API / Minn\Auth / ApplicationPasswords

ApplicationPasswords final readonly class

Minn\Auth\ApplicationPasswords · public/minn/src/Minn/Auth/ApplicationPasswords.php · 153 lines

Application passwords as the reference stores them: a serialized list in the user's _application_passwords meta, each entry uuid, app_id, name, password (a hash), created, last_used, last_ip. New passwords are 24 characters shown in groups of four; the stored hash is the reference's own ($generic$, FastHash), so a password made on either stack works on the other. Older hashes still verify, as the reference verifies them: phpass (WordPress before 6.8, and the engine before this) and $wp$.

Uses 5

FastHash Password PortableHash Content\Users Support\Serialized

Used by 5

Authenticator Rest\ApplicationPasswordsController Rest\Services Runtime\ApplicationPasswordEvents Runtime\ApplicationPasswordSignIn

Constants and properties

const	`META` = `'_application_passwords'`
private	`readonly Minn\Content\Users $users`	Promoted from the constructor.

Public

new	`__construct(Minn\Content\Users $users)`#
method	`all(int $userId): array`#	Every application password of a user, as stored records without the hash's plain text. `@return list<array<string, mixed>>`
method	`find(int $userId, string $uuid): ?array`#	One record by uuid, or null. `@return array<string, mixed>\|null`
method	`create(int $userId, string $name, string $appId): array`#	Mints a password, stores its hash, and returns the record with the plain text once. `@return array{0: array<string, mixed>, 1: string} the stored record and the one-time plaintext`
method	`rename(int $userId, string $uuid, string $name): ?array`#	Renames one password; null when the uuid is unknown.
method	`touch(int $userId, string $uuid, string $ip): ?array`#	Records a use: the time and the address it came from.
method	`delete(int $userId, string $uuid): ?array`#	Removes one password and returns its record; null when unknown.
method	`deleteAll(int $userId): int`#	Removes every application password of a user and returns how many.
method	`verify(int $userId, string $password): ?array`#	The record a plaintext (spaces ignored) unlocks for the user, or null.
static	`generate(): string`#	Twenty-four letters and digits.
static	`chunked(string $plain): string`#	The plaintext as shown once: groups of four, space separated.

Internals 3

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private	`change(int $userId, string $uuid, array $fields): ?array`#
private	`save(int $userId, array $list): void`#
private	`uuid(): string`#