CoolCMS API

AuthStorageTrait

Admin variant of the auth storage trait.

Uses the admin services (AuthStorageManager, AuthManager, UserManager); a module must not reach into another module. Login is still shared by Front and Admin: both branches work over one shared session entity (AuthSessionStorage, section auth), so a token stored anywhere is valid in admin as well. Only the redirect targets (admin dashboard and admin login) and the flash key prefix (admin.general.*) differ.

Table of Contents

Properties

$accessTokenValidator  : AccessTokenValidator
Signature and expiry alone are not enough: a revoked token (`jti` on the deny-list) that has not expired yet would keep the session logged in although the Api guard rejects the same token. Same contract as {@see \App\Core\Traits\Api\Presenters\JwtAuthTrait::checkJwtAuth()}, one implementation.
$authManager  : AuthManager
$authStorageManager  : AuthStorageManager
$authUserManager  : UserManager
Admin `UserManager` for {@see UserManager::login()}. A module must not read through another module, so admin has its own `login()` that calls the same Api endpoint (`api/system/auth/login`).
$eventDispatcher  : EventDispatcher
$jwtManager  : JwtManager
$loginDeviceCookie  : LoginDeviceCookie
Cookie of a known device for the password login throttle ({@see self::rememberLoginDevice()}).
$isLoggingIn  : bool

Methods

handleLogout()  : void
handleSignOut()  : void
loginWithCredentials()  : void
Logs in with username and password; called only by the login form (after validation and CSRF).
checkAuthentication()  : void
logout()  : void
createIdentity()  : SimpleIdentity|null
expireIdleLogin()  : bool
Returns whether the login expired from inactivity. If so, revokes the tokens (like a logout), clears the `auth` section, logs out the Nette identity and returns true; otherwise moves the activity stamp forward.
getClientIp()  : string
isDevelopment()  : bool
logoutNetteUser()  : void
processFailedLogin()  : void
processInvalidToken()  : void
processLogin()  : void
processLoginException()  : void
processMissingToken()  : void
processSuccessfulLogin()  : void
processValidToken()  : void
readLoginDeviceToken()  : string|null
Returns the raw known-device cookie for the Api login (the Api verifies its signature).
redirectAfterLoginAction()  : void
After a login attempt: a successful login returns to the request remembered before the login (`backlink`, {@see PrivilegeCheckTrait::loginReturnArgs()}), otherwise to the dashboard; a failed one stays on the login page and keeps the way back.
refreshNetteIdentity()  : bool
Refreshes the token of the same logged-in user: identity data (token, name, email) are overwritten in the stored object without `login()`, so neither the session id nor the form CSRF tokens change. The identity is stored in the session section as an object; the change is written at the end of the request.
rememberLoginDevice()  : void
After a successful login (password or OAuth) issues or renews the known-device cookie ({@see LoginDeviceCookie}): a signed proof that this browser has already logged in to the account. The next login sends it to the Api ({@see self::processLogin()}), and above the account limit the password from this browser is still verified, so foreign attempts do not lock out the owner. HttpOnly, SameSite=Lax, Secure on HTTPS; lifetime from `ratelimit.loginDevice.cookieLifetime`.
resolveLoginErrorMessage()  : string
Resolves the flash message of a failed login.
revokeTokensOnLogout()  : void
Calls the Api logout (revokes the refresh family and deny-lists the access `jti`) for the tokens of the current session. Fail-open on purpose: any failure is only logged, because the local logout must not stay unfinished.
setNetteUser()  : void
tryRefresh()  : bool
Tries an auto-refresh for an expired access token. If the session holds a refresh token and the Api accepts it, stores the new pair in the session and returns true; otherwise returns false and the caller cancels the session.

Properties

$accessTokenValidator

Signature and expiry alone are not enough: a revoked token (`jti` on the deny-list) that has not expired yet would keep the session logged in although the Api guard rejects the same token. Same contract as {@see \App\Core\Traits\Api\Presenters\JwtAuthTrait::checkJwtAuth()}, one implementation.

public AccessTokenValidator $accessTokenValidator
Attributes
#[Inject]

$authUserManager

Admin `UserManager` for {@see UserManager::login()}. A module must not read through another module, so admin has its own `login()` that calls the same Api endpoint (`api/system/auth/login`).

public UserManager $authUserManager

The own property name avoids a collision with the generic $userManager from UserTrait (typed to the admin CRUD manager).

