CoolCMS API

UserManager extends Manager

in package

• Application

uses SaveTrait, AssetTrait, RatingThreadCreatorTrait, OwnedThreadDeleteTrait, CountryCodeDerivationTrait, UserAccountDeletionTrait, UserReferralTrait, UserContentRewardTrait

Base class of Api managers whose traits delegate to a typed `Service<TEntity>`.

Tags

xtends

BaseManager<User>

extends

Table of Contents

Constants

ACCOUNT_DELETION_PAGE_SLUG  : int = \App\Core\Routers\PageId::SYSTEM_ACCOUNT_DELETION

Page "Account deletion" (`Page:form` with the `accountDeletion` component) — target of the e-mailed links.

CONTENT_REWARD_ACTIONS  : array<string|int, mixed> = [self::CONTENT_REWARD_BAZAAR_ADVERT, self::CONT...

Actions rewarded for content, in the order of the admin screen.

CONTENT_REWARD_BAZAAR_ADVERT  : string = 'bazaarAdvert'

CONTENT_REWARD_COMCAT_ADVERT  : string = 'comcatAdvert'

CONTENT_REWARD_DISCUSSION_MESSAGE  : string = 'discussionMessage'

CONTENT_REWARD_SKIP_MONTHLY_CAP  : string = 'monthly_cap'

CONTENT_REWARD_SKIP_USER_INACTIVE  : string = 'user_inactive'

PROFILE_REWARD_ACTION  : string = 'profileComplete'

Complete profile: once per account, `subject_id` = the user's own id.

REFERRAL_SKIP_DISABLED  : string = 'disabled'

REFERRAL_SKIP_MONTHLY_CAP  : string = 'monthly_cap'

REFERRAL_SKIP_REFERRER_INACTIVE  : string = 'referrer_inactive'

REFERRAL_SKIP_SAME_IP  : string = 'same_ip'

DELETED_IDS_META  : string = '__deletedIds'

Reserved `$meta` key with the ids of the entities being deleted, captured before the first hook.

LOST_PASSWORD_PAGE_SLUG  : int = \App\Core\Routers\PageId::SYSTEM_LOST_PASSWORD

Page "Lost password" (`Page:form` with the `lostPasswordForm` component) — target of the reset link.

Properties

$service  : Service<string|int, TEntity>

Manager service; subclasses narrow the type (`@property` in the Api/Admin/Front manager).

$appContext  : AppContext

$assetFormatRegistry  : AssetFormatRegistry|null

Format processor registry for file uploads, used by {@see \App\Core\Traits\Api\Models\Managers\AssetProcessingTrait}.

$blacklistManager  : BlacklistManager|null

Blacklist check of a new account ({@see blacklistRefusal()}). A plain property with a default, not a promoted one: unit tests build the manager without the constructor and the check is then skipped.

$cacheTagInvalidator  : CacheTagInvalidator|null

Post-commit invalidator of the wire-payload query cache (tag bump per entity class).

$defaultSkipFields  : array<string|int, string>

Privilege escalation guard. `User.userRoles` is many-to-many (the hydrator always does clear+add), so a client could assign roles through `data.userRoles` regardless of the admin path (`meta['roleIds']` handled by `UserRelationManager::syncRoles()` in `afterSave()`). Skipping the field makes `meta['roleIds']` the only way to change roles.

$emailManager  : EmailManager

$internalCallContext  : InternalCallContext|null

Tells whether the call is an internal bridge call; the single source for reading uploaded items with `path` ({@see readUploadedItem()}).

$languageContext  : LanguageContext|null

$nonInvalidatingColumns  : array<string|int, string>

Columns whose update does not invalidate the cache: view counters (`registerEvent()` bumps the counter on every pageview). Without this every view would flush the query cache of the whole class; counters are therefore stale up to the TTL. Override per manager by redefining the property.

$paramsConfig  : Config|null

Neon parameters (`%params%`: server paths and directories), set by the decorator (`decorators.neon`) like `setAppContext()`.

$presenterContext  : PresenterContext

$settingContext  : SettingContext

$totalCount  : int|null

$useTransactionForDelete  : bool

$useTransactionForSave  : bool

$banStateListeners  : UserBanStateListenerRegistry|null

$countryManager  : CountryManager

$fieldAudienceContext  : FieldAudienceContext|null

$passwordHasher  : PasswordHasher

$paymentRegionManager  : PaymentRegionManager

$permissionResolver  : PermissionResolver|null

$ratingThreadManager  : RatingThreadManager

$rejectedUploads  : array<int, array{name: string, reason: string}>

New uploaded items that the Api did not save during the `save()` that is running right now (type, dimensions, unreadable, …). Filled by {@see recordRejectedUpload()} and returned in `saveInfo.rejectedUploads`.

