CapabilityTokenIssuer
in package
Issues a per-request internal token carrying a capability and hands it to {@see ApiBridge::setInternalAuthToken()}.
The session stays the source of truth; the token is only a carrier of the fact "this
visitor proved the password of advert X" from the front end to the API layer. It is
minted again on every request: first from the session record before the advert is loaded
(EditAdvertFormTrait::grantAdvertEditCapabilityFromSession(), so get for editing is not
masked), then again after EditAdvertFormTrait::checkAutorization() has re-verified the
session against the DB. A stale session record opens nothing, because the API compares the
fingerprint with the DB hash itself:
request -> checkAutorization() -> session[advertId, hash, exp] x DB hash
-> grantAdvertEdit() -> new token with caps[] -> ApiBridge
-> internalAction*() -> isOwner() compares caps[].fp with the hash from the DB
IMPORTANT: never persist the capability (session, cookie) and never send the token to
the browser. Two independent DB checks (front session and API isOwner()) make a
password change by the owner revoke access at once; storing the capability would lose it.
IMPORTANT: the identity is not changed. The token inherits userId/role/username
from the current front session, otherwise userId = 0 (guest). An anonymous editor
stays guest (substituting the owner's insertUserId would escalate to a foreign
account); a logged-in user keeps their own owner grants for the rest of the request.
Table of Contents
Properties
Methods
- __construct() : mixed
- grantAdvertEdit() : void
- Issues a token with a capability for one advert and installs it on the bridge.
- baseIdentity() : JwtPayload
- Returns the identity the capability is attached to.
Properties
$apiBridge read-only
private
ApiBridge
$apiBridge
$jwtManager read-only
private
JwtManager
$jwtManager
Methods
__construct()
public
__construct(JwtManager $jwtManager, ApiBridge $apiBridge) : mixed
Parameters
- $jwtManager : JwtManager
- $apiBridge : ApiBridge
grantAdvertEdit()
Issues a token with a capability for one advert and installs it on the bridge.
public
grantAdvertEdit(string $scope, int $advertId, string $passwordHash, int $expiration, string|null $sessionToken) : void
Parameters
- $scope : string
-
JwtCapability::SCOPE_BAZAAR_ADVERT_EDIT /
…COMCAT… - $advertId : int
-
id of the advert the access was proved for
- $passwordHash : string
-
advert password hash from the DB (the one the session just passed against); only its fingerprint enters the token
- $expiration : int
-
time (unix) when the session token expires
- $sessionToken : string|null
-
current access token from the front session (
null= anonymous)
baseIdentity()
Returns the identity the capability is attached to.
private
baseIdentity(string|null $sessionToken) : JwtPayload
Empty (userId = 0, guest) when the session token is missing, expired or cannot be
decoded; nothing smarter is ever substituted.
Parameters
- $sessionToken : string|null