Ddd Gdpr Bundle Laravel Package

Getting Started

This package, becklyn/ddd-gdpr-bundle, is a Laravel-compatible bundle for integrating GDPR compliance into Domain-Driven Design (DDD) applications. After upgrading to v2.0.0, developers should focus on:

1. Symfony 7 Support: If your project uses Symfony components (e.g., HTTP layer, dependency injection), ensure compatibility with Symfony 7. The bundle now drops support for older Symfony versions.
2. Laravel Integration: For pure Laravel projects, verify that any Symfony-based dependencies (e.g., becklyn/ddd-symfony-bridge) are updated to v3.0.0+ (since the bridge is no longer compatible with v2.0).
3. First Use Case: Install via Composer:

   composer require becklyn/ddd-gdpr-bundle:^2.0
   

   Then publish the bundle’s config (if needed) and bind GDPR-related services in config/app.php or a service provider.

Implementation Patterns

Core Workflows

1. GDPR Compliance Layer:

   • Use the bundle’s GdprService to handle data subject requests (DSRs) like data deletion, export, or rectification.
   • Example:

     $gdprService = app()->make(GdprService::class);
     $gdprService->deletePersonalData($userId, $dataController);
     

   • Integrate with Laravel’s Event System to trigger GDPR events (e.g., GdprDataDeleted).

2. Symfony 7 Integration:

   • If using Symfony’s HTTP layer (e.g., for APIs), leverage Symfony 7’s new features like Attribute-based routing or HTTP client improvements for GDPR endpoints.
   • Example GDPR controller:

     #[Route('/gdpr/delete', name: 'gdpr_delete')]
     public function handleDataDeletion(Request $request): Response
     {
         $gdprService->deletePersonalData($request->get('user_id'));
         return new Response('Data deleted per GDPR');
     }
     

3. Laravel-Specific Patterns:

   • For Eloquent models, extend the bundle’s GdprAwareTrait to auto-apply GDPR rules:

     use Becklyn\GdprBundle\Traits\GdprAwareTrait;
     
     class User extends Model
     {
         use GdprAwareTrait;
     }
     

   • Use Laravel’s Policy System to define GDPR-specific authorization:

     class GdprPolicy
     {
         public function canDeleteData(User $user): bool
         {
             return $user->hasRole('admin');
         }
     }
     

Dependency Management

• Service Binding: Bind the bundle’s services in a Laravel provider:

  $this->app->bind(GdprService::class, function ($app) {
      return new GdprService(
          $app->make(DataSubjectRepository::class),
          $app->make(LoggerInterface::class)
      );
  });
  

• Configuration: Publish the bundle’s config to customize:

  php artisan vendor:publish --provider="Becklyn\GdprBundle\GdprBundle"
  

Gotchas and Tips

Breaking Changes

1. Symfony Bridge Drop:

   • Issue: The bundle no longer supports becklyn/ddd-symfony-bridge:2.0. If your project uses this bridge, upgrade to v3.0.0+ or migrate to native Laravel/Symfony 7 integration.
   • Fix: Replace bridge-specific code with direct Symfony 7 or Laravel service binding.

2. Laravel-Specific Quirks:

   • Event Dispatching: Ensure GDPR events (e.g., GdprDataExported) are properly subscribed in Laravel’s EventServiceProvider. Symfony’s event system may not auto-discover Laravel events.
   • Middleware: If using Symfony’s middleware (e.g., for GDPR endpoints), wrap it in Laravel’s middleware stack:

     $router->middleware('gdpr.middleware')->group(function () {
         // GDPR routes
     });
     

Debugging Tips

1. Logging:

   • Enable debug mode in the bundle’s config to log GDPR operations:

     'gdpr' => [
         'debug' => env('APP_DEBUG', false),
     ],
     

   • Check logs for failed data deletions/exports.

2. Testing:

   • Mock the GdprService in PHPUnit tests:

     $mockGdpr = $this->createMock(GdprService::class);
     $mockGdpr->method('deletePersonalData')->willReturn(true);
     $this->app->instance(GdprService::class, $mockGdpr);
     

Extension Points

1. Custom Data Controllers:

   • Extend the bundle’s AbstractDataController to add project-specific GDPR logic:

     class CustomDataController extends AbstractDataController
     {
         protected function getAdditionalDataToDelete(): array
         {
             return ['audit_logs'];
         }
     }
     

2. Symfony 7 Features:

   • Use Symfony 7’s Attribute system to annotate GDPR-related methods:

     #[GdprProtected]
     public function sensitiveOperation(): void
     {
         // ...
     }
     

   • (Note: Requires custom attribute integration with the bundle.)

3. Laravel Policies:

   • Combine with Laravel’s Gate System for granular GDPR permissions:

     Gate::define('delete-gdpr-data', function (User $user, $model) {
         return $user->can('gdpr-delete', $model);
     });