Attributes
#[Inject]

$loginDeviceCookie

Cookie of a known device for the password login throttle ({@see self::rememberLoginDevice()}).

public LoginDeviceCookie $loginDeviceCookie
Attributes
#[Inject]

Methods

handleLogout()

public handleLogout() : void
Attributes
#[Requires]
$methods: 'POST'

handleSignOut()

public handleSignOut() : void
Attributes
#[Requires]
$methods: 'POST'

loginWithCredentials()

Logs in with username and password; called only by the login form (after validation and CSRF).

public loginWithCredentials(string $username, string $password[, bool $remember = false ]) : void

IMPORTANT: this must not be named handleLogin(). A handle* method is a public signal of every presenter (?do=login&username=...&password=...): the password could end up in the URL and the server log, and the form token would be bypassed. Nette finds signals by the handle prefix only.

Parameters
$username : string
$password : string
$remember : bool = false

createIdentity()

private createIdentity(array<string, mixed> $payload, string $token) : SimpleIdentity|null
Parameters
$payload : array<string, mixed>
$token : string
Return values
SimpleIdentity|null

expireIdleLogin()

Returns whether the login expired from inactivity. If so, revokes the tokens (like a logout), clears the `auth` section, logs out the Nette identity and returns true; otherwise moves the activity stamp forward.

private expireIdleLogin(AuthSessionStorage $authStorage) : bool

Admin keeps 30 min, or 8 h with its own "remember me", regardless of the front end "remember me" (the auth section is shared, its 31 days do not count here). An expiry in admin logs out of the front end too (one session).

Parameters
$authStorage : AuthSessionStorage
Return values
bool

processLogin()

private processLogin(string $username, string $password[, bool $remember = false ]) : void
Parameters
$username : string
$password : string
$remember : bool = false

processLoginException()

private processLoginException(Exception $e) : void
Parameters
$e : Exception

readLoginDeviceToken()

Returns the raw known-device cookie for the Api login (the Api verifies its signature).

private readLoginDeviceToken() : string|null
Return values
string|null

redirectAfterLoginAction()

After a login attempt: a successful login returns to the request remembered before the login (`backlink`, {@see PrivilegeCheckTrait::loginReturnArgs()}), otherwise to the dashboard; a failed one stays on the login page and keeps the way back.

private redirectAfterLoginAction() : void

refreshNetteIdentity()

Refreshes the token of the same logged-in user: identity data (token, name, email) are overwritten in the stored object without `login()`, so neither the session id nor the form CSRF tokens change. The identity is stored in the session section as an object; the change is written at the end of the request.

private refreshNetteIdentity(array<string, mixed> $payload, string $token) : bool
Parameters
$payload : array<string, mixed>
$token : string
Return values
bool —

false when impossible (nobody logged in or another user); the caller uses login

rememberLoginDevice()

After a successful login (password or OAuth) issues or renews the known-device cookie ({@see LoginDeviceCookie}): a signed proof that this browser has already logged in to the account. The next login sends it to the Api ({@see self::processLogin()}), and above the account limit the password from this browser is still verified, so foreign attempts do not lock out the owner. HttpOnly, SameSite=Lax, Secure on HTTPS; lifetime from `ratelimit.loginDevice.cookieLifetime`.

private rememberLoginDevice(mixed $payload) : void
Parameters
$payload : mixed

resolveLoginErrorMessage()

Resolves the flash message of a failed login.

private resolveLoginErrorMessage(Result $result) : string

IMPORTANT: a brute-force throttle must not be shown as "wrong password"; the limit would then look like an inexplicably failing form.

results.rateLimitExceeded (the generic text of ResultCode) carries no seconds and does not belong to login. The login flow therefore has its own key in the same family as admin.general.login.error.message: login.rateLimit.message, with the seconds passed as %count% (Contributte: numeric 2nd argument).

The Api sends retryAfter in data (AuthPresenter::rateLimitedResult()); the internal bridge call does not see the Retry-After header.

Parameters
$result : Result
Return values
string

revokeTokensOnLogout()

Calls the Api logout (revokes the refresh family and deny-lists the access `jti`) for the tokens of the current session. Fail-open on purpose: any failure is only logged, because the local logout must not stay unfinished.

private revokeTokensOnLogout(AuthSessionStorage $authStorage, mixed $userId) : void
Parameters
$authStorage : AuthSessionStorage
$userId : mixed

setNetteUser()

private setNetteUser(array<string, mixed>|null $payload, string $token) : void
Parameters
$payload : array<string, mixed>|null
$token : string

tryRefresh()

Tries an auto-refresh for an expired access token. If the session holds a refresh token and the Api accepts it, stores the new pair in the session and returns true; otherwise returns false and the caller cancels the session.

private tryRefresh(AuthSessionStorage $authStorage) : bool
Parameters
$authStorage : AuthSessionStorage
Return values
bool
On this page

Search results