ApiClientKeyHandover
in package
Hands the readable application key from a POST request (client creation, new key) over once to the next page after the redirect.
reason decides where the key is shown: REASON_CREATED (application created) goes to
the application list, REASON_ISSUED (another key) to the keys page of that application.
Each page takes only its own record (take() with $reason / $clientId) and leaves
foreign ones in place so they are not lost.
Why a session: the admin saves with PRG, so it always redirects after a write. The key must
not appear in the URL (redirect parameter, history, Referer, access log) or in a flash message
(flash is translated as a key and a missing translation is logged). The session is server-side
and the record is deleted on the first read (take()), so a page refresh does not show
the key again. A record never taken (the browser did not finish the redirect) expires after
EXPIRATION.
IMPORTANT: the SESSION_KEY variable name is also listed in Tracy keysToHide (presenter);
without it the key would leak into the exception log.
Static methods over a passed section, no service: the private constructor keeps it out of DI search.
Table of Contents
Constants
- EXPIRATION : string = '10 minutes'
- REASON_CREATED : string = 'created'
- REASON_ISSUED : string = 'issued'
- SESSION_KEY : string = 'issuedApiKey'
- SESSION_SECTION : string = 'admin.apiClient.keyHandover'
Methods
- store() : void
- Stores the key for a one-time display, overwriting any record not taken yet.
- take() : array{clientId: int, clientName: string, key: string, reason: string}|null
- Returns the key and deletes it from the session, so a second read returns `null`. A record of invalid shape is deleted too. With `$reason` / `$clientId` only a matching record is returned; another one stays in the session for the page it belongs to.
- __construct() : mixed
Constants
EXPIRATION
public
string
EXPIRATION
= '10 minutes'
REASON_CREATED
public
string
REASON_CREATED
= 'created'
REASON_ISSUED
public
string
REASON_ISSUED
= 'issued'
SESSION_KEY
public
string
SESSION_KEY
= 'issuedApiKey'
SESSION_SECTION
public
string
SESSION_SECTION
= 'admin.apiClient.keyHandover'
Methods
store()
Stores the key for a one-time display, overwriting any record not taken yet.
public
static store(SessionSection $section, int $clientId, string $clientName, string $key, string $reason) : void
Parameters
- $section : SessionSection
- $clientId : int
- $clientName : string
- $key : string
- $reason : string
take()
Returns the key and deletes it from the session, so a second read returns `null`. A record of invalid shape is deleted too. With `$reason` / `$clientId` only a matching record is returned; another one stays in the session for the page it belongs to.
public
static take(SessionSection $section[, string|null $reason = null ][, int|null $clientId = null ]) : array{clientId: int, clientName: string, key: string, reason: string}|null
Parameters
- $section : SessionSection
- $reason : string|null = null
- $clientId : int|null = null
Return values
array{clientId: int, clientName: string, key: string, reason: string}|null__construct()
private
__construct() : mixed