EditorAutosaveScope
in package
FinalYes
Opaque per-user scope for the client-side TinyMCE autosave draft (`localStorage`).
IMPORTANT: without it all admins in the same browser and URL share one key (the default TinyMCE
autosave_prefix uses path, query, hash and editor id, not the user identity). After A signs out
and B signs in within the same profile, B could load A's unsaved content through "Restore last draft".
The scope is an HMAC of the user id with the same app secret as the JWT (%jwt.secret%, see
config/Shared/jwt.neon), not the bare id. The client must not be able to tell which user is
signed in; it is defense in depth and consistent with the rest of the client contract, which
never sends raw user primary keys.
Table of Contents
Properties
- $secret : string
Methods
- __construct() : mixed
- forUser() : string|null
Properties
$secret read-only
private
string
$secret
Methods
__construct()
public
__construct(string $secret) : mixed
Parameters
- $secret : string
forUser()
public
forUser(int|null $userId) : string|null
Parameters
- $userId : int|null