feat(php): masking (#1075)

| 🚥 Resolves [RM-8742](https://linear.app/readme-io/issue/RM-8742) |
| :------------------- |

## 🧰 Changes

Adds sensitive data masking to the PHP SDK
The logic is the same as we will have in Python SDK (PR #955)

Author: AndriiAndreiev

Makefile

@@ -54,12 +54,12 @@ test-metrics-node-hapi: ## Run Metrics tests against the Node SDK + hapi
 
 test-metrics-php-laravel: ## Run Metrics tests against the PHP SDK + Laravel
 	docker compose up --build --detach integration_php_laravel
-	SUPPORTS_MULTIPART=true npm run test:integration-metrics || make cleanup-failure
+	SUPPORTS_HASHING=true SUPPORTS_MULTIPART=true npm run test:integration-metrics || make cleanup-failure
 	@make cleanup
 
 test-webhooks-php-laravel: ## Run webhooks tests against the PHP SDK + Laravel
 	docker compose up --detach integration_php_laravel
-	SUPPORTS_MULTIPART=true npm run test:integration-webhooks || make cleanup-failure
+	SUPPORTS_HASHING=true SUPPORTS_MULTIPART=true npm run test:integration-webhooks || make cleanup-failure
 	@make cleanup
 
 ##

packages/php/src/HAR/MaskHelper.php

@@ -0,0 +1,14 @@
+<?php
+
+namespace ReadMe\HAR;
+
+class MaskHelper
+{
+    public static function mask(string $data): string
+    {
+        $hashBytes = hash('sha512', $data, true);
+        $base64Hash = base64_encode($hashBytes);
+        $opts = substr($data, -4);
+        return 'sha512-' . $base64Hash . '?' . $opts;
+    }
+}

packages/php/src/HAR/Payload.php

@@ -33,7 +33,7 @@ public function create(string $log_id, Request $request, Response $response): ar
         if ($api_key_exists) {
             // Swap the externally documented `api_key` field into backwards compatible and
             // internally used `id` field.
-            $group['id'] = $group['api_key'];
+            $group['id'] = MaskHelper::mask($group['api_key']);
             unset($group['api_key']);
         }
 
@@ -334,10 +334,14 @@ protected static function convertHeaderBagToArray(HeaderBag $headers): array
             /** @psalm-suppress PossiblyNullIterator */
             foreach ($values as $value) {
                 // If the header is empty, don't worry about it.
-                if ($value === '') {
+                if ($value === '' || $value === null) {
                     continue; // @codeCoverageIgnore
                 }
 
+                if (strtolower($name) === 'authorization') {
+                    $value = MaskHelper::mask($value);
+                }
+
                 $output[] = [
                     'name' => $name,
                     'value' => $value

packages/php/tests/HAR/PayloadTest.php

@@ -125,7 +125,8 @@ public function testCreate(): void
         $this->assertSame('fake-uuid', $har['_id']);
 
         $this->assertEqualsCanonicalizing([
-            'id' => '123457890',
+            'id' => 'sha512-UrMmjaetxGbu6QkwzYAH9h4c1dzTNIy3CV1lBuHSb0TNlTmrgUUzTRINiCPah7ObWnOiqVXUlVjQD14gblqlPA=='
+                . '?7890',
             'label' => 'username',
             'email' => '[email protected]'
         ], $har['group']);