Sessions final readonly class

Minn\Auth\Sessions · public/minn/src/Minn/Auth/Sessions.php · 173 lines

The session_tokens usermeta store: {sha256(token): {expiration, ip, ua, login}}. Read by a bounded scan of the serialized blob and written by serializing it ourselves, so stored data is never executed.

Uses 1

Content\Users

Used by 5

Admin\SessionsController Authenticator Cookie Engine Rest\Services

Constants and properties

private

readonly Minn\Content\Users $users

Promoted from the constructor.

Public

new	`__construct(Minn\Content\Users $users)`#
static	`generateToken(): string`#	A 43-character token; only sha256(token) is ever stored or compared.
method	`isLive(int $userId, string $token): bool`#	Whether a session token is still stored and unexpired for a user.
method	`create(int $userId, int $expiration, string $ip, string $userAgent): string`#	Creates a session, pruning expired ones, and returns the raw token.
static	`plain(string $value): string`#	A request-supplied field (the address, the user agent) as the store keeps it: the store is read back by shape, so it carries nothing that looks like the shape, and no more than 255 characters.
method	`destroyAll(int $userId): void`#	Ends every session of the user (a password change).
method	`destroy(int $userId, string $token): bool`#	Removes one session; true when it existed.
method	`destroyKey(int $userId, string $key): bool`#	Removes the session stored under a key (the sha256 of its token); true when it existed.
method	`destroyOthers(int $userId, string $keepKey): void`#	Ends every session of the user except the one stored under the given key.
method	`read(int $userId): array`#	Every stored session of a user, keyed by token hash. Each entry keeps its stored text under raw, so writing the store back leaves sessions this request did not make exactly as they were, including anything a plugin attached to them. `@return array<string, array{expiration: int, ip: string, ua: string, login: int, raw: string}>`
static	`serialize(array $sessions): string`#	The map in PHP's serialized form: stored entries as they were read, new ones key by key in the order given.

Internals 5

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private parseEntry(string $inner): array#

private prune(array $sessions): array#

private write(int $userId, array $sessions): void#

private

entry(array $entry): string#

One new session: integers for the times, strings for the rest. @param array<string, int|string> $entry

$entry array<string, int|string>

private string(string $value): string#