$userRefreshTokenManager  : UserRefreshTokenManager

$userRelationManager  : UserRelationManager

$userService  : UserService

$vatIdAutoCheckManager  : VatIdAutoCheckManager

$vatIdCheckManager  : VatIdCheckManager

Methods

__construct()  : mixed

activateUser()  : Result

Activates an account from the e-mailed link.

anonymizeAccountRow()  : Result

Wipes the personal data of the account row (the row stays — orders, documents and posts refer to it). Placeholder e-mail/username free the originals for a new registration, the password becomes unusable, the account inactive; sessions are revoked and deleted.

cancelAccountDeletion()  : bool

Compare-and-set cancel of the pending request the caller has read. `false` = refused (anonymized, claimed by a running anonymization, cancelled or requested again in the meantime) — nothing was written.

claimAccountDeletion()  : bool

Atomic claim of the pending request the caller has just read (time + nonce). Only the run that gets `true` may take irreversible steps; it then owns the account by `$claimNonce` ({@see self::holdsAccountDeletionClaim()}).

createFromExternalLogin()  : Result

Creates a user from an external (OAuth) login; called from {@see \App\UI\Api\System\Presenters\AuthPresenter::internalActionLoginExternal()}.

creditPoints()  : void

Credits loyalty points of an order and recomputes the discount band (owner of `cms_system_users` and `cms_system_user_discount_levels`).

debitCreditsForPayment()  : CreditDebitOutcome

Atomically debits the price of a credit payment, at most once per payment (credit payment gateway), see {@see \App\UI\Api\System\Models\Repositories\Db\UserRepository::debitCreditsForPayment()}.

delete()  : Result

Refuses to delete the caller's own account and the last active holder of a protected role (`protect_last_holder`, currently the administrator), for a grid row, a bulk delete (the whole batch is refused, nothing is deleted) and a direct Api call.

deleteAll()  : Result

Same gate for deleting by filters, applied to the ids the filter selects.

deliverAccountDeletionConfirm()  : Result

`SY_ACCOUNT_DELETION_CONFIRM` — an account without a password confirms its deletion request by this link.

deliverAccountDeletionRequested()  : Result

`SY_ACCOUNT_DELETION_REQUESTED` — "your account will be deleted on the scheduled date, if it was not you, cancel it: <link>". The only place the plain cancel token leaves the server.

deliverActivationEmail()  : Result

Sends `SY_USER_ACTIVATION` to one specific (inactive) account, without a lookup by name.

deliverExternalLinkConfirmation()  : Result

E-mails the owner of a password account the one-time link that confirms pairing it with the provider identity (`SY_EXTERNAL_LINK_CONFIRM`). The token is already stored (hashed) by {@see UserExternalLoginManager::requestLinkConfirmation()}; this is the only place the plain token leaves the server.

emailExists()  : bool

Whether the e-mail is already used by another user (than `$excludeId`).

find()  : T|null

findAll()  : T> : list>)

findBy()  : T|null

findEmailsByIds()  : array<int, string>

Batch lookup of e-mails by user id (owner of `cms_system_users`).

findFresh()  : User|null

Current row straight from the DB (bypasses the query cache) — for one-time token flows.

findRelatedIds()  : array<int, int>|null

Returns the ids of target entities that already belong to the record `$parentId` through the relation collection `$property` (for example `('assetRels', 'asset')`, `('fileRels', 'file')`). Reads straight from the database, not through the Api read path (no `UoW::clear()` in the middle of save hooks).

findRoleNames()  : array<int, string>

Returns role names of the user for the informational `role` JWT claim (login, token refresh, new pair after a password change, OAuth). The claim is not a source of permissions; {@see PermissionResolver} decides fresh from the DB.

generateNewPassword()  : Result

Admin/internal password regeneration.

getAccountDeletionGraceDays()  : int

Grace period from the setting `account.deletion.graceDays` (module 1), default 7 days.

getAppContext()  : AppContext

getContentRewardCredits()  : int

Credits of the action; 0 = the action is not rewarded (also for an unknown action).

getDefaultSkipFields()  : array<string|int, string>

Returns keys that the generic `service->save()` must not copy onto the managed entity.

