API / Minn\Admin / SessionsController

SessionsController final readonly class

Minn\Admin\SessionsController · public/minn/src/Minn/Admin/SessionsController.php · 72 lines

A person's sign-in sessions, read from the same session_tokens store the login endpoint writes. Verifiers are the store's keys (the sha256 of each cookie token), so the app can name one without ever seeing the token. Expired rows are skipped, not garbage-collected here.

Uses 12

Auth\Sessions Content\Users Http\Access Http\Method Http\Policy Http\Request Http\Response Http\Route RestError Rest\Caller Rest\Fields Rest\Reply

Used by 1

Rest\Api

Constants and properties

private	`readonly Minn\Content\Users $users`	Promoted from the constructor.
private	`readonly Minn\Auth\Sessions $sessions`	Promoted from the constructor.
private	`readonly Minn\Rest\Caller $caller`	Promoted from the constructor.

Public

new	`__construct(Minn\Content\Users $users, Minn\Auth\Sessions $sessions, Minn\Rest\Caller $caller)`#
method	`list(Minn\Http\Request $request, string $id): Minn\Http\Response`GET /minn-admin/v1/users/{id:\d+}/sessions (cap edit_user on {id})#	A user's sessions, the caller's own marked.
method	`destroyAll(Minn\Http\Request $request, string $id): Minn\Http\Response`DELETE /minn-admin/v1/users/{id:\d+}/sessions (cap edit_user on {id})#	Signs the person out everywhere; a caller acting on themselves keeps the session they are using.
method	`destroy(Minn\Http\Request $request, string $id, string $verifier): Minn\Http\Response`DELETE /minn-admin/v1/users/{id:\d+}/sessions/{verifier:[a-f0-9]{40,64}} (cap edit_user on {id})#	Signs one session out.

Internals 1

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private

target(string $id): int#

The user from the path: the caller themselves, or anyone the caller may edit.