BackupRecoveryKeyService
in package
FinalYes
Creates and consumes portable, backup-scoped recovery-key packages.
Table of Contents
Constants
- FILE_EXTENSION : mixed = '.kmpbackup-key.json'
- FORMAT : mixed = 'kmp-managed-backup-recovery-key'
- MAX_KEY_FILE_BYTES : mixed = 65536
- VERSION : mixed = 1
- SCOPE_PLATFORM : mixed = 'platform'
- SCOPE_TENANT : mixed = 'tenant'
Properties
- $platformEncryptor : PlatformDatabaseBackupEncryptor|null
- $streamCipher : BackupStreamCipher|null
- $tenantEncryptor : TenantBackupEncryptor|null
Methods
- __construct() : mixed
- Constructor.
- decryptPlatformArchiveFile() : void
- Decrypt a platform database archive for an external disaster-recovery restore.
- decryptTenantArchive() : string
- Decrypt an in-memory tenant archive with a matching recovery-key package.
- decryptTenantArchiveFile() : string
- Decrypt a tenant archive after validating its recovery-key identity and checksum.
- exportPlatform() : array{filename: string, content: string}
- Create a platform database backup recovery-key download.
- exportTenant() : array{filename: string, content: string}
- Create a tenant backup recovery-key download.
- assertArchiveMatches() : void
- assertCommonBackupMetadata() : void
- buildExport() : array{filename: string, content: string}
- decodeDataEncryptionKey() : string
- decodeWrappingMetadata() : array<string, mixed>
-
parsePackage()
: array{scope: string, backup_id: string, tenant: array
- requireKek() : SensitiveString
- Fetch a required key-encryption key without exposing it in error output.
Constants
FILE_EXTENSION
public
mixed
FILE_EXTENSION
= '.kmpbackup-key.json'
FORMAT
public
mixed
FORMAT
= 'kmp-managed-backup-recovery-key'
MAX_KEY_FILE_BYTES
public
mixed
MAX_KEY_FILE_BYTES
= 65536
VERSION
public
mixed
VERSION
= 1
SCOPE_PLATFORM
private
mixed
SCOPE_PLATFORM
= 'platform'
SCOPE_TENANT
private
mixed
SCOPE_TENANT
= 'tenant'
Properties
$platformEncryptor read-only
private
PlatformDatabaseBackupEncryptor|null
$platformEncryptor
= null
$streamCipher read-only
private
BackupStreamCipher|null
$streamCipher
= null
$tenantEncryptor read-only
private
TenantBackupEncryptor|null
$tenantEncryptor
= null
Methods
__construct()
Constructor.
public
__construct([TenantBackupEncryptor|null $tenantEncryptor = null ][, PlatformDatabaseBackupEncryptor|null $platformEncryptor = null ][, BackupStreamCipher|null $streamCipher = null ]) : mixed
Parameters
- $tenantEncryptor : TenantBackupEncryptor|null = null
- $platformEncryptor : PlatformDatabaseBackupEncryptor|null = null
- $streamCipher : BackupStreamCipher|null = null
decryptPlatformArchiveFile()
Decrypt a platform database archive for an external disaster-recovery restore.
public
decryptPlatformArchiveFile(string $archivePath, string $recoveryKeyJson, string $outputPath) : void
Parameters
- $archivePath : string
- $recoveryKeyJson : string
- $outputPath : string
decryptTenantArchive()
Decrypt an in-memory tenant archive with a matching recovery-key package.
public
decryptTenantArchive(string $archiveData, string $recoveryKeyJson, string $expectedTenantSlug) : string
Parameters
- $archiveData : string
- $recoveryKeyJson : string
- $expectedTenantSlug : string
Return values
stringdecryptTenantArchiveFile()
Decrypt a tenant archive after validating its recovery-key identity and checksum.
public
decryptTenantArchiveFile(string $archivePath, string $recoveryKeyJson, string $expectedTenantSlug) : string
Parameters
- $archivePath : string
- $recoveryKeyJson : string
- $expectedTenantSlug : string
Return values
stringexportPlatform()
Create a platform database backup recovery-key download.
public
exportPlatform(array<string, mixed> $backup, SecretStoreInterface $secretStore) : array{filename: string, content: string}
Parameters
- $backup : array<string, mixed>
-
Backup metadata row
- $secretStore : SecretStoreInterface
Return values
array{filename: string, content: string}exportTenant()
Create a tenant backup recovery-key download.
public
exportTenant(array<string, mixed> $backup, TenantMetadata $tenant, SecretStoreInterface $secretStore) : array{filename: string, content: string}
Parameters
- $backup : array<string, mixed>
-
Backup metadata row
- $tenant : TenantMetadata
- $secretStore : SecretStoreInterface
Return values
array{filename: string, content: string}assertArchiveMatches()
private
assertArchiveMatches(string $archivePath, array{sha256: string, size_bytes: int} $expectedArchive) : void
Parameters
- $archivePath : string
- $expectedArchive : array{sha256: string, size_bytes: int}
-
Expected archive identity
assertCommonBackupMetadata()
private
assertCommonBackupMetadata(array<string, mixed> $backup, string $expectedAlgorithm) : void
Parameters
- $backup : array<string, mixed>
-
Backup metadata row
- $expectedAlgorithm : string
buildExport()
private
buildExport(array<string, mixed> $backup, string $scope, array{id: string, slug: string}|null $tenant, string $dek, string $filename) : array{filename: string, content: string}
Parameters
- $backup : array<string, mixed>
-
Backup metadata row
- $scope : string
- $tenant : array{id: string, slug: string}|null
-
Tenant identity
- $dek : string
- $filename : string
Return values
array{filename: string, content: string}decodeDataEncryptionKey()
private
decodeDataEncryptionKey(array{data_encryption_key: array{encoding: string, value: string}} $package) : string
Parameters
- $package : array{data_encryption_key: array{encoding: string, value: string}}
-
Recovery-key package
Return values
stringdecodeWrappingMetadata()
private
decodeWrappingMetadata(array<string, mixed> $backup) : array<string, mixed>
Parameters
- $backup : array<string, mixed>
-
Backup metadata row
Return values
array<string, mixed>parsePackage()
private
parsePackage(string $json) : array{scope: string, backup_id: string, tenant: array|null, backup_type: string, encryption_algorithm: string, archive: array{sha256: string, size_bytes: int}, data_encryption_key: array{encoding: string, value: string}}
Parameters
- $json : string
Return values
array{scope: string, backup_id: string, tenant: arrayrequireKek()
Fetch a required key-encryption key without exposing it in error output.
private
requireKek(SecretStoreInterface $secretStore, string $keyName) : SensitiveString
Parameters
- $secretStore : SecretStoreInterface
- $keyName : string