EditAdvertFormTrait
Advert editing: loads the advert, verifies the permission (logged-in owner or session token) and provides the actions that show the edit form.
Tags
Table of Contents
Constants
- sessionSection : mixed = 'front.bazaar.advert.edit'
- tabConfirm : mixed = 'confirm'
- tabDelete : mixed = 'delete'
- tabExtend : mixed = 'extend'
- tabForm : mixed = 'form'
- Tab keys of the edit page; they match the files in `Templates/Advert/Sections/Edit/`.
- tabRenew : mixed = 'renew'
- tabResponses : mixed = 'responses'
- tabStatistics : mixed = 'statistics'
Properties
- $capabilityTokenIssuer : CapabilityTokenIssuer
- Issuer of the capability token for the Api layer (see {@see self::checkAutorization()}).
- $advert : Advert|null
Methods
- actionEdit() : void
- getAdvert() : Advert|null
- renderEdit() : void
- setAdvert() : self
- createComponentEditAdvertForm() : AdvertForm
- buildEditTabs() : array<int, string>
- Builds the list of available tabs. Renew and Extend appear by the expiration state.
- checkAutorization() : bool
- Checks whether the current user may edit the advert.
- grantAdvertEditCapability() : void
- Passes the fact that this visitor just proved the advert password to the Api layer. The token is minted again on every request from the current session state (already verified against the DB by the caller) and is never stored.
- grantAdvertEditCapabilityFromSession() : void
- Issues the capability from the session before the advert is loaded. The Api verifies it itself (password digest from the DB in `ownsByCapability()`), so a stale session record opens nothing. Without it `get` for editing would give an anonymous editor a masked e-mail and the form would fail validation. {@see self::checkAutorization()} then issues the capability again after the check against the fresh hash, which stays decisive for access.
Constants
sessionSection
private
mixed
sessionSection
= 'front.bazaar.advert.edit'
tabConfirm
private
mixed
tabConfirm
= 'confirm'
tabDelete
private
mixed
tabDelete
= 'delete'
tabExtend
private
mixed
tabExtend
= 'extend'
tabForm
Tab keys of the edit page; they match the files in `Templates/Advert/Sections/Edit/`.
private
mixed
tabForm
= 'form'
tabRenew
private
mixed
tabRenew
= 'renew'
tabResponses
private
mixed
tabResponses
= 'responses'
tabStatistics
private
mixed
tabStatistics
= 'statistics'
Properties
$capabilityTokenIssuer
Issuer of the capability token for the Api layer (see {@see self::checkAutorization()}).
public
CapabilityTokenIssuer
$capabilityTokenIssuer
Attributes
- #[Inject]
$advert
private
Advert|null
$advert
= null
Methods
actionEdit()
public
actionEdit(int $id) : void
Parameters
- $id : int
getAdvert()
public
getAdvert() : Advert|null
Return values
Advert|nullrenderEdit()
public
renderEdit() : void
setAdvert()
public
setAdvert(Advert|null $advert) : self
Parameters
- $advert : Advert|null
Return values
selfcreateComponentEditAdvertForm()
protected
createComponentEditAdvertForm() : AdvertForm
Return values
AdvertFormbuildEditTabs()
Builds the list of available tabs. Renew and Extend appear by the expiration state.
private
buildEditTabs() : array<int, string>
Return values
array<int, string>checkAutorization()
Checks whether the current user may edit the advert.
private
checkAutorization() : bool
A logged-in owner passes without a session. A guest needs a valid session token (id + hash + expiration) stored after typing the password.
When the session check passes, a capability token for the Api layer is issued as well
(self::grantAdvertEditCapability()). Without it an anonymous editor is a plain guest
for the Api guard, which rejects save, extend and delete in internalMode: enforce.
IMPORTANT: the order is binding. The capability is issued only after the comparison
$hash !== $advertHash, that is, after the check against the fresh hash from the DB.
Issued earlier, it would lose the property this mechanism exists for: an owner password
change must immediately invalidate every session that is being edited.
Return values
boolgrantAdvertEditCapability()
Passes the fact that this visitor just proved the advert password to the Api layer. The token is minted again on every request from the current session state (already verified against the DB by the caller) and is never stored.
private
grantAdvertEditCapability(int $advertId, string $passwordHash, int $expiration) : void
NOTE: userId in the token stays empty for a guest and unchanged for a logged-in user;
the capability is not an identity. See CapabilityTokenIssuer.
Parameters
- $advertId : int
- $passwordHash : string
- $expiration : int
grantAdvertEditCapabilityFromSession()
Issues the capability from the session before the advert is loaded. The Api verifies it itself (password digest from the DB in `ownsByCapability()`), so a stale session record opens nothing. Without it `get` for editing would give an anonymous editor a masked e-mail and the form would fail validation. {@see self::checkAutorization()} then issues the capability again after the check against the fresh hash, which stays decisive for access.
private
grantAdvertEditCapabilityFromSession(int $advertId) : void
Parameters
- $advertId : int