Authenticator final readonly class
Minn\Auth\Authenticator · public/minn/src/Minn/Auth/Authenticator.php · 149 lines
Resolves the current user two ways. A page load carries the cookie alone; a REST call must also carry a nonce bound to the same session.
Constants and properties
| private | NOBODY = '$wp$2y$10$q/tQZiHVAKXuCoJIeZTH0.rb6Otms4vDKv0NrPeGKdvracPiLPy4W' | A real hash of a password nobody knows, checked against when the user does not exist so the answer takes as long either way. |
| private | readonly Minn\Auth\Cookie $cookie | Promoted from the constructor. |
| private | readonly Minn\Content\Users $users | Promoted from the constructor. |
Public
| new | __construct(Minn\Auth\Cookie $cookie, Minn\Content\Users $users)# | ||||
| static | fromDb(Minn\Db $db): self# | An authenticator over the shared database door. | |||
| method | session(array $cookies): Minn\Auth\Authenticated|Minn\Auth\AuthFailure# | The session the cookie jar carries, or why there is none.
| |||
| method | rest(array $cookies, ?string $nonce): Minn\Auth\Authenticated|Minn\Auth\AuthFailure# | The session for a REST call: the cookie, then the nonce. A cookie sent without a nonce is no sign-in at all (the request goes on signed out, as the reference's cookie check makes it); one with a nonce that does not verify is refused (suite auth, checked against the reference).
| |||
| method | restFromRequest(Minn\Http\Request $request): Minn\Auth\Authenticated|Minn\Auth\AuthFailure# | A REST caller: the cookie session with its nonce first; failing that, HTTP Basic credentials carrying an application password, which need no nonce. A wrong Basic pair is reported as not logged in. | |||
| method | applicationPassword(Minn\Http\Request $request): ?Minn\Auth\Authenticated# | The user an Authorization: Basic header's application password unlocks, with the use recorded. | |||
| static | basicCredentials(Minn\Http\Request $request): ?array# | The login and password an Authorization: Basic header carries, or null. @return array{0: string, 1: string}|null | |||
| static | applicationPasswordsAvailable(Minn\Http\Request $request): bool# | Application passwords need HTTPS, unless plugin code says otherwise through the reference's filter. | |||
| static | applicationPasswordsAvailableFor(Minn\Content\UserRecord $user): bool# | Whether Basic auth may sign this user in; the runtime's filter has the last word.
| |||
| method | login(string $username, string $password): ?Minn\Content\UserRecord# | Username and password to a user row, an outdated hash replaced as the sign-in succeeds; no session is created here. |
Nothing matches.