CoolCMS API

AuthPresenter extends BasePresenter

in package

• Application

uses GetTrait, GetByTrait, GetAllTrait, SendActivationEmailTrait

Table of Contents

Constants

SESSION_SUBSECTION  : mixed = 'auth'

CALLER_TIER_PRIVILEGED  : string = 'privileged'

Caller tier: `privileged` means the grant for this key came from a role with `privileged = 1`; `user` means anything else (`guest`, `registrated`, `owner`) and is also the fail-closed default of all error branches.

CALLER_TIER_USER  : string = 'user'

SESSION_NAMESPACE  : mixed = 'api'

CALLER_BACKTRACE_LIMIT  : int = 14

Depth of `debug_backtrace()` when looking for `caller=` (a limit, not the whole stack).

CALLER_SKIPPED_PATHS  : array<string|int, mixed> = [ // The Api layer itself. 'app/Core/Traits/Api...

Path prefixes (relative to the project root) skipped when looking for `caller=`.

TIMING_DUMMY_HASH  : mixed = '$2y$12$Z3.QA3djXfoFYEpfdVwH6eOzffBWtA4S2t8GPKu...

Bcrypt hash without an account; only evens out the response time of an unknown account with an existing one.

Properties

$accessTokenValidator  : AccessTokenValidator

The rule "signature + expiry + `jti` deny-list" has a single implementation ({@see AccessTokenValidator}), shared by this guard and the admin/front `checkAuthentication()`.

$accountDeletionManager  : AccountDeletionManager

Account deletion: sign-in of an account awaiting deletion is refused with the date and a cancel ticket. Property injection keeps the constructor stable for the tests that build the presenter.

$allowedMethods  : array<string|int, mixed>

$apiClientContext  : ApiClientContext

IMPORTANT: access only through {@see self::apiClientContext()}. A presenter built outside DI (unit tests) lacks it, and reading an uninitialized typed property throws `Error`.

$apiClientKeyConfig  : ApiClientKeyConfig

$apiClientManager  : ApiClientManager

$apiClientRateLimiter  : ApiClientRateLimiter

$apiRbacConfig  : ApiRbacConfig

$authLogManager  : AuthLogManager

$corsConfig  : CorsConfig

$currencyContext  : CurrencyContext

$currencyManager  : CurrencyManager

$fieldAudienceContext  : FieldAudienceContext

Audience of the caller for the emit filter ({@see \App\Core\Attributes\Hydration\FieldAccess}).

$jtiDenyList  : JtiDenyList

$jwtGuardConfig  : JwtGuardConfig

$jwtManager  : JwtManager

$lang  : int|string|null

$languageContext  : LanguageContext

$languageManager  : LanguageManager

$localizationContext  : LocalizationContext

$localizationManager  : LocalizationManager

$localizationPaymentRegionManager  : PaymentRegionManager

NOTE: deliberately named differently; presenters often have `$paymentRegionManager` in the constructor (property collision).

$loginDeviceCookie  : LoginDeviceCookie

Verifies the "known device" cookie passed in by Front/Admin ({@see self::internalActionLogin()}). Property injection for the same reason as above.

$operationScope  : OperationScope

Boundary of one Api operation (see {@see self::operation()}).

$pageManager  : PageManager

$permissionResolver  : PermissionResolver

$personalDataPolicy  : PersonalDataPolicy

Personal data policy applied to the output (see {@see self::sendJson()}).

$presenterContext  : PresenterContext

$queryCache  : QueryCache

$queryPathPolicy  : QueryPathPolicy

Policy for field paths in filters and ordering (see {@see self::rejectForbiddenQueryPaths()}).

$securityConfig  : SecurityConfig

$settingContext  : SettingContext

$settingManager  : SettingManager

$debugMode  : bool

$manager  : Manager|null

$productionMode  : bool

$anonymousDenyReported  : array<string, true>

$callerTierReported  : array<string, true>

Dedup of `API_COLTIER` lines within one request. The key is `kind|rbac key|tier|userId|field|caller`, so only a literally identical line is dropped; a different caller, tier or field set is logged separately.

