Register encryption commands only when automatic encryption is configured

The mongodb:encrypted:create and mongodb:encrypted:diagnose commands are now
registered only when at least one MongoDB connection configures
driver_options.autoEncryption, matching the keys-first setup contract.

Registration moves to boot() so the connection configuration is fully loaded
before the check. The command test configures autoEncryption on the mongodb
connection beforehand; without it the commands are not exposed.

Author: GromNaN

src/MongoDBServiceProvider.php

@@ -35,6 +35,7 @@
 use function class_exists;
 use function config;
 use function get_debug_type;
+use function is_array;
 use function is_string;
 use function sprintf;
 
@@ -48,6 +49,17 @@ public function boot()
         Model::setConnectionResolver($this->app['db']);
 
         Model::setEventDispatcher($this->app['events']);
+
+        // Only expose the Queryable Encryption CLI when a MongoDB connection is
+        // configured with automatic encryption; otherwise the setup contract
+        // (keys-first, config map) is not usable. Registered in boot() so the
+        // connection configuration is fully loaded.
+        if ($this->supportsQueryableEncryption()) {
+            $this->commands([
+                Commands\Encrypted\CreateEncryptedCommand::class,
+                Commands\Encrypted\DiagnoseEncryptedCommand::class,
+            ]);
+        }
     }
 
     /**
@@ -109,11 +121,23 @@ public function register()
         $this->registerFlysystemAdapter();
         $this->registerScoutEngine();
         $this->registerBoostTools();
+    }
+
+    /**
+     * Determine whether at least one MongoDB connection config uses automatic
+     * encryption (driver_options.autoEncryption).
+     */
+    private function supportsQueryableEncryption(): bool
+    {
+        foreach (config('database.connections', []) as $connection) {
+            $autoEncryption = is_array($connection) ? ($connection['driver_options']['autoEncryption'] ?? null) : null;
+
+            if (($connection['driver'] ?? null) === 'mongodb' && is_array($autoEncryption)) {
+                return true;
+            }
+        }
 
-        $this->commands([
-            Commands\Encrypted\CreateEncryptedCommand::class,
-            Commands\Encrypted\DiagnoseEncryptedCommand::class,
-        ]);
+        return false;
     }
 
     private function registerFlysystemAdapter(): void

tests/Commands/EncryptedCommandsTest.php

@@ -13,11 +13,14 @@
 
 class EncryptedCommandsTest extends TestCase
 {
-    public function testDiagnoseFailsWhenEncryptionNotConfigured(): void
+    protected function getEnvironmentSetUp($app): void
     {
-        $this->artisan('mongodb:encrypted:diagnose', ['--no-server' => true])
-            ->expectsOutputToContain('Queryable Encryption is not enabled')
-            ->assertExitCode(Command::FAILURE);
+        parent::getEnvironmentSetUp($app);
+
+        // Configure automatic encryption so the encryption commands are
+        // registered on the "mongodb" connection (registered in boot());
+        // the config is fully loaded by then.
+        $app['config']->set('database.connections.mongodb.driver_options.autoEncryption', $this->encryptionOptions([]));
     }
 
     public function testDiagnoseNoServerListsMappedCollections(): void
@@ -49,20 +52,30 @@ public function testCreateNoServerFailsWithoutMappedCollection(): void
     }
 
     /**
-     * Configure automatic encryption on the default MongoDB connection.
+     * @param  array<string, mixed> $encryptedFieldsMap
+     *
+     * @return array<string, mixed>
+     */
+    private function encryptionOptions(array $encryptedFieldsMap): array
+    {
+        return [
+            'keyVaultNamespace' => 'encryption.__keyVault',
+            'kmsProviders' => ['local' => ['key' => base64_encode(random_bytes(96))]],
+            // Opt out of crypt_shared so the tests run on a community server.
+            'extraOptions' => ['cryptSharedLibRequired' => false],
+            'encryptedFieldsMap' => $encryptedFieldsMap,
+        ];
+    }
+
+    /**
+     * Override the encrypted fields map on the default MongoDB connection.
      *
      * @param  array<string, mixed> $encryptedFieldsMap
      */
     private function enableEncryption(array $encryptedFieldsMap): void
     {
         config([
-            'database.connections.mongodb.driver_options.autoEncryption' => [
-                'keyVaultNamespace' => 'encryption.__keyVault',
-                'kmsProviders' => ['local' => ['key' => base64_encode(random_bytes(96))]],
-                // Opt out of crypt_shared so the tests run on a community server.
-                'extraOptions' => ['cryptSharedLibRequired' => false],
-                'encryptedFieldsMap' => $encryptedFieldsMap,
-            ],
+            'database.connections.mongodb.driver_options.autoEncryption' => $this->encryptionOptions($encryptedFieldsMap),
         ]);
     }
 }