Decrypt Laravel Package

Product Decisions This Supports

• API Security & Data Exposure Control:

  • Enable granular field-level encryption/decryption for sensitive data (e.g., PII, payment details) in API responses without modifying core Eloquent logic.
  • Align with compliance requirements (GDPR, HIPAA) by ensuring encrypted fields are only decrypted when explicitly needed (e.g., for API consumers).

• Roadmap: Decoupled Data Handling:

  • Justify building a lightweight abstraction layer for encryption/decryption to avoid hardcoding logic in controllers or services.
  • Support future expansion (e.g., dynamic encryption policies, audit logging) without rewriting core model logic.

• Build vs. Buy:

  • Buy: Avoid reinventing wheel for basic field-level decryption in Eloquent models. Low stars/maturity may require customization but reduces initial dev effort.
  • Build: If needing advanced features (e.g., conditional decryption, key rotation), this package could serve as a foundation to extend.

• Use Cases:

  • API Responses: Decrypt only necessary fields for specific endpoints (e.g., Decrypt::collection($users)->only(['name', 'email'])).
  • Admin vs. Public Data: Differentiate data exposure for internal tools vs. third-party integrations.
  • Legacy Migration: Gradually encrypt sensitive fields in existing models without breaking downstream systems.

When to Consider This Package

• Adopt When:

  • Your Laravel app uses Eloquent models with sensitive fields requiring encryption (e.g., passwords, tokens, health data).
  • You need a consistent, model-defined way to decrypt data for API responses, avoiding scattered Attribute::makeHidden() or manual decryption in controllers.
  • Your team lacks time/resources to build a custom decryption layer but needs flexibility beyond Laravel’s built-in encryption helpers.
  • You’re okay with a MIT-licensed, untested package (0 stars) and can contribute to its maintenance if issues arise.

• Look Elsewhere If:

  • You need fine-grained access control (e.g., decrypt based on user roles/permissions) – this package lacks such logic.
  • Your encryption requirements go beyond field-level (e.g., entire model serialization, nested relationships).
  • You prioritize battle-tested packages (e.g., spatie/laravel-encryption or laravel/breeze for auth-specific needs).
  • Your app uses non-Eloquent data sources (e.g., raw database queries, external APIs).
  • You need audit trails for decryption events (this package doesn’t log decryption actions).

How to Pitch It (Stakeholders)

For Executives:

"This package lets us securely expose only the encrypted data our APIs need—when they need it—without bloating our codebase. For example, a user’s payment details stay encrypted at rest, but our fraud-detection API can decrypt just the last_four_digits field dynamically. It’s a lightweight way to meet compliance needs while keeping our tech stack lean. The trade-off? We’d need to vet its stability, but the MIT license and minimal setup make it a low-risk experiment."

For Engineering:

*"This solves a common pain point: manually decrypting fields in controllers or responses. With this package:

• Models define what’s encryptable (e.g., $encryptable = ['ssn', 'credit_card']), so the logic lives where the data lives.
• API responses stay clean: Decrypt a collection or single model with Decrypt::collection($users) and return JSON—no more mixing decryption logic with business logic.
• Easy to adopt: Just add a service provider, alias, and $encryptable array to models. Downside? It’s untested (0 stars), so we’d need to test edge cases (e.g., nested relationships, custom casts).

Alternative: We could build this in-house, but this gives us 80% of the functionality with 20% of the effort. If we hit limits (e.g., need role-based decryption), we can fork it or pair it with another package like spatie/laravel-permission."*

Key Risk to Mitigate:

• "We’ll add this to our tech radar but won’t ship it until we’ve stress-tested it with our encrypted model schemas. If it fails, we’ll fall back to a custom solution or spatie/laravel-encryption."