Symfony中加密字段的UniqueEntity约束：实现策略与最佳实践

<?php

namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
// 假设您的加密注解是这样的，或者使用实际的加密包注解
// use App\Annotation\Encrypted; 

/**
 * @ORM\Entity(repositoryClass="App\Repository\DemoRepository")
 * @UniqueEntity(
 *      fields={"emailHash"}, // 对哈希字段进行唯一性检查
 *      ignoreNull=true,
 *      message="此邮箱已被注册，请使用其他邮箱。"
 * )
 */
class Demo
{
    /**
     * @ORM\Id
     * @ORM\GeneratedValue
     * @ORM\Column(type="integer")
     */
    private $id;

    /**
     * @ORM\Column(type="string", length=255, nullable=true)
     * // @Encrypted // 假设这里使用了加密注解
     */
    private $email;

    /**
     * @ORM\Column(type="string", length=40, unique=true, nullable=true) // SHA1哈希通常是40个字符
     */
    private $emailHash;

    public function getId(): ?int
    {
        return $this->id;
    }

    public function getEmail(): ?string
    {
        return $this->email;
    }

    public function setEmail(?string $email): self
    {
        $this->email = $email;
        // 在设置email时，同时计算并设置emailHash
        // 使用SHA1哈希，并以类名作为简单的“盐”增加安全性
        $this->emailHash = $email ? hash('sha1', $email . get_class($this)) : null;

        return $this;
    }

    public function getEmailHash(): ?string
    {
        return $this->emailHash;
    }

    // 注意：emailHash的setter不应暴露，或应确保其内部逻辑与setEmail同步
    // public function setEmailHash(?string $emailHash): self
    // {
    //     $this->emailHash = $emailHash;
    //     return $this;
    // }
}

<?php

namespace App\Repository;

use App\Entity\Demo;
use Doctrine\Bundle\DoctrineBundle\Repository\ServiceEntityRepository;
use Doctrine\Persistence\ManagerRegistry;
// 假设您有一个加密服务
use App\Service\EncryptionService; 

/**
 * @method Demo|null find($id, $lockMode = null, $lockVersion = null)
 * @method Demo|null findOneBy(array $criteria, array $orderBy = null)
 * @method Demo[]    findAll()
 * @method Demo[]    findBy(array $criteria, array $orderBy = null, $limit = null, $offset = null)
 */
class DemoRepository extends ServiceEntityRepository
{
    private $encryptionService;

    public function __construct(ManagerRegistry $registry, EncryptionService $encryptionService)
    {
        parent::__construct($registry, Demo::class);
        $this->encryptionService = $encryptionService;
    }

    /**
     * 自定义方法，用于检查加密字段的唯一性
     *
     * @param string $email 待验证的原始邮箱
     * @param int|null $currentId 当前实体ID，用于编辑时排除自身
     * @return bool 如果邮箱已存在（加密后），则返回true
     */
    public function isEmailUnique(string $email, ?int $currentId = null): bool
    {
        // 1. 对传入的原始邮箱进行加密
        $encryptedEmail = $this->encryptionService->encrypt($email);

        // 2. 查询数据库，查找是否存在相同的加密邮箱
        $qb = $this->createQueryBuilder('d')
            ->andWhere('d.email = :encryptedEmail')
            ->setParameter('encryptedEmail', $encryptedEmail);

        if ($currentId !== null) {
            $qb->andWhere('d.id != :currentId')
               ->setParameter('currentId', $currentId);
        }

        return $qb->getQuery()->getOneOrNullResult() !== null;
    }
}

<?php

namespace App\Entity;

use Doctrine\ORM\Mapping as ORM;
use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
// use App\Annotation\Encrypted; 

/**
 * @ORM\Entity(repositoryClass="App\Repository\DemoRepository")
 * @UniqueEntity(
 *      fields={"email"}, // 字段仍然是email，但验证逻辑在repositoryMethod中
 *      repositoryMethod="isEmailUnique", // 指定自定义Repository方法
 *      ignoreNull=true,
 *      message="此邮箱已被注册，请使用其他邮箱。"
 * )
 */
class Demo
{
    /**
     * @ORM\Id
     * @ORM\GeneratedValue
     * @ORM\Column(type="integer")
     */
    private $id;

    /**
     * @ORM\Column(type="string", length=255, nullable=true)
     * // @Encrypted 
     */
    private $email;

    public function getId(): ?int
    {
        return $this->id;
    }

    public function getEmail(): ?string
    {
        return $this->email;
    }

    public function setEmail(?string $email): self
    {
        $this->email = $email;
        return $this;
    }
}