getEntityClass()  : TEntity>

Returns the root Doctrine entity class managed by this manager.

getExternalMetaAllowlist()  : array<string|int, string>

Returns the meta keys allowed through the external HTTP path ({@see \App\Core\Traits\Api\Presenters\SaveTrait::actionSave()}).

getExternalOwnerData()  : array<string, mixed>

Returns `data` keys that fill the owner from the server when an external save creates a record.

getExternalRemoteIpData()  : array<string, mixed>

Returns `data` keys that fill the caller's IP from the server when an external save creates a record; sibling of {@see getExternalOwnerData()}.

getExternalUpdateColumnsAllowlist()  : array<string|int, string>

Returns the columns the external HTTP path may change through {@see \App\Core\Traits\Api\Presenters\SaveTrait::actionUpdateColumns()}.

getGraphDataKeys()  : array<string|int, string>

Returns the keys an external client may send nested in `data`.

getLanguageContext()  : LanguageContext|null

getPresenterContext()  : PresenterContext

getReferralOverview()  : array{enabled: bool, code: ?string, registered: int, activated: int, credits: int, rewardCredits: int}

Referral data of the user for the "My account" page.

getReferralRewardCredits()  : int

Credits of the referral reward; 0 = the affiliate program is off.

getServiceClass()  : class-string

Returns the fully qualified service class name, the identity for the per-service rollout allowlist of the wire-payload query cache ({@see \App\Core\Cache\Config::isServiceEnabled()}).

getSettingContext()  : SettingContext

getSettings()  : array<int, array<string, mixed>>

getTotalCount()  : int|null

holdsAccountDeletionClaim()  : bool

Whether the run still owns the account (claim not lost).

initializeAllContexts()  : void

isOwnedBy()  : bool

Whether `$id` is the caller's own account.

isSignInAllowedNow()  : bool

Fresh scalar check of the stored row right before tokens are handed out.

registerEvent()  : Result

resetPassword()  : Result

Sets a new password from the "lost password" link.

rewardCompletedProfile()  : void

Marks the first complete profile of the account (one-way flag `profile_completed_at`) and pays `reward.profileComplete.credits` at that moment. Called after every user save and after the account activation.

rewardPublishedContent()  : void

Pays the credits of the action to the author of a record that has just been published. Safe to call repeatedly for the same record (each save, moderation toggle or payment): only the first call records a decision.

save()  : Result

sendActivationEmail()  : Result

sendNewPassword()  : Result

Whole "lost password" flow in one place.

setAppContext()  : $this

setAssetFormatRegistry()  : static

setCacheTagInvalidator()  : static

setInternalCallContext()  : static

setLanguageContext()  : $this

setParamsConfig()  : static

setPresenterContext()  : $this

setSettingContext()  : $this

updateAllRelations()  : Result

updateColumn()  : Result

updateColumns()  : Result

IMPORTANT: `updateColumns()` does not run the save hooks (see `Core\Traits\Api\Models\Managers\SaveTrait`). Without this override a ban through the API would not cancel sessions and the sign-in gate could be bypassed by waiting for a token refresh. The `banned` column is writable through the API (`#[UpdatableColumn]`), so this path is real.

updateOwnPassword()  : Result

Changes the password of the caller's own account.

updatePasswordForUser()  : Result

Changes the password of another account: admin and system paths (currently the lazy rehash in {@see \App\UI\Api\System\Presenters\AuthPresenter::internalActionLogin()}).

updateRelations()  : Result

usernameExists()  : bool

Whether the username is already used by another user (than `$excludeId`).

afterSave()  : Result|null

beforeSave()  : Result|null

beginRejectedUploads()  : array<int, array{name: string, reason: string}>

Starts a save ({@see save()}): the list of rejected items belongs to this save only; the outer one (a nested save of the same manager) is returned to the caller and restored after the save through {@see finishRejectedUploads()}.

bumpCacheTags()  : void

Bumps cache tags for the entity after commit: its class, the owned-cascade classes from metadata and the optional `additionalCacheTags()` of the manager.

bumpCacheTagsExplicit()  : void

Bumps the given classes explicitly (raw-DBAL paths with a cross-entity effect).

bumpCacheTagsForClass()  : void

Bumps cache tags by class name when there is no instance (bulk delete, `updateColumns()`, raw DBAL, tree operations).