$hydrator  : OrmEntityHydrator

$jwtPayload  : JwtPayload|null

$legacyPasswordHasher  : LegacyPasswordHasher

$loginProviderManager  : LoginProviderManager

$loginRateLimit  : RateLimitResult|null

Verdict of the brute-force gate from the last {@see self::internalActionLogin()} in this request.

$loginUser  : LoginUser

$rateLimit  : RateLimit

$rateLimitConfig  : RateLimitConfig

$rbacDecision  : PermissionDecision|null

Decision after the ownership check; the one that allows or denies.

$rbacEnforced  : bool

True only when the gate actually rejected the request (`enforce` + deny).

$rbacKey  : string|null

Key of the last evaluation, e.g. `:Api:Eshop:Order:save`.

$rbacRawDecision  : PermissionDecision|null

Resolver decision before the ownership check (input of the field tier).

$refreshRateLimit  : RateLimitResult|null

The same for `/auth/refresh`, see {@see self::$loginRateLimit}. The gate has to sit in the operation for the same reason: admin and front refresh tokens through the internal bridge call `internalActionRefresh()`, so a limit in `actionRefresh()` would be bypassed.

$userExternalLoginManager  : UserExternalLoginManager

$userManager  : UserManager

$userRefreshTokenManager  : UserRefreshTokenManager

Methods

__construct()  : mixed

actionDeauthorizeExternal()  : void

actionGet()  : void

actionGetAll()  : void

actionGetBy()  : void

actionIsAuthValid()  : void

actionLogin()  : void

actionLogout()  : void

actionMe()  : void

GET /api/system/auth/me — returns the caller's user record. Identity comes from the Bearer access token via JwtAuthTrait::checkJwtAuth, not from an Api session.

actionOauthDeauthorizeCallback()  : void

actionRefresh()  : void

actionSendActivationEmail()  : never

getApiClient()  : ApiClientIdentity|null

Returns the client whose key came with this request; `null` means no key (web or admin through the bridge, a `#[NoClientKey]` exception, or `required: false` without a key).

getCurrencyContext()  : CurrencyContext

getJwtPayload()  : JwtPayload|null

getLanguageContext()  : LanguageContext

getPersonalDataCapabilityRows()  : array<string, array<int, int>>

Returns the records whose personal data the caller receives in full thanks to a capability (advert password).

internalActionConfirmExternalLink()  : array<string, mixed>

The account owner clicked the one-time link from `SY_EXTERNAL_LINK_CONFIRM`: consume the token, pair the provider identity and sign in.

internalActionGet()  : array<string, mixed>

internalActionGetAll()  : array<string, mixed>

internalActionGetBy()  : array<string, mixed>

internalActionIsAuthValid()  : array<string, mixed>

internalActionLogin()  : array<string, int|string|false|null>|array<string, mixed>

Password sign-in with the brute-force gate, which sits here and not in {@see self::actionLogin()}.

internalActionLoginExternal()  : array<string, int|string|false|null>|array<string, mixed>

internalActionLogout()  : array<string, mixed>

internalActionRefresh()  : array<string, mixed>

internalActionSendActivationEmail()  : array<string, int|string|false|null>|array<string, mixed>

isPersonalDataPolicyExempt()  : bool

Sign-in flows return only the caller's own account (just verified by password, refresh token or external provider). At response time the audience context does not know its id yet (the JWT is still being created), so the personal data policy would mask the user's own e-mail. No foreign data is produced here.

sendJson()  : void

Sends the JSON response after personal data of other users passed through {@see PersonalDataPolicy}.

setApiCallSource()  : void

Sets the call source; only {@see \App\Core\Bridge\ApiBridge::internalCall()} calls it (same pattern as `setQueryCacheEnabled()`).

setAuthenticatedPayload()  : void

Pre-populate the authenticated payload from a trusted caller (ApiBridge internal mode). Internal calls skip startup() and therefore the Bearer middleware — this setter is how ApiBridge propagates the calling Front user's identity into the Api presenter so internalAction* methods can see it via getJwtPayload().

