From d570647f03123474ad823147fd65ec6c9c343619 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20de=20la=20Pen=CC=83a?= <p@shedcollective.org>
Date: Wed, 21 Oct 2026 16:56:01 +0100
Subject: [PATCH 1/2] feat: hide sensitive columns from find and replace

---
 .phpstan/constants.php                      | 12 ++++
 src/FindReplace/Exclusion/Package.php       | 49 ++++++++++++++++
 tests/FindReplace/Exclusion/PackageTest.php | 63 +++++++++++++++++++++
 tests/bootstrap.php                         | 12 ++++
 4 files changed, 136 insertions(+)
 create mode 100644 src/FindReplace/Exclusion/Package.php
 create mode 100644 tests/FindReplace/Exclusion/PackageTest.php

diff --git a/.phpstan/constants.php b/.phpstan/constants.php
index 7be0db69..ecefc766 100644
--- a/.phpstan/constants.php
+++ b/.phpstan/constants.php
@@ -1,2 +1,14 @@
 <?php
 define('NAILS_DB_PREFIX', '');
+
+if (!interface_exists(\Nails\FindReplace\Interfaces\Exclusion::class, false)) {
+    foreach ([
+        dirname(__DIR__) . '/vendor/nails/common/src/FindReplace/Interfaces/Exclusion.php',
+        dirname(__DIR__, 2) . '/common/src/FindReplace/Interfaces/Exclusion.php',
+    ] as $nailsFindReplaceExclusion) {
+        if (is_file($nailsFindReplaceExclusion)) {
+            require_once $nailsFindReplaceExclusion;
+            break;
+        }
+    }
+}
diff --git a/src/FindReplace/Exclusion/Package.php b/src/FindReplace/Exclusion/Package.php
new file mode 100644
index 00000000..b1482968
--- /dev/null
+++ b/src/FindReplace/Exclusion/Package.php
@@ -0,0 +1,49 @@
+<?php
+
+namespace Nails\Auth\FindReplace\Exclusion;
+
+use Nails\FindReplace\Interfaces\Exclusion;
+
+class Package implements Exclusion
+{
+    public function hidden(): array
+    {
+        return [
+            NAILS_DB_PREFIX . 'user.password',
+            NAILS_DB_PREFIX . 'user.password_md5',
+            NAILS_DB_PREFIX . 'user.password_engine',
+            NAILS_DB_PREFIX . 'user.salt',
+            NAILS_DB_PREFIX . 'user.forgotten_password_code',
+            NAILS_DB_PREFIX . 'user.remember_code',
+            NAILS_DB_PREFIX . 'user.id_md5',
+            NAILS_DB_PREFIX . 'user.user_acl',
+            NAILS_DB_PREFIX . 'user_email.code',
+            NAILS_DB_PREFIX . 'user_group.acl',
+            NAILS_DB_PREFIX . 'user_group.password_rules',
+            NAILS_DB_PREFIX . 'user_password_history',
+            NAILS_DB_PREFIX . 'user_passkey',
+            NAILS_DB_PREFIX . 'user_auth_access_token',
+            NAILS_DB_PREFIX . 'user_event',
+            NAILS_DB_PREFIX . 'user_import',
+            NAILS_DB_PREFIX . 'user_import_item',
+        ];
+    }
+
+    public function readOnly(): array
+    {
+        return [
+            NAILS_DB_PREFIX . 'user.username',
+            NAILS_DB_PREFIX . 'user.ip_address',
+            NAILS_DB_PREFIX . 'user.last_ip',
+            NAILS_DB_PREFIX . 'user.referral',
+            NAILS_DB_PREFIX . 'user.timezone',
+            NAILS_DB_PREFIX . 'user.language',
+            NAILS_DB_PREFIX . 'user.datetime_format_date',
+            NAILS_DB_PREFIX . 'user.datetime_format_time',
+            NAILS_DB_PREFIX . 'user_email.email',
+            NAILS_DB_PREFIX . 'user_email_blocker.type',
+            NAILS_DB_PREFIX . 'user_group.default_homepage',
+            NAILS_DB_PREFIX . 'user_group.registration_redirect',
+        ];
+    }
+}
diff --git a/tests/FindReplace/Exclusion/PackageTest.php b/tests/FindReplace/Exclusion/PackageTest.php
new file mode 100644
index 00000000..6cbf9544
--- /dev/null
+++ b/tests/FindReplace/Exclusion/PackageTest.php
@@ -0,0 +1,63 @@
+<?php
+
+namespace Tests\Auth\FindReplace\Exclusion;
+
+use Nails\Auth\FindReplace\Exclusion\Package;
+use PHPUnit\Framework\TestCase;
+
+class PackageTest extends TestCase
+{
+    public static function setUpBeforeClass(): void
+    {
+        if (!defined('NAILS_DB_PREFIX')) {
+            define('NAILS_DB_PREFIX', 'nails_');
+        }
+    }
+
+    public function testHidden(): void
+    {
+        self::assertSame(
+            [
+                NAILS_DB_PREFIX . 'user.password',
+                NAILS_DB_PREFIX . 'user.password_md5',
+                NAILS_DB_PREFIX . 'user.password_engine',
+                NAILS_DB_PREFIX . 'user.salt',
+                NAILS_DB_PREFIX . 'user.forgotten_password_code',
+                NAILS_DB_PREFIX . 'user.remember_code',
+                NAILS_DB_PREFIX . 'user.id_md5',
+                NAILS_DB_PREFIX . 'user.user_acl',
+                NAILS_DB_PREFIX . 'user_email.code',
+                NAILS_DB_PREFIX . 'user_group.acl',
+                NAILS_DB_PREFIX . 'user_group.password_rules',
+                NAILS_DB_PREFIX . 'user_password_history',
+                NAILS_DB_PREFIX . 'user_passkey',
+                NAILS_DB_PREFIX . 'user_auth_access_token',
+                NAILS_DB_PREFIX . 'user_event',
+                NAILS_DB_PREFIX . 'user_import',
+                NAILS_DB_PREFIX . 'user_import_item',
+            ],
+            (new Package())->hidden()
+        );
+    }
+
+    public function testReadOnly(): void
+    {
+        self::assertSame(
+            [
+                NAILS_DB_PREFIX . 'user.username',
+                NAILS_DB_PREFIX . 'user.ip_address',
+                NAILS_DB_PREFIX . 'user.last_ip',
+                NAILS_DB_PREFIX . 'user.referral',
+                NAILS_DB_PREFIX . 'user.timezone',
+                NAILS_DB_PREFIX . 'user.language',
+                NAILS_DB_PREFIX . 'user.datetime_format_date',
+                NAILS_DB_PREFIX . 'user.datetime_format_time',
+                NAILS_DB_PREFIX . 'user_email.email',
+                NAILS_DB_PREFIX . 'user_email_blocker.type',
+                NAILS_DB_PREFIX . 'user_group.default_homepage',
+                NAILS_DB_PREFIX . 'user_group.registration_redirect',
+            ],
+            (new Package())->readOnly()
+        );
+    }
+}
diff --git a/tests/bootstrap.php b/tests/bootstrap.php
index 93ac78fe..67eac2b9 100644
--- a/tests/bootstrap.php
+++ b/tests/bootstrap.php
@@ -5,3 +5,15 @@
 require 'vendor/autoload.php';
 
