SessionRoot
The visitor's session as `$app->session`: login, the signed-in user, permissions, CSRF and throttling.
Values live in named scope()s, so nothing can overwrite the auth keys.
- can Whether the visitor's role grants permission $key.
- clearThrottle Forgets one key's attempts, or every key's when none is given.
- hasCookie Whether the visitor sent a session cookie.
- id The session id, starting the session if needed.
- isLoggedIn Whether a user is signed in.
- login Signs a user in by username and password; false when the details are wrong or password login is off.
- loginAs Signs in a user already proven by other means, e.g. an OpenID Connect provider (see Oidc).
- logout Signs the visitor out and destroys the session.
- refresh Swaps in the saved copy of the signed-in user, since a save returns a new User.
- regenerate Gives the session a new id, keeping its values.
- requireLogin Sends a signed-out visitor to the login page, then back here.
- requirePermission Throws a 403 unless the visitor can $key; a signed-out visitor is sent to log in first.
- revoke Ends every session the user has signed in so far, on any device; the next request of each finds itself signed out.
- scope A named Session for a view or addon: `$app->session->scope('cart')->get('items')`.
- start Starts the PHP session if it isn't running and checks for idle expiry.
- throttle Counts an attempt for $key and returns true once it exceeds $max within $window seconds.
- user The signed-in user, or null.
Methods
$sessionRoot->can(string $key): bool
Whether the visitor's role grants permission $key.
A signed-out visitor has the guest role.
Parameters (1)
| $key | string |
Returns bool
phlat/src/SessionRoot.php:97
$sessionRoot->clearThrottle(?string $key = null): void
Forgets one key's attempts, or every key's when none is given.
Parameters (1)
| $key | ?string = null |
phlat/src/SessionRoot.php:206
$sessionRoot->hasCookie(): bool
Whether the visitor sent a session cookie.
Without one nobody is signed in, so no session needs starting.
Returns bool
phlat/src/SessionRoot.php:169
$sessionRoot->id(): string
The session id, starting the session if needed.
Returns string
phlat/src/SessionRoot.php:175
$sessionRoot->isLoggedIn(): bool
Whether a user is signed in.
Returns bool
phlat/src/SessionRoot.php:84
$sessionRoot->login(string $username, string $password): bool
Signs a user in by username and password; false when the details are wrong or password login is off.
Parameters (2)
| $username | string | |
| $password | string |
Returns bool
phlat/src/SessionRoot.php:120
$sessionRoot->logout(): void
Signs the visitor out and destroys the session.
phlat/src/SessionRoot.php:159
$sessionRoot->regenerate(): bool
Gives the session a new id, keeping its values.
Returns bool
phlat/src/SessionRoot.php:182
$sessionRoot->requireLogin(string $redirect = ''): void
Sends a signed-out visitor to the login page, then back here.
Parameters (1)
| $redirect | string = '' |
phlat/src/SessionRoot.php:90
$sessionRoot->requirePermission(string $key): void
Throws a 403 unless the visitor can $key; a signed-out visitor is sent to log in first.
Parameters (1)
| $key | string |
phlat/src/SessionRoot.php:104
$sessionRoot->revoke(string $username): void
Ends every session the user has signed in so far, on any device; the next request of each finds itself signed out.
Parameters (1)
| $username | string |
phlat/src/SessionRoot.php:145
$sessionRoot->start(): void
Starts the PHP session if it isn't running and checks for idle expiry.
phlat/src/SessionRoot.php:43
$sessionRoot->throttle(string $key, int $max, int $window = 300): bool
Counts an attempt for $key and returns true once it exceeds $max within $window seconds.
Parameters (3)
| $key | string | |
| $max | int | |
| $window | int = 300 |
Returns bool
phlat/src/SessionRoot.php:189