setConfigParameters()  : void

setQueryCacheEnabled()  : void

Sets the query cache flag; only {@see \App\Core\Bridge\ApiBridge::internalCall()} calls it, before `internalAction*()` (same pattern as `setAuthenticatedPayload()`).

startup()  : void

applyCors()  : void

Applies the CORS headers and short-circuits a preflight (OPTIONS) with a 204 response.

checkApiPermission()  : void

Gate entry point; call in `startup()` right after `checkJwtAuth()`.

checkClientCallerLimit()  : void

Step 4 of an external request: limit of one caller under the key. A logged-in caller is counted by `userId` from the JWT (never from the request), an anonymous one by address.

checkClientKey()  : void

Step 2 of an external request, see the trait docblock. A rejection ends in `sendJson()` (`AbortException`); otherwise the client is set in the request context.

checkJwtAuth()  : void

exemptPersonalDataForCapabilityHolder()  : void

IMPORTANT: exempts the capability holder's own record from personal data masking.

filterReadPayload()  : array<string, mixed>

Read field tier: the last payload filter before the response is sent to the caller.

getRbacDecision()  : PermissionDecision|null

Decision after the ownership check (null when the gate did not run, i.e. mode `off`).

getRbacKey()  : string|null

getRbacRawDecision()  : PermissionDecision|null

Resolver decision before the ownership check; input of the field tier.

getRequestParameters()  : array<string, mixed>

Returns the parameters of the current request.

getSessionKey()  : string

Returns a session key string, e.g. 'front.auth.step1'.

getSessionSection()  : SessionSection

Returns a Nette\SessionSection instance using a dynamically built session key.

initializePresenterContext()  : void

isCallerTierProbeActive()  : bool

Returns whether the `API_COLTIER` measuring probe is active. All three conditions are needed:

isClientKeyExempt()  : bool

Returns whether the current action is exempt from the key (`#[NoClientKey]` on its `action*()` method). An unknown action is not exempt (fail-closed, like {@see JwtAuthTrait::isPublicAction()}).

isOwner()  : bool

Default ownership check, fail-closed: without {@see OwnerAwareInterface} on the entity it is always `false`. Presenters with their own semantics (`Bazaar/Comcat Advert` have `getInsertUserId()`; `Base\Rating` has the owner of the rated object, not the author) override it. The generic `getUserId()` fallback with the `> 0` edge lives in `OwnershipCheckTrait`.

isPublicAction()  : bool

Tells whether the current action carries `#[PublicAction]`.

isQueryCacheEnabled()  : bool

isReceiver()  : bool

Default check of the `receiver` role: "is the caller the recipient of this record?" (whom it was sent to, not who created it). Fail-closed: without {@see ReceiverAwareInterface} on the entity it is always `false`. {@see self::requireApiPermission()} calls it only when the resolver returned a conditional `receiver` grant (without an unconditional one). Each domain defines its recipient itself (Response: privileged role, advert owner, password capability or a valid `read_key`).

isSameSiteRequest()  : bool

Tells whether the request comes from the own site (Nette SameSite cookie); protects GET actions with a side effect.

operation()  : T

Runs the body of one `internalAction*()` method as one operation (one Api call = one action).

ownsByCapability()  : bool

Returns whether the caller is the owner of the record by a capability in the JWT (not by identity).

readBodyParameter()  : string|null

Returns a value from the request body: `application/x-www-form-urlencoded` or `multipart` (POST fields) and `application/json`.

rejectForbiddenQueryPaths()  : array<string|int, mixed>|null

IMPORTANT: rejects filters, ordering and `columns` that reach fields the caller would not get in the output.

reportCallerTierGap()  : void

Writes one machine-parsable `API_COLTIER` line to the `auth` channel. The format follows `API_RBAC ...` from {@see logApiPermissionDecision()}, so both parse with one report:

requireApiPermission()  : ApiPermissionDeniedShape|null

Guards one Api action. Returns `null` to continue, or an array to return immediately.

