feat: add key:rotate command#10174
Open
paulbalandan wants to merge 3 commits intocodeigniter4:4.8from
Open
Conversation
memleakd
reviewed
May 7, 2026
Contributor
memleakd
left a comment
memleakd
left a comment
There was a problem hiding this comment.
Thanks for working on this. I left a few inline questions about .env rewrite edge cases.
michalsn
reviewed
May 8, 2026
5 tasks
paulbalandan
force-pushed
the
key-rotate
branch
2 times, most recently
from
db8a0eb to
64e98b0
Compare
5 tasks
michalsn
reviewed
May 10, 2026
|
|
||
| $keep = $options['keep']; | ||
|
|
||
| if (! is_numeric($keep) || (int) $keep < 0) { |
Member
There was a problem hiding this comment.
Does it make sense to use ctype_digit() instead of is_numeric() here? This will pass if someone writes '3.5'.
|
|
||
| $length = $options['length']; | ||
|
|
||
| if (! is_numeric($length) || (int) $length < 1) { |
Comment on lines
+262
to
+266
| if ($injected === $contents) { | ||
| // Fallback: append to the end. Shouldn't trigger because `key:generate` | ||
| // writes the `encryption.key` line just before this method runs. | ||
| $injected = $contents . "\nencryption.previousKeys = {$value}"; // @codeCoverageIgnore | ||
| } |
Member
There was a problem hiding this comment.
The code is okay (from what I understand), but this method runs before key:generate is called. So we need to update the comment.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Adds a
key:rotatespark command that demotes the currentencryption.keytoencryption.previousKeysin .env and generates a fresh key, so existing ciphertext stays decryptable via theKeyRotationDecoratorfallback.The actual key write is delegated to
key:generateto avoid duplicating that logic. All inputs (--prefix,--length,--keep) are validated up-front, before any .env mutation, so an invalid value cannot leave the file half-rotated. Once validation passes,previousKeysis written first; ifkey:generatewere ever to fail afterwards, the worst case is a stale-but-decryptable .env rather than a key-loss event. The replace/insert path uses anchored regexes that recognize DotEnv's optionalexportprefix and ignore comments mentioning the setting name.Options:
--force/-f,--prefix,--length,--keep=N.The IO-swap pattern used to silence the
key:generatesub-command was extracted to a reusableAbstractCommand::callSilently()helper in #10177 (per @michalsn's review); this branch will be rebased onto that once it lands.Checklist: