Gdpr Bundle Laravel Package

Getting Started

Minimal Setup for Laravel Integration

Since this is a Symfony bundle, direct Laravel integration isn't natively supported, but you can adapt it via:

1. Composer Installation (Symfony-compatible):

   composer require bijsterdee/gdpr-bundle
   

2. Manual Service Registration (Laravel-specific):

   • Create a GdprServiceProvider in app/Providers/:

     use Bijsterdee\GdprBundle\GdprBundle;
     use Symfony\Component\HttpKernel\KernelInterface;
     
     class GdprServiceProvider extends ServiceProvider
     {
         public function register()
         {
             $this->app->singleton('gdpr.anonymizer', function ($app) {
                 return new GdprBundle()->getAnonymizer();
             });
         }
     }
     

   • Register in config/app.php under providers.

3. First Use Case: Anonymize a user’s email in a controller:

   use Illuminate\Support\Facades\App;
   
   public function anonymizeUser()
   {
       $anonymizer = App::make('gdpr.anonymizer');
       $anonymizedEmail = $anonymizer->anonymize('user@example.com');
       // Returns: "*****@example.com" (default mask)
   }
   

Implementation Patterns

Core Workflows

1. Data Anonymization in Models:

   • Override getAttribute() to anonymize sensitive fields:

     public function getEmailAttribute($value)
     {
         return app('gdpr.anonymizer')->anonymize($value);
     }
     

   • Use accessors for dynamic anonymization (e.g., in API responses).

2. Batch Processing:

   • Anonymize records during GDPR deletion requests:

     public function handleGdprRequest()
     {
         $users = User::where('is_deleted', false)->get();
         foreach ($users as $user) {
             $user->anonymize(); // Custom method calling the bundle
         }
     }
     

3. Event-Driven Anonymization:

   • Trigger anonymization via Laravel events (e.g., UserDeleting):

     event(new UserDeleting($user));
     // Listener:
     public function handle(UserDeleting $event)
     {
         $event->user->email = app('gdpr.anonymizer')->anonymize($event->user->email);
     }
     

Integration Tips

• Configuration: Override default masks in config/services.php (Symfony-style):

  'gdpr' => [
      'masks' => [
          'email' => '*****@domain.com',
          'phone' => '****1234',
      ],
  ],
  

  (Note: Requires extending the bundle’s config loader for Laravel.)

• Query Scoping: Use the anonymizer in query scopes to filter anonymized data:

  public function scopeAnonymized($query)
  {
      return $query->select([
          'id',
          'anonymized_email' => app('gdpr.anonymizer')->anonymize(DB::raw('email')),
      ]);
  }
  

• API Responses: Wrap responses with anonymized data:

  return response()->json([
      'user' => $this->anonymizeUser($user),
  ]);
  
  private function anonymizeUser($user)
  {
      return collect($user)->mapWithKeys(function ($value, $key) {
          return in_array($key, ['email', 'phone'])
              ? app('gdpr.anonymizer')->anonymize($value)
              : $value;
      });
  }
  

Gotchas and Tips

Pitfalls

1. Symfony Dependency:

   • The bundle assumes Symfony’s HttpKernel and DependencyInjection. Workarounds:
     • Mock interfaces (e.g., KernelInterface) in Laravel’s container.
     • Use adapters (e.g., SymfonyBridge) to translate Symfony services.

2. Configuration Conflicts:

   • Laravel’s config/ structure differs from Symfony’s config/packages/. Solution: Create a custom config loader or override bundle defaults via service provider:

     $this->app->extend('gdpr.anonymizer', function ($anonymizer, $app) {
         $anonymizer->setConfig($app['config']['gdpr']);
         return $anonymizer;
     });
     

3. Database-Level Anonymization:

   • Avoid anonymizing in raw SQL (e.g., DB::select()). Use Eloquent accessors or application-level masking.

4. Performance:

   • Batch anonymization can be slow for large datasets. Optimize:
     • Use database transactions.
     • Queue anonymization jobs (Laravel Queues).

Debugging

• Log Anonymization: Enable debug logs for the anonymizer:

  app('gdpr.anonymizer')->setDebug(true);
  

  (Requires extending the bundle’s logger.)

• Test Edge Cases:

  • Empty strings, null, or malformed data (e.g., user@):

    $this->assertEquals('*****', app('gdpr.anonymizer')->anonymize('user@'));
    

Extension Points

1. Custom Anonymizers: Extend the base anonymizer for domain-specific rules:

   class CustomAnonymizer extends \Bijsterdee\GdprBundle\Anonymizer
   {
       protected function anonymizeEmail($email)
       {
           return 'redacted@example.com'; // Custom logic
       }
   }
   

   Register via service provider:

   $this->app->bind('gdpr.anonymizer', function () {
       return new CustomAnonymizer();
   });
   

2. Event Listeners: Hook into anonymization events (if the bundle supports them) to log or audit changes.

3. Laravel Policy Integration: Use policies to control anonymization access:

   public function anonymize(User $user)
   {
       $this->authorize('anonymize', $user);
       return app('gdpr.anonymizer')->anonymize($user->email);
   }