CoolCMS API

AuthStorageTrait

Table of Contents

Properties

$accessTokenValidator  : AccessTokenValidator
Validates access tokens beyond signature and expiry.
$accountDeletionSessionManager  : AccountDeletionSessionManager
Account deletion — cancel ticket of a sign-in refused while the account awaits deletion.
$authManager  : AuthManager
$authStorageManager  : AuthStorageManager
$eventDispatcher  : EventDispatcher
$jwtManager  : JwtManager
$loginDeviceCookie  : LoginDeviceCookie
"Known device" cookie for the password login throttle ({@see self::rememberLoginDevice()}).
$userManager  : UserManager
$isLoggingIn  : bool

Methods

completeExternalLogin()  : bool
Completes an OAuth login (`LoginExternalComponent`) with the same storage as a password login.
handleLogout()  : void
handleSignOut()  : void
Sign-out from an ordinary link (account menu), also without JavaScript.
loginWithCredentials()  : void
Logs in by username and password; called only by the login form (after validation and CSRF).
redirectToPendingAccountDeletion()  : void
Account deletion: a sign-in (password or OAuth) was refused because the account awaits deletion: keep the cancel ticket in the session and go to the "Account deletion" page, which offers "Cancel the deletion". Without a ticket (should not happen) the visitor gets the plain refusal flash instead.
checkAuthentication()  : void
logout()  : void
createIdentity()  : SimpleIdentity|null
expireIdleLogin()  : bool
Checks whether the login expired from inactivity.
getClientIp()  : string
isDevelopment()  : bool
logoutNetteUser()  : void
processFailedLogin()  : void
processInvalidToken()  : void
processLogin()  : void
processLoginException()  : void
processMissingToken()  : void
processSuccessfulLogin()  : void
processValidToken()  : void
readLoginDeviceToken()  : string|null
Returns the raw known-device cookie for the Api login (the Api verifies its signature).
redirectAfterLoginAction()  : void
Ends a sign-in attempt. A classic (non-AJAX) successful sign-in lands on "My account" ({@see PageId::SYSTEM_USER_ACCOUNT}); a failed one on the home page. An AJAX sign-in stays on the current page and only redraws the flash messages.
refreshNetteIdentity()  : bool
Refreshes the token for the same logged-in user.
rememberLoginDevice()  : void
Issues or renews the "known device" cookie after a successful login (password or OAuth).
resolveLoginErrorMessage()  : string
Resolves the translated login error text.
revokeTokensOnLogout()  : void
Calls the Api logout (revokes the refresh family and deny-lists the access `jti`) for the tokens of the current session.
setNetteUser()  : void
tryRefresh()  : bool
Tries an automatic refresh when the access token has expired.

Properties

$accessTokenValidator

Validates access tokens beyond signature and expiry.

public AccessTokenValidator $accessTokenValidator

A revoked token (jti on the deny-list) that has not expired yet would otherwise keep the session logged in although the Api guard rejects the same token. Same contract as JwtAuthTrait::checkJwtAuth(), one implementation.

Attributes
#[Inject]

$loginDeviceCookie

"Known device" cookie for the password login throttle ({@see self::rememberLoginDevice()}).

public LoginDeviceCookie $loginDeviceCookie
Attributes
#[Inject]

Methods

completeExternalLogin()

Completes an OAuth login (`LoginExternalComponent`) with the same storage as a password login.

public completeExternalLogin(array<string, mixed> $resultData) : bool

IMPORTANT: the whole session section is cleared first and the refresh token from the Api must be stored. Otherwise the user drops out after 15 minutes, and the refresh token of the previous account stays in the section, so tryRefresh() would log account A back in after expiry (shared computer).

Parameters
$resultData : array<string, mixed>

data from the Api loginExternal (token, refreshToken, payload)

Return values
bool

handleSignOut()

Sign-out from an ordinary link (account menu), also without JavaScript.

public handleSignOut() : void

Nette refuses every signal whose request is not same-origin (Sec-Fetch-Site) and redirects to the same URL without do, so a typed or bookmarked ?do=signOut (Sec-Fetch-Site: none) never ran. A user-initiated navigation cannot be forged by another site, so it is allowed here as well; a cross-site request still ends in detectedCsrf().

Attributes
#[Requires]
$sameOrigin: false

loginWithCredentials()

Logs in by username and password; called only by the login form (after validation and CSRF).

public loginWithCredentials(string $username, string $password[, bool $remember = false ]) : void

IMPORTANT: this must not be a handle* method. Nette finds signals by that prefix, so a public handleLogin() would be a signal on every presenter (?do=login&username=…&password=…): the password could end up in the URL and the server log, and the form token would be bypassed.

