Oihana Php Masking

Implements the conventional creditCard masker: it returns a random 16-digit number (as an integer) whose check digit satisfies the Luhn algorithm. The original value is never reflected in the output.

Implements the conventional datetime masker: a random instant is picked in [begin, end] and rendered with format. The format uses DATE_FORMAT()-style tokens — the common ones are supported: %yyyy, %yy, %mm, %m, %dd, %d, %hh, %h, %ii, %i, %ss, %s, %fff and %%. When format is empty (the default), an empty string is returned.

Implements the conventional decimal masker: the value is replaced whatever its original type (string, boolean and null included), rounded to scale fraction digits. The bounds are inclusive; they are swapped if given in the wrong order.

This is a portable, self-contained masking engine. Each rule is { "path": …, "type": <masker>, …params }; the supported path forms are:

• "name" — a leaf attribute name at the top level ;
• "a.b" — the exact nested path a → b (through objects only) ;
• ".name" — every leaf attribute named name, at any depth ;
• "*" — every leaf attribute ;
• "`a.b`" — a literal attribute name containing dots (backtick/tick quoted).

A leaf is a value that is null, a scalar or a JSON array; objects are descended into. When a matched leaf is an array, the masker is applied to its elements individually (see maskValue()). When several rules match the same leaf, the first one in the list wins.

The attributes named in $protectedAttributes are never masked at the top level, even by a * rule — use this to preserve identity fields. The default is an empty list (nothing protected), so the engine stays agnostic of any particular data store: supply the identity fields of your model yourself (e.g. ['_key','_id','_rev','_from','_to'] for ArangoDB, ['_id'] for MongoDB, ['id'] for a relational row).

Each element is handled on its own: a nested list recurses through this helper, a nested object is walked by maskDocumentNode(), and a bare scalar is left untouched (it is not a keyed attribute, so no path rule can target it directly — only the masker applied to the parent leaf reaches it). This mirrors the common "array elements are masked individually" rule.

A leaf (scalar, null or a JSON array) is masked by the first matching rule (resolveMaskingRule()); an array with no matching rule is walked deeper (maskDocumentList()); a nested object recurses through this helper. The attributes named in $protectedAttributes are never masked at the top level ($depth === 0); the default is an empty list (nothing protected).

Implements the conventional email masker: the result has the shape AAAA.BBBB@CCCC.invalid with random parts. The original value is never reflected in the output (the content is replaced wholesale, not hashed reversibly), so it is safe for anonymization. The .invalid TLD is reserved (RFC 2606) and never resolves.

Implements the conventional integer masker: the value is replaced whatever its original type (string, boolean and null included). The bounds are inclusive; they are swapped if given in the wrong order.

Implements the conventional phone masker: each digit is replaced by a random digit, each letter by a random letter (case kept), and every other character is left unchanged. When the value is not a string, the default fallback is used.

Implements the conventional random masker:

• strings → a random string (see maskRandomString()) ;
• integers → a random integer between -1000 and 1000 ;
• floats → a random decimal between -1000 and 1000 ;
• booleans → a random boolean ;
• null → stays null.

Implements the conventional randomString masker: only string values are modified — any other type (number, boolean, null) is returned unchanged. The replacement keeps the original length (with a minimum of 1).

The replacement is random, not a reversible hash of the input — the goal is anonymization, not byte-compatibility with any external tool.

This is the dispatcher in front of the per-type maskers (maskEmail(), maskXifyFront(), …). When the value is a JSON array (a PHP list), the masker is applied to each element individually — sub-arrays recurse, nested objects (associative arrays) are left untouched — mirroring the common "array elements are masked individually" rule. Scalars and null are masked directly.

Implements the conventional xifyFront masker. Within each word (a run of alphanumeric, _ or - characters) every character except the last unmaskedLength ones is replaced by x; words no longer than unmaskedLength are left untouched. Every other character (spaces, punctuation) becomes a blank. Non-string values (boolean, number) become the fixed string "xxxx", and null stays null.

Implements the conventional zip masker: each digit becomes a random digit, each letter a random letter (case kept), other characters are left unchanged. When the value is not a string, the default fallback is used.

A small building block shared by the string-producing maskers (maskEmail(), maskRandomString(), maskRandom()). It is not meant to be cryptographically reversible — its only purpose is to replace a value with anonymized, readable characters.

A leaf is identified by its attribute name ($key) and its exact dotted path ($exactPath, which is null once an array has been crossed, disabling exact-path matching). The supported path forms are:

• "*" — matches every leaf ;
• "`a.b`" — a backtick/tick quoted literal attribute name ;
• ".name" — any leaf whose attribute name is name, at any depth ;
• "a.b" — the exact dotted path.

The first matching rule wins, so a more specific rule listed earlier shadows a broader one listed later.