Auth
in package
Session-based authentication: login, logout, session state, route guarding and CSRF tokens. All methods are static; `Auth::start()` must run before any output.
Table of Contents
Methods
- attempt() : bool
- Verify an email/password pair and, on success, log the user in.
- canManage() : bool
- Whether the logged-in user may manage (edit/delete) a bookmark.
- check() : bool
- Whether a user is currently logged in.
- csrfCheck() : bool
- Validate a submitted CSRF token against the session token.
- csrfToken() : string
- The per-session CSRF token, created on first use.
- guard() : void
- Require an authenticated user; redirect anonymous requests to `/login`.
- id() : int|null
- The logged-in user's id, or null if the request is anonymous.
- logout() : void
- Log the current user out: clear and destroy the session and its cookie.
- start() : void
- Start the session with hardened cookie parameters. Safe to call more than once. Must run before any output is sent.
- user() : array{id: int, username: string, role: string}|null
- The logged-in user's session data, or null if the request is anonymous.
Methods
attempt()
Verify an email/password pair and, on success, log the user in.
public
static attempt(string $email, string $password) : bool
On success the session id is regenerated (to prevent fixation) and the user's id and role are stored in the session.
Parameters
- $email : string
-
Email typed at login (normalised to lower-case here).
- $password : string
-
Plain password typed at login.
Return values
bool —True if the credentials are valid and the user is now logged in.
canManage()
Whether the logged-in user may manage (edit/delete) a bookmark.
public
static canManage(int $owner) : bool
True for the bookmark's owner and for owner/admin roles; false for
anonymous requests.
Parameters
- $owner : int
-
User id of the bookmark's owner.
Return values
boolcheck()
Whether a user is currently logged in.
public
static check() : bool
Return values
boolcsrfCheck()
Validate a submitted CSRF token against the session token.
public
static csrfCheck(string|null $token) : bool
Parameters
- $token : string|null
-
Token from the request (e.g.
$_POST['csrf']).
Return values
bool —True if it matches the current session token.
csrfToken()
The per-session CSRF token, created on first use.
public
static csrfToken() : string
Return values
string —A 64-character hex token.
guard()
Require an authenticated user; redirect anonymous requests to `/login`.
public
static guard() : void
id()
The logged-in user's id, or null if the request is anonymous.
public
static id() : int|null
Return values
int|nulllogout()
Log the current user out: clear and destroy the session and its cookie.
public
static logout() : void
start()
Start the session with hardened cookie parameters. Safe to call more than once. Must run before any output is sent.
public
static start() : void
user()
The logged-in user's session data, or null if the request is anonymous.
public
static user() : array{id: int, username: string, role: string}|null