SignIn final readonly class

Minn\Auth\SignIn · public/minn/src/Minn/Auth/SignIn.php · 65 lines

The door itself: what a sign-in surface needs beyond checking a password. Sessions are minted here, the three cookies ride out on the response, and the failure counter behind the throttle is kept in one place with the session store and the cookie jar it protects.

Uses 6

AuthCookies Authenticated LoginThrottle Content\UserRecord Http\Request Http\Response

Used by 2

Engine Login\LoginController

Constants and properties

private	`readonly Minn\Auth\AuthCookies $cookies`	Promoted from the constructor.
private	`readonly Minn\Auth\LoginThrottle $throttle`	Promoted from the constructor.

Public

new	`__construct(Minn\Auth\AuthCookies $cookies, Minn\Auth\LoginThrottle $throttle)`#
method	`retryAfter(string $address): ?int`#	Seconds this address must wait before another attempt, or null when it may try now.
method	`recordFailure(string $address): void`#	Counts one failed attempt from an address.
method	`hash(): string`#	The cookie-name hash the sign-in cookies, the postpass cookie, and the reset cookie share.
method	`establish(Minn\Http\Response $response, Minn\Content\UserRecord $user, Minn\Http\Request $request): Minn\Http\Response`#	Signs a user in for two days: a new session, and the response with the cookies attached for the browser session.
method	`remember(Minn\Http\Response $response, Minn\Content\UserRecord $user, Minn\Http\Request $request): Minn\Http\Response`#	Signs a user in for fourteen days, the cookies kept past the browser session: "remember me", and the one-time login link.
method	`end(Minn\Http\Response $response, Minn\Auth\Authenticated $session): Minn\Http\Response`#	Ends one session and clears the cookies from the response, unless send_auth_cookies says not to (AuthCookies::clearing).
method	`endAll(Minn\Http\Response $response, int $userId): Minn\Http\Response`#	Ends every session of a user (a password reset) and clears the cookies from the response.
method	`clear(Minn\Http\Response $response): Minn\Http\Response`#	The response with the sign-in cookies cleared.

Internals 1

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private

open(Minn\Http\Response $response, Minn\Content\UserRecord $user, Minn\Http\Request $request, int $days): Minn\Http\Response

A session longer than the two-day default is one to keep past the browser session, as the reference's remember-me does.