<?php
namespace App\Providers;
use App\Support\Security\{AwsKmsEnvelopeEncryption,EnvelopeEncryption,LaravelEnvelopeEncryption}; use Aws\Kms\KmsClient; use Illuminate\Support\ServiceProvider; use RuntimeException;
final class SecurityServiceProvider extends ServiceProvider { public function register(): void { $this->app->singleton(EnvelopeEncryption::class,function($app){ $driver=env('ENVELOPE_ENCRYPTION_DRIVER',$app->environment('production')?'aws-kms':'local'); if($driver==='local') return new LaravelEnvelopeEncryption($app['encrypter']); if($driver!=='aws-kms') throw new RuntimeException('Unsupported envelope encryption driver.'); $key=(string)config('services.aws.kms_key_id'); if($key==='') throw new RuntimeException('AWS_KMS_KEY_ID is required.'); $kms=new KmsClient(['version'=>'latest','region'=>config('services.aws.region'),'credentials'=>env('AWS_ACCESS_KEY_ID')?['key'=>env('AWS_ACCESS_KEY_ID'),'secret'=>env('AWS_SECRET_ACCESS_KEY')]:null]); return new AwsKmsEnvelopeEncryption($kms,$key); }); } }
