Anonymizer Bundle Laravel Package

Getting Started

The 1.0.0 release is a Symfony bundle for the framework-agnostic PHPSharkTank/Anonymizer library — it is not a Laravel package and will not be auto-discovered by a Laravel app. What you actually consume in Laravel is the core anonymizer library; the bundle is best read as a reference implementation showing the three wiring points the core exposes: a Loader (metadata discovery), ExclusionStrategies (which entities/properties to skip), and a Cache (for loader metadata).

• Install the core library: composer require phpsharktank/anonymizer. Do not install the Symfony bundle expecting it to register services in Laravel.
• Look first at the bundle's DependencyInjection/Extension and its config/packages/anonymizer.yaml — the three toggles (cache, loader, exclusion_strategies) map directly to the three extension points you must bind in a Laravel service provider.
• First use case: anonymize PII before it hits logs, analytics exports, or non-production database dumps. Bind an anonymizer as a singleton in AppServiceProvider, load metadata once, and call it from a queued job or console command.

Implementation Patterns

• Service provider binding. Bind the anonymizer (and its Loader, ExclusionStrategyManager) as singletons in a dedicated AnonymizerServiceProvider. Mirror the bundle's three booleans as entries in config/anonymizer.php driven by env(), so you can flip caching/loader/strategies per environment just like the Symfony bundle.
• Loader registration. Register a reflection/attribute-based loader at boot so metadata (which properties to anonymize) is discovered once. In Laravel, prefer doing this in register() and resolving lazily so tests can swap it.
• Exclusion strategy chains. Model the bundle's "Enable/Disable ExclusionStrategies" as a tagged collection of strategy classes. Useful strategies: exclude by class, by attribute, by tenant/role, or by a #[DoNotAnonymize] marker.
• Caching. Adapter-pattern the loader cache to Laravel's Cache::store(). Enable in staging/production; disable in local and in tests. Key the cache on the loader class + schema version so redeploys invalidate cleanly.
• Batch anonymization. Run via php artisan anonymizer:run command or a queued job that chunk-reads models and writes anonymized rows — never load a whole table into memory.
• Boundary anonymization. Anonymize in the serialization layer (API Resources, DTOs, formatters) rather than mutating Eloquent models, so the source of truth stays intact and the same anonymizer can be reused for logging, exports, and analytics.
• Middleware. Apply anonymization to outbound payloads (webhooks, third-party logging) via a middleware or a tap() hook on your logging channel.

Gotchas and Tips

• Bundle ≠ Laravel package. Don't composer require the Symfony bundle in a Laravel app and expect service wiring. The toggles are bundle-specific; replicate them in Laravel config yourself.
• Caching staleness. The loader cache becomes wrong the moment you add or remove an attribute on a model. Add a cache-buster (e.g. a schema/mtime hash) and clear it in your deploy pipeline. Never cache in local.
• Loader cost. Reflection is the slow path; warm it once at boot or via a deploy command. Avoid loading metadata per-request in hot paths.
• Exclusion order matters. In the bundle (and in a chain in Laravel) the first matching strategy wins. Audit the order — an "exclude everything except X" strategy placed first voids the rest.
• Disabling exclusion strategies in prod is a footgun. If your config mirrors the bundle's toggle and someone flips it off, PII will be anonymized where it shouldn't be (or skipped where it should be). Guard the toggle with a policy check, not just an env var.
• Framework-agnostic gap. The core library is Symfony-agnostic, but the ergonomic wiring (container tags, config tree, cache adapters) only exists for Symfony. You'll write a small Laravel adapter — keep it thin and testable.
• Testing. Disable the cache in phpunit.xml, bind an in-memory cache, and assert anonymized output for each entity type. Snapshot-test the anonymized DTOs so regressions in strategy order are caught.
• Extension points worth owning. A custom Loader (e.g. Eloquent model introspection), a custom ExclusionStrategy (tenant/role), and a custom cache adapter (Laravel cache repository) are the three you'll most likely write — start there rather than porting the whole bundle.