From ec245cd5b8e9a9e359f1f649eb857f7cf4012450 Mon Sep 17 00:00:00 2001
From: Andrii Andreiev <129078694+AndriiAndreiev@users.noreply.github.com>
Date: Mon, 23 Sep 2024 18:30:08 +0300
Subject: [PATCH] feat(php): masking (#1075)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

| 🚥 Resolves [RM-8742](https://linear.app/readme-io/issue/RM-8742) |
| :------------------- |

## 🧰 Changes

Adds sensitive data masking to the PHP SDK
The logic is the same as we will have in Python SDK (PR #955)
---
 Makefile                               |  4 ++--
 packages/php/src/HAR/MaskHelper.php    | 14 ++++++++++++++
 packages/php/src/HAR/Payload.php       |  8 ++++++--
 packages/php/tests/HAR/PayloadTest.php |  3 ++-
 4 files changed, 24 insertions(+), 5 deletions(-)
 create mode 100644 packages/php/src/HAR/MaskHelper.php

diff --git a/Makefile b/Makefile
index cdf0e7ad32..db91a5491f 100644
--- a/Makefile
+++ b/Makefile
@@ -54,12 +54,12 @@ test-metrics-node-hapi: ## Run Metrics tests against the Node SDK + hapi
 
 test-metrics-php-laravel: ## Run Metrics tests against the PHP SDK + Laravel
 	docker compose up --build --detach integration_php_laravel
-	SUPPORTS_MULTIPART=true npm run test:integration-metrics || make cleanup-failure
+	SUPPORTS_HASHING=true SUPPORTS_MULTIPART=true npm run test:integration-metrics || make cleanup-failure
 	@make cleanup
 
 test-webhooks-php-laravel: ## Run webhooks tests against the PHP SDK + Laravel
 	docker compose up --detach integration_php_laravel
-	SUPPORTS_MULTIPART=true npm run test:integration-webhooks || make cleanup-failure
+	SUPPORTS_HASHING=true SUPPORTS_MULTIPART=true npm run test:integration-webhooks || make cleanup-failure
 	@make cleanup
 
 ##
diff --git a/packages/php/src/HAR/MaskHelper.php b/packages/php/src/HAR/MaskHelper.php
new file mode 100644
index 0000000000..93d3babf85
--- /dev/null
+++ b/packages/php/src/HAR/MaskHelper.php
@@ -0,0 +1,14 @@
+<?php
+
+namespace ReadMe\HAR;
+
+class MaskHelper
+{
+    public static function mask(string $data): string
+    {
+        $hashBytes = hash('sha512', $data, true);
+        $base64Hash = base64_encode($hashBytes);
+        $opts = substr($data, -4);
+        return 'sha512-' . $base64Hash . '?' . $opts;
+    }
+}
diff --git a/packages/php/src/HAR/Payload.php b/packages/php/src/HAR/Payload.php
index f4b977f753..9df6209006 100644
--- a/packages/php/src/HAR/Payload.php
+++ b/packages/php/src/HAR/Payload.php
@@ -33,7 +33,7 @@ public function create(string $log_id, Request $request, Response $response): ar
         if ($api_key_exists) {
             // Swap the externally documented `api_key` field into backwards compatible and
             // internally used `id` field.
-            $group['id'] = $group['api_key'];
+            $group['id'] = MaskHelper::mask($group['api_key']);
             unset($group['api_key']);
         }
 
@@ -334,10 +334,14 @@ protected static function convertHeaderBagToArray(HeaderBag $headers): array
             /** @psalm-suppress PossiblyNullIterator */
             foreach ($values as $value) {
                 // If the header is empty, don't worry about it.
-                if ($value === '') {
+                if ($value === '' || $value === null) {
                     continue; // @codeCoverageIgnore
                 }
 
+                if (strtolower($name) === 'authorization') {
+                    $value = MaskHelper::mask($value);
+                }
+
                 $output[] = [
                     'name' => $name,
                     'value' => $value
diff --git a/packages/php/tests/HAR/PayloadTest.php b/packages/php/tests/HAR/PayloadTest.php
index c67b1c3430..738d427352 100644
--- a/packages/php/tests/HAR/PayloadTest.php
+++ b/packages/php/tests/HAR/PayloadTest.php
@@ -125,7 +125,8 @@ public function testCreate(): void
         $this->assertSame('fake-uuid', $har['_id']);
 
         $this->assertEqualsCanonicalizing([
-            'id' => '123457890',
+            'id' => 'sha512-UrMmjaetxGbu6QkwzYAH9h4c1dzTNIy3CV1lBuHSb0TNlTmrgUUzTRINiCPah7ObWnOiqVXUlVjQD14gblqlPA=='
+                . '?7890',
             'label' => 'username',
             'email' => 'email@example.com'
         ], $har['group']);