 Testing::bootstrapModule(__FILE__);
+
+if (!interface_exists(\Nails\FindReplace\Interfaces\Exclusion::class, false)) {
+    foreach ([
+        dirname(__DIR__) . '/vendor/nails/common/src/FindReplace/Interfaces/Exclusion.php',
+        dirname(__DIR__, 2) . '/common/src/FindReplace/Interfaces/Exclusion.php',
+    ] as $nailsFindReplaceExclusion) {
+        if (is_file($nailsFindReplaceExclusion)) {
+            require_once $nailsFindReplaceExclusion;
+            break;
+        }
+    }
+}

From bd5381a23fb82d979d6a0b38a15c1deae17c18b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pablo=20de=20la=20Pen=CC=83a?= <p@shedcollective.org>
Date: Wed, 21 Oct 2026 17:04:34 +0100
Subject: [PATCH 2/2] fix: require find-replace so exclusion tests can autoload

---
 composer.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/composer.json b/composer.json
index 1e8de158..bfa7bcb8 100644
--- a/composer.json
+++ b/composer.json
@@ -47,6 +47,7 @@
         "ext-mbstring": "*"
     },
     "require-dev": {
+        "nails/module-find-replace": "dev-develop",
         "phpunit/phpunit": "^12.0",
         "phpstan/phpstan": "^2.0",
         "nails/module-queue": "dev-develop"