raises, since collection selection/exclusion is done by --collection / the profile, not by the engine. Files are expected uncompressed (the dump action forces compressOutput = false).

Parameters
$directory : string

The dump output directory holding the *.data.json files.

$compiled : array<string|int, mixed>

The compiled masking structure (compileMaskings()).

Tags
throws
InvalidArgumentException

When a targeted collection declares a non-masked mode.

RandomException
Return values
int —

The number of data files masked.

dumpCollectionName()

Resolves the collection name a `*.data.json` file belongs to, by reading the `parameters.name` of its paired `*.structure.json` (falling back to the file-name prefix before the dump hash).

private dumpCollectionName(string $dataFile) : string
Parameters
$dataFile : string

The path to a <name>_<hash>.data.json file.

Return values
string

maskingRule()

Builds — and validates — a single attribute masking rule from a path and its value (a masker name string, or an inline table carrying `type`).

private maskingRule(string $path, mixed $value) : array<string, mixed>
Parameters
$path : string
$value : mixed
Tags
throws
InvalidArgumentException

When the masker is unknown or the value malformed.

Return values
array<string, mixed> —

{ path, type, …params }

On this page

Search results