requireManager()  : Manager

Returns the manager for the shared CRUD/tree actions.

resolveApiPresenterName()  : string

Maps `App\UI\Api\Eshop\Presenters\OrderPresenter` to `Api:Eshop:Order`.

resolveCallerFrame()  : string

Returns e.g. `app/UI/Front/Eshop/Presenters/ProductPresenter.php:88`: the first stack frame outside {@see self::CALLER_SKIPPED_PATHS}, i.e. the first place that really asked for the data.

resolveCallerTier()  : string

Returns the caller tier for this presenter and action: `privileged` or `user`.

resolveExternalFieldTier()  : string

Resolves the field tier of the caller (`#[ExternalAdminOnly]`).

sendInvalidRequestParameter()  : void

shouldProduceNotifications()  : bool

Returns whether notifications in the bell should be created for this operation.

verifyOwnership()  : bool

Default `owner` check: is the caller the owner of this record? Fail-closed.

verifyReceiver()  : bool

Default `receiver` check: is the caller the receiver of this record (who it was sent to, not who created it)? Fail-closed.

activationUserKey()  : string

apiClientContext()  : ApiClientContext|null

apiPermissionTokenHint()  : string

Returns the first 12 characters of the Bearer token, in the same shape as `API_RBAC ... token=` from the external gate. On the internal path the `Authorization` header is usually empty, giving `-`.

buildAccountRateLimitKey()  : string

Per-account counter, shared by sign-in with a nickname and with an e-mail (see {@see self::internalActionLogin()}).

buildApiPermissionKey()  : string

Builds the key such as `:Api:Eshop:Order:updateColumns` from `getName()` + `getAction()`, never from the URL: Nette `Route::$styles['action']` applies `path2action`, so the URL `update-columns` is `updateColumns` inside the presenter, and the optional `<loc>` route segment is not part of the key.

buildDeviceRateLimitKey()  : string

Failure counter of one known device (id from the {@see LoginDeviceCookie} cookie plus the account). Over the `ratelimit.loginDevice` limit the device is treated as unknown.

buildGlobalAccountRateLimitKey()  : string

Per-account counter regardless of IP. The (identifier, IP) and (account, IP) pairs slow down only an attacker with a single address; a distributed attack on one account (typically admin) would otherwise be limited only by the number of IPs. The limit is looser (`ratelimit.loginAccount`, 20 per hour). Cost: anyone who knows the name can block the owner's password sign-in for an hour, but only from an unknown device and address (see {@see self::internalActionLogin()}).

buildLoginRateLimitKey()  : string

completeExternalSignIn()  : array<string, mixed>

Account gate + pairing + tokens — shared by the provider callback and by the confirmed link.

extractBearerToken()  : string|null

failureResult()  : array<string, mixed>

Failure envelope as an array: `Result::toArray()` is typed `mixed`, but a failure is always an array (same as {@see self::rateLimitedResult()}).

fieldAudience()  : FieldAudienceContext|null

Returns the audience context, or `null` when the presenter did not get it through DI.

getOwnershipRecordId()  : int|null

Returns the id of the decided record, taken only from the request identifiers: the `id` parameter (get/delete) or `data.id` (save UPDATE). Returns `null` when both are given and differ (ambiguous), when `id` is an array (bulk delete) and for an INSERT.

initializeCurrency()  : void

initializeLanguage()  : void

isInternalTransport()  : bool

Returns true when `Presenter::run()` did not run, i.e. the call is on the internal (bridge) path.

isKnownLoginAddress()  : bool

Tells whether the account signed in successfully from this IP within `loginKnownAddressWindow` (auth log).

loadLocalization()  : Localization|null

localizationCurrencyKey()  : string|null

Returns the currency key of the localization's payment region.

