Laravel Serializable Closure

When using this package, be aware of the following limitations:

• REPL Environments: Serializing closures in REPL environments, such as Laravel Tinker, is not supported.
• Source Line Ambiguity: If multiple closures are defined on the same source line and have identical signatures, they may not be distinguishable after serialization. To prevent this, ensure each closure is placed on its own line.

Install the package using Composer. This package requires PHP 7.4+.

composer require laravel/serializable-closure

To serialize a closure, wrap it in a Laravel\SerializableClosure\SerializableClosure instance and then use the standard PHP serialize() function. To restore the closure, use unserialize() and call getClosure() on the resulting object.

Security Note: It is highly recommended to set a secret key using SerializableClosure::setSecretKey() before serialization to ensure the integrity of the serialized data.

use Laravel\SerializableClosure\SerializableClosure;

$closure = fn () => 'james';

// Recommended
SerializableClosure::setSecretKey('secret');

$serialized = serialize(new SerializableClosure($closure));
$closure = unserialize($serialized)->getClosure();

echo $closure(); // james;

Use SerializableClosure::setSecretKey() to define a secret key. This is the recommended way to handle closures to ensure security during the serialization process.

Laravel\SerializableClosure\SerializableClosure::setSecretKey('secret');

If you want to create a serializable instance that does not include a cryptographic signature (useful when you don't need to verify the integrity of the closure), use the unsigned() static method. This returns an UnsignedSerializableClosure instance.

use Laravel\SerializableClosure\SerializableClosure;

$closure = function () {
    return 'hello';
};

$unsigned = SerializableClosure::unsigned($closure);

The UnsignedSerializableClosure class provides a way to wrap a PHP Closure so that it can be serialized and later invoked. It uses a native serializer internally to handle the closure's state.

To use it, instantiate the class with a Closure. You can then retrieve the original closure using getClosure() or execute the wrapped closure directly by invoking the instance.

use Laravel\SerializableClosure\UnsignedSerializableClosure;

$closure = function ($name) {
    return "Hello, {$name}!";
};

$serializable = new UnsignedSerializableClosure($closure);

// Execute the closure
echo $serializable("World"); // Outputs: Hello, World!

// Retrieve the original closure
$original = $serializable->getClosure();

To get the original Closure object back from a SerializableClosure instance, call the getClosure() method.

$closure = $serializableClosure->getClosure();

A SerializableClosure instance can be invoked directly like a function using the __invoke() magic method. It accepts any arguments and passes them to the underlying closure.

$serializableClosure = new SerializableClosure(fn($a, $b) => $a + $b);

$result = $serializableClosure(1, 2);
// $result is 3

Use setSecretKey($secret) to provide a secret string. When a secret is provided, the library uses an Hmac signer, and all subsequent SerializableClosure instances will use the Signed serializer. This allows you to verify that the closure has not been tampered with during serialization/deserialization.

use Laravel\SerializableClosure\SerializableClosure;

SerializableClosure::setSecretKey('your-secret-key');

You can customize how use variables are handled during the serialization process using the following static methods:

• transformUseVariablesUsing($transformer): Sets a closure that defines how variables captured by the use keyword are transformed during serialization.
• resolveUseVariablesUsing($resolver): Sets a closure that defines how those transformed variables are resolved back to their original state during deserialization.

use Laravel\SerializableClosure\SerializableClosure;

// Example: Custom transformer
SerializableClosure::transformUseVariablesUsing(function ($variables) {
    // logic to transform variables
    return $variables;
});

// Example: Custom resolver
SerializableClosure::resolveUseVariablesUsing(function ($variables) {
    // logic to resolve variables
    return $variables;
});

To wrap a PHP Closure so it can be serialized and deserialized, instantiate the SerializableClosure class. By default, if a secret key has been set via setSecretKey(), it will use a signed serializer to ensure integrity. Otherwise, it uses a native serializer.

use Laravel\SerializableClosure\SerializableClosure;

$closure = function ($a, $b) {
    return $a + $b;
};

$serializableClosure = new SerializableClosure($closure);