Method encryptFileInPlace

src/FileRise/Support/CryptoAtRest.php:220–309

(string $path)

    }

    public static function encryptFileInPlace(string $path): void
    {
        if (!self::isAvailable()) {
            throw new \RuntimeException('libsodium secretstream is not available on this PHP build.');
        }
        if (!is_file($path)) {
            throw new \RuntimeException('File not found for encryption.');
        }
        if (self::isEncryptedFile($path)) {
            return;
        }

        $key = self::requireMasterKey();

        $dir = dirname($path);
        $base = basename($path);
        $tmp = $dir . DIRECTORY_SEPARATOR . '.' . $base . '.frtmp.' . bin2hex(random_bytes(6));

        $in = @fopen($path, 'rb');
        if ($in === false) {
            throw new \RuntimeException('Unable to open file for encryption.');
        }

        $out = @fopen($tmp, 'wb');
        if ($out === false) {
            @fclose($in);
            throw new \RuntimeException('Unable to open temp file for encryption.');
        }

        try {
            $plainSize = @filesize($path);
            if (!is_int($plainSize) || $plainSize < 0) {
                $plainSize = 0;
            }

            $init = sodium_crypto_secretstream_xchacha20poly1305_init_push($key);
            if (!is_array($init) || count($init) < 2) {
                throw new \RuntimeException('Failed to initialize secretstream (push).');
            }
            $state  = $init[0];
            $header = $init[1];

            // Write header
            fwrite($out, self::MAGIC);
            fwrite($out, chr(self::VERSION));
            fwrite($out, chr(self::FLAGS));
            fwrite($out, self::packU64BE((int)$plainSize));
            fwrite($out, $header);

            while (!feof($in)) {
                $chunk = fread($in, self::CHUNK_SIZE);
                if ($chunk === '' || $chunk === false) {
                    break;
                }
                $cipher = sodium_crypto_secretstream_xchacha20poly1305_push(
                    $state,
                    $chunk,
                    '',