如何在Laravel中实现数据脱敏

// app/Models/User.php

namespace App\Models;

use Illuminate\Database\Eloquent\Factories\HasFactory;
use Illuminate\Foundation\Auth\User as Authenticatable;
use Illuminate\Notifications\Notifiable;
use Laravel\Sanctum\HasApiTokens;

class User extends Authenticatable
{
    use HasApiTokens, HasFactory, Notifiable;

    // ... 其他属性和方法

    /**
     * 获取脱敏后的邮箱地址。
     */
    public function getEmailAttribute($value)
    {
        if (empty($value)) {
            return '';
        }
        // 假设邮箱是 test@example.com
        // 脱敏后变成 t***@example.com
        $parts = explode('@', $value);
        if (count($parts) === 2) {
            $username = $parts[0];
            $domain = $parts[1];
            return substr($username, 0, 1) . '***' . '@' . $domain;
        }
        return '***'; // 无法识别的邮箱格式
    }

    /**
     * 获取脱敏后的手机号码。
     */
    public function getPhoneAttribute($value)
    {
        if (empty($value)) {
            return '';
        }
        // 假设手机号是 13812345678
        // 脱敏后变成 138****5678
        return substr($value, 0, 3) . '****' . substr($value, -4);
    }
}

// app/Casts/DesensitizedEmail.php

namespace App\Casts;

use Illuminate\Contracts\Database\Eloquent\CastsAttributes;
use Illuminate\Support\Str;

class DesensitizedEmail implements CastsAttributes
{
    /**
     * 将原始值转换为脱敏后的值。
     *
     * @param  \Illuminate\Database\Eloquent\Model  $model
     * @param  string  $key
     * @param  mixed  $value
     * @param  array  $attributes
     * @return string
     */
    public function get($model, $key, $value, $attributes)
    {
        if (empty($value)) {
            return '';
        }
        $parts = explode('@', $value);
        if (count($parts) === 2) {
            $username = $parts[0];
            $domain = $parts[1];
            return Str::substr($username, 0, 1) . '***' . '@' . $domain;
        }
        return '***';
    }

    /**
     * 准备值以进行存储。
     * 在这里我们通常返回原始值，因为脱敏只针对显示。
     *
     * @param  \Illuminate\Database\Eloquent\Model  $model
     * @param  string  $key
     * @param  mixed  $value
     * @param  array  $attributes
     * @return mixed
     */
    public function set($model, $key, $value, $attributes)
    {
        return $value; // 存储时保持原始值
    }
}

// app/Models/User.php

namespace App\Models;

use App\Casts\DesensitizedEmail; // 引入自定义Cast

class User extends Authenticatable
{
    // ...

    protected $casts = [
        'email' => DesensitizedEmail::class,
        // 'phone' => DesensitizedPhone::class, // 如果有需要，可以为手机号也创建一个
    ];

    // ...
}

// app/Console/Commands/DesensitizeData.php

namespace App\Console\Commands;

use Illuminate\Console\Command;
use App\Models\User; // 假设你需要脱敏User表

class DesensitizeData extends Command
{
    protected $signature = 'data:desensitize';
    protected $description = 'Desensitize sensitive data in development/testing environments.';

    public function handle()
    {
        if (app()->environment('production')) {
            $this->error('This command should NOT be run in production!');
            return Command::FAILURE;
        }

        $this->info('Starting data desensitization...');

        User::chunk(1000, function ($users) {
            foreach ($users as $user) {
                // 这里直接修改模型属性，然后保存
                // 注意：如果你的模型使用了访问器进行脱敏，这里直接保存会把脱敏后的值存入数据库
                // 如果你希望数据库中存储的是脱敏后的数据，并且不希望在生产环境展示原始数据
                // 那么你需要在这里手动进行脱敏处理，或者确保 set 方法不会修改原始值
                // 另一种做法是，在这里直接更新数据库字段
                $user->email = $this->maskEmail($user->getRawOriginal('email')); // 获取原始值再脱敏
                $user->phone = $this->maskPhone($user->getRawOriginal('phone'));
                $user->save();
            }
            $this->info('Processed 1000 users...');
        });

        $this->info('Data desensitization completed.');
        return Command::SUCCESS;
    }

    protected function maskEmail($email)
    {
        if (empty($email)) return '';
        $parts = explode('@', $email);
        if (count($parts) === 2) {
            $username = $parts[0];
            $domain = $parts[1];
            return substr($username, 0, 1) . '***' . '@' . $domain;
        }
        return '***';
    }

    protected function maskPhone($phone)
    {
        if (empty($phone)) return '';
        return substr($phone, 0, 3) . '****' . substr($phone, -4);
    }
}

// database/factories/UserFactory.php

namespace Database\Factories;

use Illuminate\Database\Eloquent\Factories\Factory;
use Illuminate\Support\Str;

class UserFactory extends Factory
{
    public function definition()
    {
        // 生成一个随机邮箱，然后脱敏
        $email = $this->faker->unique()->safeEmail();
        $maskedEmail = substr($email, 0, 1) . '***' . '@' . explode('@', $email)[1];

        // 生成一个随机手机号，然后脱敏
        $phone = $this->faker->numerify('1##########'); // 生成1开头的11位数字
        $maskedPhone = substr($phone, 0, 3) . '****' . substr($phone, -4);

        return [
            'name' => $this->faker->name(),
            'email' => $maskedEmail, // 直接存储脱敏后的邮箱
            'phone' => $maskedPhone, // 直接存储脱敏后的手机号
            'email_verified_at' => now(),
            'password' => '$2y$10$92IXUNpkjO0rOQ5byMi.Ye4oKoEa3Ro9llC/.og/at2.uheWG/igi', // password
            'remember_token' => Str::random(10),
        ];
    }
}