objects

SessionRoot

The visitor's session as `$app->session`: login, the signed-in user, permissions, CSRF and throttling.

Values live in named scope()s, so nothing can overwrite the auth keys.

$sessionRoot Phlat\SessionRoot 20 methods

Show

audience Who an entry kept at $level (see Cache::LEVELS) is shared with: '' for everyone (`none`), `role:{name}` (`role`), or `user:{uuid}` (`user`, where signed-out visitors share `role:guest`).
can Whether the visitor's role grants permission $key.
clearThrottle Forgets one key's attempts, or every key's when none is given.
hasCookie Whether the visitor sent a session cookie.
id The session id, starting the session if needed.
isLoggedIn Whether a user is signed in.
login Signs a user in by username and password; false when the details are wrong or password login is off.
loginAs Signs in a user already proven by other means, e.g. an OpenID Connect provider (see Oidc).
logout Signs the visitor out and destroys the session.
reads How often a render has asked about the visitor: who they are (user()) and what they hold (role(), can(), isLoggedIn()).
refresh Swaps in the saved copy of the signed-in user, since a save returns a new User.
regenerate Gives the session a new id, keeping its values.
requireLogin Sends a signed-out visitor to the login page, then back here.
requirePermission Throws a 403 unless the visitor can $key; a signed-out visitor is sent to log in first.
revoke Ends every session the user has signed in so far, on any device; the next request of each finds itself signed out.
role The visitor's role name, `guest` when signed out.
scope A named Session for a view or addon: `$app->session->scope('cart')->get('items')`.
start Starts the PHP session if it isn't running and checks for idle expiry.
throttle Counts an attempt for $key and returns true once it exceeds $max within $window seconds.
user The signed-in user, or null.

Methods

audience

$sessionRoot->audience(string $level): string

Who an entry kept at $level (see Cache::LEVELS) is shared with: '' for everyone (`none`), `role:{name}` (`role`), or `user:{uuid}` (`user`, where signed-out visitors share `role:guest`).

Not counted as a read.

Parameters (1)

$level

string

Returns string

phlat/src/SessionRoot.php:96

can

$sessionRoot->can(string $key): bool

Whether the visitor's role grants permission $key.

A signed-out visitor has the `guest` role.

Parameters (1)

$key

string

Returns bool

phlat/src/SessionRoot.php:134

clearThrottle

$sessionRoot->clearThrottle(?string $key = null): void

Forgets one key's attempts, or every key's when none is given.

Parameters (1)

$key

?string = null

phlat/src/SessionRoot.php:243

id

$sessionRoot->id(): string

The session id, starting the session if needed.

Returns string

phlat/src/SessionRoot.php:212

isLoggedIn

$sessionRoot->isLoggedIn(): bool

Whether a user is signed in.

Returns bool

phlat/src/SessionRoot.php:120

login

$sessionRoot->login(string $username, string $password): bool

Signs a user in by username and password; false when the details are wrong or password login is off.

Parameters (2)

$username	string
$password	string

Returns bool

phlat/src/SessionRoot.php:157

loginAs

$sessionRoot->loginAs(User $user): void

Signs in a user already proven by other means, e.g. an OpenID Connect provider (see Oidc).

Parameters (1)

$user

User

phlat/src/SessionRoot.php:172

logout

$sessionRoot->logout(): void

Signs the visitor out and destroys the session.

phlat/src/SessionRoot.php:196

reads

$sessionRoot->reads(): array

How often a render has asked about the visitor: who they are (user()) and what they hold (role(), can(), isLoggedIn()).

A signed-out visitor's questions count as role reads, since the answer is only that they are a guest. A kept render compares these to know who may share it (App::audience()).

Returns array

phlat/src/SessionRoot.php:90