logApiPermissionDecision()  : void

Writes the `API_RBAC` line to the `auth` channel. The format is identical to {@see RbacCheckTrait::logRbacDecision()} (so both parse with one report), extended with: - `path=internal|external`: tells the two modes apart in one log; - `caller=File.php:123`: makes the report a list of pages instead of a list of keys; - `key_exists=yes|no`: see below.

logRateLimited()  : int

Writes to the auth log. Returns the normalized `Retry-After` (never below 1 s), so that the same number reaches the log, the header and the response.

logRbacDecision()  : void

Writes one machine-parsable line to the `auth` channel, in a format that follows `JWT_GUARD ...` from {@see JwtAuthTrait::reportJwtAuthFailure()} so that a report can be built from the log.

pairExternalIdentity()  : void

passesSendActivationEmailRateLimit()  : bool

permissionDeniedPayload()  : ApiPermissionDeniedShape

Returns the denial shape, identical to what the external gate sends ({@see RbacCheckTrait::checkApiPermission()}), but returned instead of `sendJson()` because the internal path has nowhere to send an HTTP status.

rateLimitedResult()  : array<string, mixed>

Response envelope for a throttled attempt. `data.retryAfter` is the only way the number of seconds reaches an internal caller (the bridge does not see the `Retry-After` header); `AuthStorageTrait::resolveLoginErrorMessage()` reads it in Admin and on the front end.

rbacTokenHint()  : string

Returns the first 12 characters of the Bearer token, in the same shape as `JWT_GUARD ... token=`.

readBearerFromHeader()  : string|null

refuseClientKey()  : void

Sends one response for a missing, unknown, disabled, revoked and expired key, so the caller cannot tell which key exists. The reason, client id and key id (`cms_system_api_client_keys`, not the key itself) go only to the log; the key or any part of it never does.

refuseClientLimit()  : void

Sends 429 with `Retry-After`. Only the first refusal in the window goes to the auth log, so a flood does not flood the log too.

refuseInactiveExternalSignIn()  : array<string, mixed>|null

Account gate shared by every external sign-in path; `null` = may sign in.

refuseThrottledLogin()  : array<string, mixed>

Handles a throttled attempt: the verdict for {@see self::actionLogin()} (429 with `Retry-After`), an auth log record with the reason, and an envelope identical to a normal refusal.

refuseTokensOfChangedAccount()  : array<string, mixed>|null

Last gate of every token issuance (password, OAuth, refresh): the tokens are already issued, the stored account row is read once more straight from the DB (scalar, no query cache) and when it may not sign in any more (deletion requested, anonymized, banned, deactivated meanwhile), the just-issued refresh token is revoked, the access token's `jti` denied and nothing is handed out.

rejectRefreshReuse()  : array{code: int}

Shared reuse-detection branch of `internalActionRefresh()`: revokes the whole token family, logs the incident and returns a failure. Called from two places: a directly detected replay (an already rotated token reused) and the losing side of a concurrent rotation (`RefreshTokenAlreadyConsumedException` from `UserRefreshTokenManager::rotate()`).

reportJwtAuthFailure()  : void

requestExternalLinkConfirmation()  : array<string, mixed>

The provider identity matched a password account by e-mail. Records a pending request and e-mails the one-time link (at most once per 15 min per account; a repeated attempt inside the window keeps the link already sent). The answer is the same either way, and the sign-in is refused.

resolveGuardMode()  : string

Returns the mode for the transport. Never throws: a missing configuration service means the guard is inert (the pre-guard behavior), not deny.

resolveLogin()  : array<string, mixed>

Verifies the name and password itself. It has no gate and no guard: both are held by {@see self::internalActionLogin()}, the only public entry into this operation.

resultPayload()  : array<string, mixed>

`Result::toArray()` is declared `mixed` (always an array in practice).

revokeAccessJti()  : void

sendActivationEmailOperation()  : array<string, mixed>

sendRateLimitedResponse()  : never

verifySignedRequest()  : string|null

API_COLTIER path=internal kind=save key=:Api:Bazaar:Advert:save tier=user \
  userId=11 would_strip=insertUserId,user caller=app/UI/Front/.../EditTrait.php:88