# Features — encryptionatrestphp

Evidence date: 2026-10-15. Revision: `main` `9b3df5c` (2025-08-05).

Feature status is recovered from `README.md`, `PROJECT_SUMMARY.md`, `SENSITIVE_DATA_GUIDE.md`, `src/EncryptionAtRest.php`, `examples/`, `tests/`, and `index.php`. No separate feature backlog file exists in the source repository.

Planned product features beyond “next steps” in `PROJECT_SUMMARY.md`: **none are written as a backlog**. Composer publish and composer.json customisation are documentation next steps, not tickets.

## Current features

| Feature | Status | Where |
|---|---|---|
| AES-256-GCM encrypt to base64 | Current | `EncryptionAtRest::encrypt` |
| AES-256-GCM decrypt from base64 | Current | `EncryptionAtRest::decrypt` |
| Auto-generate 32-byte key when none supplied | Current | `__construct` / `generateKey` |
| Construct with explicit 32-byte key | Current | `__construct($key)` + `validateKey` |
| `getKey()` raw key accessor | Current | `getKey` |
| Export key as base64 | Current | `exportKey` |
| Import key from base64 | Current | `importKey` |
| `isSupported()` OpenSSL + cipher check | Current | static method |
| `getSupportedCiphers()` list | Current | static method |
| Empty-input rejection | Current | encrypt/decrypt |
| Invalid base64 / short ciphertext rejection | Current | decrypt |
| Composer package metadata + classmap autoload | Current | `composer.json` |
| Composer scripts `test` / `example` | Current | `composer.json` scripts |
| Basic usage CLI example | Current | `examples/basic_usage.php` |
| Framework-style + DB + file examples | Current | `examples/framework_integration.php` |
| Sensitive-data field examples | Current | `examples/sensitive_data_examples.php` |
| Custom test suite script | Current | `tests/test_encryption.php` |
| Browser POST demo | Current | `index.php` |
| Operator docs (README, summary, sensitive-data guide) | Current | root Markdown files |

## Completed features

Everything on `main` arrived in one commit (`9b3df5c`). Treat the inventory above as **completed for the initial delivery**. There is no earlier release history in git.

## In development

None evidenced in the repository (no open branches, WIP markers, or unfinished modules).

## Planned / aspirational

| Item | Evidence | Notes |
|---|---|---|
| `composer require encryption-at-rest/php` | `PROJECT_SUMMARY.md` “if published” | Packagist publish status **Unknown** |
| Customize composer.json details | `PROJECT_SUMMARY.md` Next Steps | Homepage still placeholder |
| Key rotation strategies | README / guides as operator advice | Not implemented in code |
| Environment-specific keys | Documented best practice | Caller responsibility |
| Audit logging of encrypt/decrypt ops | Documented advice (“never log the data”) | Not implemented in library |

## Recently changed

| Change | Date | Evidence |
|---|---|---|
| Initial project import | 2025-08-05 | Sole commit `9b3df5c` |

No subsequent commits on `main` at inspection.

## Deprecated / removed

None. Single-commit history; nothing removed in git.

## Not present (listed at scan time or claimed elsewhere)

| Item | Status |
|---|---|
| `sonar-project.properties` | Named in onboarding scan; **not in git** |
| `sonarqube_scan.bat` | Named in onboarding scan; **not in git** |
| `LICENSE` file | MIT claimed in README/composer; **file absent** |
| PHPUnit / PHPSpec / Pest harness | Not present; custom script only |
| PSR-4 namespace for `EncryptionAtRest` | Not present; global class name |
| CI (Bitbucket Pipelines / GitHub Actions) | Not present |
| Chunked streaming encrypt/decrypt | Claimed in README performance wording; **not implemented** |

## Feature notes with caveats

### Demo `UserRepository::getUser`

**Status:** Present in example code, behaviour incomplete.

`saveUser` encrypts fields correctly. `getUser` decrypts hard-coded placeholder strings rather than stored ciphertext. Treat as **example scaffolding**, not a working retrieve path.

### `index.php` demo

**Status:** Current for ephemeral round-trip only. New key each POST — no persistent decrypt.

### Compliance checkmarks in `SENSITIVE_DATA_GUIDE.md`

**Status:** Documented marketing/guidance claims (GDPR / HIPAA / PCI DSS). Not features of the class API. Formal compliance posture: **Unknown / Requires Confirmation**.

## Traceability map (API surface)

| Public API | Feature |
|---|---|
| `__construct(?string $key = null)` | Key supply or generate |
| `encrypt(string $data): string` | Encrypt |
| `decrypt(string $encryptedData): string` | Decrypt |
| `getKey(): string` | Raw key |
| `exportKey(): string` | Base64 key out |
| `importKey(string $base64Key): void` | Base64 key in |
| `isSupported(): bool` | Capability |
| `getSupportedCiphers(): array` | Cipher list |