CoolCMS API

JwtAuthTrait

Identifies the user on the external Api path (Bearer JWT).

The application key is handled one step earlier by ApiClientKeyTrait; this trait only reads getApiClient() (both traits sit on the same class, the Api BasePresenter).

Table of Contents

Properties

$accessTokenValidator  : AccessTokenValidator
The rule "signature + expiry + `jti` deny-list" has a single implementation ({@see AccessTokenValidator}), shared by this guard and the admin/front `checkAuthentication()`.
$authLogManager  : AuthLogManager
$jtiDenyList  : JtiDenyList
$jwtGuardConfig  : JwtGuardConfig
$jwtManager  : JwtManager
$jwtPayload  : JwtPayload|null

Methods

getJwtPayload()  : JwtPayload|null
setAuthenticatedPayload()  : void
Pre-populate the authenticated payload from a trusted caller (ApiBridge internal mode). Internal calls skip startup() and therefore the Bearer middleware — this setter is how ApiBridge propagates the calling Front user's identity into the Api presenter so internalAction* methods can see it via getJwtPayload().
checkJwtAuth()  : void
isPublicAction()  : bool
Tells whether the current action carries `#[PublicAction]`.
extractBearerToken()  : string|null
reportJwtAuthFailure()  : void

Properties

$accessTokenValidator

The rule "signature + expiry + `jti` deny-list" has a single implementation ({@see AccessTokenValidator}), shared by this guard and the admin/front `checkAuthentication()`.

public AccessTokenValidator $accessTokenValidator
Attributes
#[Inject]

Methods

setAuthenticatedPayload()

Pre-populate the authenticated payload from a trusted caller (ApiBridge internal mode). Internal calls skip startup() and therefore the Bearer middleware — this setter is how ApiBridge propagates the calling Front user's identity into the Api presenter so internalAction* methods can see it via getJwtPayload().

public setAuthenticatedPayload(JwtPayload|null $payload) : void
Parameters
$payload : JwtPayload|null

isPublicAction()

Tells whether the current action carries `#[PublicAction]`.

protected isPublicAction() : bool

IMPORTANT: the visibility is protected (not private) because RbacCheckTrait uses it too: the RBAC gate must evaluate #[PublicAction] exactly like the JWT guard, otherwise the two layers diverge. Single source of truth.

An empty action returns false (fail-closed): "action not recognized" must not mean "public", otherwise a presenter without an action* method would pass without authentication and authorization. On the external HTTP path the action is never empty because ApiRouteFactory defaults the route to 'action' => 'show'; the empty case occurs only in-process or if someone removes that default, and then it ends in 401 (guard) / 403 (gate) instead of a bypass.

Return values
bool

extractBearerToken()

private extractBearerToken() : string|null
Return values
string|null

reportJwtAuthFailure()

private reportJwtAuthFailure(string $reason, string|null $token) : void
Parameters
$reason : string
$token : string|null
On this page

Search results