Parameters
$username : string
$password : string
$remember : bool = false

redirectToPendingAccountDeletion()

Account deletion: a sign-in (password or OAuth) was refused because the account awaits deletion: keep the cancel ticket in the session and go to the "Account deletion" page, which offers "Cancel the deletion". Without a ticket (should not happen) the visitor gets the plain refusal flash instead.

public redirectToPendingAccountDeletion(mixed $resultData) : void
Parameters
$resultData : mixed

createIdentity()

private createIdentity(array<string, mixed> $payload, string $token) : SimpleIdentity|null
Parameters
$payload : array<string, mixed>
$token : string
Return values
SimpleIdentity|null

expireIdleLogin()

Checks whether the login expired from inactivity.

private expireIdleLogin(AuthSessionStorage $authStorage) : bool

If so, it revokes the tokens (like a logout), clears the auth section, logs out the Nette identity and returns true; otherwise it moves the activity stamp. The limit is 30 minutes without "remember me", 31 days with it (AuthSessionStorage::isIdleExpired()).

Parameters
$authStorage : AuthSessionStorage
Return values
bool

processLogin()

private processLogin(string $username, string $password[, bool $remember = false ]) : void
Parameters
$username : string
$password : string
$remember : bool = false

processLoginException()

private processLoginException(Exception $e) : void
Parameters
$e : Exception

readLoginDeviceToken()

Returns the raw known-device cookie for the Api login (the Api verifies its signature).

private readLoginDeviceToken() : string|null
Return values
string|null

redirectAfterLoginAction()

Ends a sign-in attempt. A classic (non-AJAX) successful sign-in lands on "My account" ({@see PageId::SYSTEM_USER_ACCOUNT}); a failed one on the home page. An AJAX sign-in stays on the current page and only redraws the flash messages.

private redirectAfterLoginAction([bool $succeeded = false ]) : void
Parameters
$succeeded : bool = false

refreshNetteIdentity()

Refreshes the token for the same logged-in user.

private refreshNetteIdentity(array<string, mixed> $payload, string $token) : bool

The identity data (token, name, email) are overwritten in the stored object without login(), so neither the session ID nor the form CSRF tokens change. The identity lives in the session section as an object and the change is written at the end of the request.

Parameters
$payload : array<string, mixed>
$token : string
Return values
bool —

false when not possible (nobody logged in or another user), the caller then uses login

rememberLoginDevice()

Issues or renews the "known device" cookie after a successful login (password or OAuth).

private rememberLoginDevice(mixed $payload) : void

The cookie (LoginDeviceCookie) is a signed proof that this browser has already logged in to the account. The next login sends it to the Api (self::processLogin()), so above the account limit the password from this browser is still verified and foreign attempts do not lock the owner out. HttpOnly, SameSite=Lax, Secure on HTTPS; lifetime ratelimit.loginDevice.cookieLifetime.

Parameters
$payload : mixed

resolveLoginErrorMessage()

Resolves the translated login error text.

private resolveLoginErrorMessage(Result $result) : string

IMPORTANT: a throttle by the brute-force gate must not be shown as "wrong password"; the limit would then look like an inexplicably failing form. The generic results.rateLimitExceeded carries no seconds and does not belong to login, so the login flow has its own key login.rateLimit.message (same family as front.general.login.error.message), with the seconds passed as %count% (Contributte: numeric second argument).

The Api sends retryAfter in data (AuthPresenter::rateLimitedResult()); the internal bridge call does not see the Retry-After header.

Parameters
$result : Result
Return values
string

revokeTokensOnLogout()

Calls the Api logout (revokes the refresh family and deny-lists the access `jti`) for the tokens of the current session.

private revokeTokensOnLogout(AuthSessionStorage $authStorage, mixed $userId) : void

Deliberately fail-open: any failure is only logged, because the local logout must not stay unfinished.

Parameters
$authStorage : AuthSessionStorage
$userId : mixed

setNetteUser()

private setNetteUser(array<string, mixed>|null $payload, string $token) : void
Parameters
$payload : array<string, mixed>|null
$token : string

tryRefresh()

Tries an automatic refresh when the access token has expired.

private tryRefresh(AuthSessionStorage $authStorage) : bool

If the session holds a refresh token and the Api accepts it, the new pair is stored in the session and true is returned; otherwise false, and the caller drops the session.

Parameters
$authStorage : AuthSessionStorage
Return values
bool
On this page

Search results