Summary

Add first-class Queryable Encryption (QE) support to mongodb/laravel-mongodb, configuration-driven with no model metadata. The encryption schema is declared once in driver_options.autoEncryption.encryptedFieldsMap; the driver and the server handle encryption and decryption transparently.

Scope: Queryable Encryption in Laravel
https://docs.google.com/document/d/1d5rHlUQQBk8oG3xAKX58uKTLAmuT8CUBfTyZknVDvjE/edit?tab=t.eyxusmsiv22h

Implemented

• Connection: validation of driver_options.autoEncryption (keyVaultNamespace, kmsProviders, local key size, crypt_shared) plus getClientEncryption() and getEncryptionOptions().
• encryptedFieldsMap: simplified keyed-by-path syntax and the list form, normalized to the driver format, with aggressive validation.
• Data keys: each field resolves by an alternate key name, default ./, with a per-field keyAltName override. Generation delegated to libmongocrypt (>= 1.18). DRIVERS-3637.
• Encrypted collection lifecycle: Schema::createEncrypted() and a plain Schema::create() on a mapped collection; transparent drop; dropAllTables() warns about key vault loss.
• Models: the reserved _safeContent_ is hidden from serialization and protected from writes; encrypted collections use single-document updates.
• Artisan: mongodb:encrypted:create and mongodb:encrypted:diagnose, each with a --no-server mode.
• Safety guard: a write to a mapped collection not created as encrypted fails fast, never writing plaintext. DRIVERS-3647.
• Internals: encryption logic in an internal MongoDB\Laravel\Encryption\AutoEncryption, created lazily and held weakly.
• Requires mongodb/mongodb ^1.21.2|^2.1.1.

Related

• Closes https://github.com/mongodb/laravel-mongodb/issues/2699