classCacheTags()  : array<string|int, string>

Returns extra tags for a bump that has no entity, typically tree operations ({@see \App\Core\Traits\Api\Models\Managers\TreeTrait::treeTransaction()}) that rewrite `lft`/`rgt` on many rows.

completedSave()  : void

Automatic VAT id check after a registration (`$meta['verifyVatId']`, sent by the Front registration form). Post-commit and best effort (SaveTrait `completedSave`): the registered account stays even when VIES is down, and the up to 3 s VIES call does not hold the save transaction. The registering visitor has no identity yet, so the Front cannot ask `VatIdCheck:verify` itself; the per-IP safety cap applies.

createRatingThread()  : Result|null

Creates a new {@see RatingThread} of the given section and writes its id into `$column` of the entity `$entityId` (default `ratingThreadId`, a scalar FK; pass the association name for an association). Returns a failed {@see Result} (the caller may return it from `afterSave` to roll back), or null.

deleteAsset()  : void

Deletes an asset file by its absolute path.

deleteOwnedThreads()  : Result|null

deriveCountryText()  : Result|null

finishRejectedUploads()  : void

Ends a save: whatever {@see recordRejectedUpload()} wrote during it is added to the data of a successful result as `saveInfo.rejectedUploads` (the Api presenter passes it on to the caller, the admin builds a warning from it). A rejected item does not fail the save; the accepted files stay.

getDeletedId()  : int|null

Returns the id `$entity` had before the delete, from the snapshot in `$meta` that {@see delete()} hands to every hook. Null for an entity the snapshot does not know (not loaded by this delete, or without a simple id).

getService()  : Service<string|int, TEntity>

Returns the service backing the manager traits.

ownedThreadIds()  : array{comment: list, rating: list}

Reads the thread ids from the entities preloaded before the delete (`getCommentThreadId()` / `getRatingThreadId()`).

readUploadedItem()  : string|null

Reads the content of an uploaded item (`{name, data}` base64 or `{name, path}` from the dropzone) through the single reader {@see UploadedItem}.

recordRejectedUpload()  : void

Records a new uploaded item that the save skipped ({@see UploadRejection} `REASON_*`).

saveAsset()  : string|null

Saves one base64 image; `null` means the image did not pass {@see ImageUploadPolicy}.

saveAssets()  : array<int, string>

Saves base64 images into a directory, raster images only, per {@see ImageUploadPolicy}.

assignReferralCode()  : void

attachReferrerByCode()  : void

Links a new account to the owner of the referral code. An unknown, malformed or own code is ignored; the registration itself always goes on.

blacklistRefusal()  : Result|null

A new account of a non-privileged caller (front registration, another client) is refused when its e-mail, phone or registration IP (`meta.ip`, sent by the front; external meta is stripped) is on the blacklist. The front form checks the same values first and reports them at the fields; this is the gate for every other path ({@see BlacklistManager::refusalFor()} skips the administrator).

buildAccountDeletionLink()  : string|null

bumpDeleteCacheTags()  : void

Post-commit bump after a delete. With entities it goes through {@see \App\Core\Base\BaseManager::bumpCacheTags()}, which also collects `additionalCacheTags()` (Comment → CommentThread); without them it falls back to bumping the manager class itself, the original behavior.

callerCanSetRoles()  : bool|null

Whether the caller may set roles (`:Api:System:User:setRoles`). `null` means the audience was not resolved (cron/CLI calls the manager directly); internal code without a caller is not checked. The identity comes only from the Api gate ({@see FieldAudienceContext}), never from data. Fail-closed without the resolver.

captureDeletedIds()  : WeakMap<object, int>

Keys the ids by the loaded entity objects, not by the input ids: an input id that loaded nothing must not shift the pairing. A weak map, so the snapshot never keeps an entity alive.

changedContactBlacklistRefusal()  : Result|null

Profile edit: a non-privileged caller may not change the e-mail or phone to a blacklisted value. Only the changed values are checked, so an account whose current value was blacklisted later can still save the rest.

columnsInvalidateCache()  : bool

contentRewardSince()  : DateTimeImmutable|null

Moment the reward of the action was switched on; null = never (nothing is rewarded).

contentRewardSkipReason()  : string|null

deactivatesAccount()  : bool

Whether `updateColumns` writes a state in which the account stops being active.

