base64 iv in payload

phpstan-baseline.neon

@@ -1,5 +1,11 @@
 parameters:
 	ignoreErrors:
+		-
+			message: '#^Parameter \#3 \$iv of class Patchlevel\\Hydrator\\Extension\\Cryptography\\Cipher\\CipherKey constructor expects non\-empty\-string, string given\.$#'
+			identifier: argument.type
+			count: 1
+			path: src/Extension/Cryptography/BaseCryptographer.php
+
 		-
 			message: '#^Method Patchlevel\\Hydrator\\Extension\\Cryptography\\Cipher\\OpensslCipher\:\:encrypt\(\) should return non\-empty\-string but returns string\.$#'
 			identifier: return.type
@@ -90,42 +96,6 @@ parameters:
 			count: 1
 			path: src/Normalizer/ObjectNormalizer.php
 
-		-
-			message: '#^Call to method clear\(\) on an unknown class Patchlevel\\Hydrator\\Cryptography\\Store\\InMemoryCipherKeyStore\.$#'
-			identifier: class.notFound
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
-		-
-			message: '#^Call to static method createWithOpenssl\(\) on an unknown class Patchlevel\\Hydrator\\Cryptography\\BaseCryptographer\.$#'
-			identifier: class.notFound
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
-		-
-			message: '#^Instantiated class Patchlevel\\Hydrator\\Cryptography\\CryptographyExtension not found\.$#'
-			identifier: class.notFound
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
-		-
-			message: '#^Instantiated class Patchlevel\\Hydrator\\Cryptography\\Store\\InMemoryCipherKeyStore not found\.$#'
-			identifier: class.notFound
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
-		-
-			message: '#^Parameter \#1 \$extension of method Patchlevel\\Hydrator\\HydratorBuilder\:\:useExtension\(\) expects Patchlevel\\Hydrator\\Extension, Patchlevel\\Hydrator\\Cryptography\\CryptographyExtension given\.$#'
-			identifier: argument.type
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
-		-
-			message: '#^Property Patchlevel\\Hydrator\\Tests\\Benchmark\\HydratorWithCryptographyBench\:\:\$store has unknown class Patchlevel\\Hydrator\\Cryptography\\Store\\InMemoryCipherKeyStore as its type\.$#'
-			identifier: class.notFound
-			count: 1
-			path: tests/Benchmark/HydratorWithCryptographyBench.php
-
 		-
 			message: '#^Property Patchlevel\\Hydrator\\Tests\\Unit\\Extension\\Cryptography\\Fixture\\ChildWithSensitiveDataWithIdentifierDto\:\:\$email is never read, only written\.$#'
 			identifier: property.onlyWritten

src/Extension/Cryptography/BaseCryptographer.php

@@ -15,6 +15,8 @@
 use Patchlevel\Hydrator\Extension\Cryptography\Store\CipherKeyStore;
 
 use function array_key_exists;
+use function base64_decode;
+use function base64_encode;
 use function is_array;
 
 /**
@@ -52,7 +54,7 @@ public function encrypt(string $subjectId, mixed $value): array
             '__enc' => 'v1',
             'data' => $this->cipher->encrypt($cipherKey, $value),
             'method' => $cipherKey->method,
-            'iv' => $cipherKey->iv,
+            'iv' => base64_encode($cipherKey->iv),
         ];
     }
 
@@ -70,7 +72,7 @@ public function decrypt(string $subjectId, mixed $encryptedData): mixed
             new CipherKey(
                 $cipherKey->key,
                 $encryptedData['method'] ?? $cipherKey->method,
-                $encryptedData['iv'] ?? $cipherKey->iv,
+                isset($encryptedData['iv']) ? base64_decode($encryptedData['iv']) : $cipherKey->iv,
             ),
             $encryptedData['data'],
         );

tests/Unit/Extension/Cryptography/BaseCryptographerTest.php

@@ -46,7 +46,7 @@ public function testEncrypt(): void
             '__enc' => 'v1',
             'data' => 'encrypted',
             'method' => 'methodA',
-            'iv' => 'random',
+            'iv' => 'cmFuZG9t',
         ];
 
         self::assertEquals($expected, $cryptographer->encrypt('foo', 'info@patchlevel.de'));
@@ -81,7 +81,7 @@ public function testEncryptWithoutKey(): void
             '__enc' => 'v1',
             'data' => 'encrypted',
             'method' => 'methodA',
-            'iv' => 'random',
+            'iv' => 'cmFuZG9t',
         ];
 
         self::assertEquals($expected, $cryptographer->encrypt('foo', 'info@patchlevel.de'));
@@ -115,7 +115,7 @@ public function testDecrypt(): void
                     '__enc' => 'v1',
                     'data' => 'encrypted',
                     'method' => 'methodA',
-                    'iv' => 'random',
+                    'iv' => 'cmFuZG9t',
                 ],
             ),
         );