deleteBatch()  : Result

Bulk delete of a list of ids as one transaction. `Service::deleteAll()` flushes per entity; in autocommit the rows deleted before a database failure would stay deleted while the caller got either an escaped `EntityManagerClosed` or an "OK" with an error text. Here the service stops at the technical failure, this wrapper rolls the whole batch back and returns the failure Result with `deletedCount = 0` and `rolledBack = true`: nothing of the batch is durable and nothing is attempted over the closed EntityManager. A domain partial success (missing ids) keeps the existing contract and is committed.

deliverPasswordResetLink()  : Result

Generates and stores the token and sends `SY_LOST_PASSWORD` with the link to one specific account.

derivePaymentRegionLink()  : Result|null

`regionId` is derived from the payment region; the front and the admin form fill it in themselves and never offer it separately. An external `save` could send one that does not match the payment region, so it is always aligned here, whatever path or value the caller used: - no payment region: both are null (same as the front when no region is found), - an unknown payment region: an error (otherwise the save would fail on the FK).

fieldTakenByOther()  : bool

findByUsernameOrEmail()  : User|null

Finds an account by username or e-mail; the single implementation, shared by {@see self::sendActivationEmail()} and {@see self::sendNewPassword()}.

getUserImageDir()  : string

guardedDeactivation()  : Result

guardedDelete()  : Result

invalidateCredentialsAfterPasswordChange()  : Result

After a password change by a path other than the own change or reset (admin, {@see self::generateNewPassword()}): invalidates all refresh tokens and issued access tokens of the account (same method and reason as {@see self::updateOwnPassword()}) and clears a pending "lost password" link.

isActiveState()  : bool

Whether the account stays active after saving in the sense of protected roles (can sign in).

isAssetPathAllowed()  : bool

Checks only entities composing {@see AssetPathTrait}; the trait is the allowlist of "relative file path" columns, other `assetPath`-like fields are untouched.

issueActivationLink()  : string|null

Generates a new activation key, stores its sha256 and expiry (72 h) and returns the link with the readable key (the only place the readable key exists). Returns `null` when the account has no id or e-mail, no presenter is available for the link, or the key could not be stored.

loadEntitiesForCacheTags()  : array<int, object>

Loads the entities being deleted only to find out their `additionalCacheTags()`. Fail-soft: what cannot be loaded is simply missing and the bump falls back to the class; it must never stop the delete.

notifyBanState()  : void

Tells the content modules the resulting ban state of the account (idempotent, like {@see revokeSessionsIfBlocked()}); they hide or restore the user's public content.

onboardNewAccount()  : void

Steps after a new account got its code: links the referrer and, for an account already active, pays the rewards right away. Fail-open.

positiveIds()  : array<int, int>

processAvatar()  : Result|null

referralSkipReason()  : string|null

resolveAvatarAbsPath()  : string|null

Converts the stored relative avatar path to an absolute disk path.

restoreTokenIfStillIssued()  : void

Called when the e-mail with the new link was not queued, so the user holds only the previous one: restores the previous hash and expiry. Conditional: only while the row still carries the hash issued here, so a concurrent successful resend (another hash) is not overwritten. `$previous` comes from the state loaded from the DB before issuing (Api `findBy`/`find` reads the DB, not the query cache).

revokeSessionsIfBlocked()  : void

Invalidates all refresh tokens of a blocked account. It deliberately looks only at the resulting state, not at the transition: this is idempotent (re-saving a banned account has nothing to revoke) and avoids needing the previous value, which the Doctrine identity map may already have overwritten.

rewardActivatedAccount()  : void

Registration bonus for the account and the reward for its referrer, once the account is active.

roleChangeRefusal()  : Result|null

Applies the role and account state gates ({@see UserRolePolicy::assignmentRefusal()}, {@see UserRolePolicy::lastHolderRefusal()}) to data from the DB.

rollbackBatch()  : void

saveWithHooks()  : Result

Runs the save itself: transaction, `beforeSave` / `afterSave` / `completedSave`, tree, cache.

sendAccountDeletionEmail()  : Result

sendRegistrationEmails()  : void

updateColumnsTargetIds()  : array<int, int>

Returns account ids from the `updateColumns` argument (an id, a list of ids, or rows `[0 => id, …]`).

userTypeDataRefusal()  : Result|null

The user type may require company data (reg. id and company name) and the VAT id (`requires_company_data`, `requires_vat_id`); the front forms (registration, profile) require them, a direct Api save did not. Only a non-privileged caller is checked (the administrator may save an incomplete account), and only when the save carries the user type.

usesAssetPathTrait()  : bool

writePassword()  : Result

The only password write implementation; the public variants above differ only in contract.