Authentication and authorization

// A table: crystoline/xpsr-database and DatabaseServiceRegistry.
'users' => ['driver' => 'database', 'table' => 'users', 'login' => 'email', 'password' => 'password'],

// Doctrine entities: crystoline/xpsr-orm-doctrine.
'users' => ['driver' => 'doctrine', 'entity' => App\Entity\User::class, 'login' => 'email'],

// Eloquent models: crystoline/xpsr-orm-eloquent.
'users' => ['driver' => 'eloquent', 'model' => App\Model\User::class, 'login' => 'email'],

php xpsr make:migration create_users_table --create=users

use Crystoline\Xpsr\Auth\PasswordHasher;

$hash = $hasher->hash($password);   // Argon2id when PHP has it, otherwise bcrypt

use Crystoline\Xpsr\Auth\AuthManager;

public function store(ServerRequestInterface $request): ResponseInterface
{
    $input = $this->validator->validate($request, SignIn::class);
    if ($this->auth->attempt($request, $input->email, $input->password) === null) {
        Session::of($request)->flash('error', 'Those details do not match.');

        return $this->responses->redirect('/login');
    }

    return $this->responses->redirect($this->auth->intended($request));
}

public function destroy(ServerRequestInterface $request): ResponseInterface
{
    $this->auth->logout($request);

    return $this->responses->redirect('/');
}

use Crystoline\Xpsr\Auth\Http\Authenticate;
use Crystoline\Xpsr\Auth\Http\Guest;
use Crystoline\Xpsr\Cache\RateLimit\RateLimit;

// Inside the group in routes/web.php:
$routes->get('/login', [LoginController::class, 'create'])->middleware(Guest::class);
$routes->post('/login', [LoginController::class, 'store'])->middleware(Guest::class, RateLimit::named('login'));
$routes->post('/logout', [LoginController::class, 'destroy']);
$routes->get('/account', [AccountController::class, 'show'])->middleware(Authenticate::class);

// routes/api.php
$routes->group('/api', static function (RouteCollection $routes): void {
    $routes->get('/tasks', [TaskController::class, 'index'])->middleware(RequireScopes::of('tasks:read'));
}, [Authenticate::guard('api')]);

composer require crystoline/xpsr-auth-jwt
php xpsr auth:jwt-secret --write   # sets AUTH_JWT_SECRET in .env

use Crystoline\Xpsr\Auth\Jwt\JwtIssuer;
use Crystoline\Xpsr\Auth\UnauthenticatedException;

public function store(ServerRequestInterface $request): ResponseInterface
{
    $input = $this->validator->validate($request, SignIn::class);
    $user = $this->auth->verify($input->email, $input->password) ?? throw new UnauthenticatedException();
    $token = $this->jwt->issue($user, ['tasks:read', 'tasks:write']);

    return $this->responses->json(['token' => $token->token, 'expires_at' => $token->expiresAt->format(DATE_ATOM)]);
}

php xpsr make:token-table && php xpsr migrate

use Crystoline\Xpsr\Database\Auth\TokenRepository;

$new = $tokens->create($user, 'deploy script', ['tasks:read'], expiresAt: new DateTimeImmutable('+90 days'));
$new->plainText;                        // show it once: xpsr_ followed by 64 hexadecimal characters
$tokens->forUser($user);                // name, scopes, created, last used, expiry
$tokens->revoke($new->token->id);
$tokens->revokeAll($user);

php xpsr auth:token ada@example.com --name=deploy --scope=tasks:read --expires="90 days"
php xpsr auth:token-revoke 12

'guards' => [
    'web'   => ['driver' => 'session', 'provider' => 'users'],
    'admin' => ['driver' => 'session', 'provider' => 'admins', 'login_path' => '/admin/login', 'home_path' => '/admin'],
    'api'   => ['driver' => 'jwt', 'provider' => 'users'],
],
'providers' => [
    'users'  => ['driver' => 'database', 'table' => 'users'],
    'admins' => ['driver' => 'database', 'table' => 'admins'],
],

$auth->attempt($request, $email, $password, guard: 'admin');
$auth->intended($request, guard: 'admin');
$auth->logout($request, 'admin');            // the web sign-in stays; the session moves to a new ID

$routes->group('/admin', static function (RouteCollection $routes): void {
    $routes->get('/login', [AdminLoginController::class, 'create'])->middleware(Guest::guard('admin'));
    $routes->post('/login', [AdminLoginController::class, 'store'])->middleware(Guest::guard('admin'));
    $routes->group('', static function (RouteCollection $routes): void {
        $routes->get('', [AdminController::class, 'index']);
    }, [Authenticate::guard('admin')]);
});

use Crystoline\Xpsr\Auth\Identity;

$identity = Identity::of($request);     // 401 for a guest
$identity = Identity::find($request);   // null for a guest
$identity->user;                        // the UserInterface
$identity->guard;                       // 'web' or 'api'
$identity->hasScope('tasks:write');
$identity->tokenId;                     // the JWT's jti or the token's ID; null for sessions

namespace App\Policies;

use App\Entity\Task;
use App\Entity\User;

final class TaskPolicy
{
    /** Runs first: true or false decides, null goes on to the method. */
    public function before(User $user, string $ability): ?bool
    {
        return $user->isAdmin ? true : null;
    }

    public function view(?User $user, Task $task): bool   // ?User: guests reach this method
    {
        return $task->public || $task->ownerId === $user?->id;
    }

    public function update(User $user, Task $task): bool
    {
        return $task->ownerId === $user->id;
    }

    public function create(User $user): bool
    {
        return true;
    }
}

'policies' => [App\Entity\Task::class => App\Policies\TaskPolicy::class],

$user = Identity::of($request)->user;
$this->gate->authorize($user, 'update', $task);           // 403 "You are not allowed to do this." when refused
if ($this->gate->allows($user, 'create', Task::class)) {   // a class name: no record yet
    // ...
}

$this->container->get(Gate::class)->define('view-reports', static fn(User $user): bool => $user->isAdmin);

public function testTheAccountPageShowsTheUser(): void
{
    $this->actingAs(new GenericUser(7, null, ['name' => 'Ada']));
    self::assertStringContainsString('Ada', (string) $this->get('/account')->getBody());
}

public function testTheApiNeedsTheReadScope(): void
{
    $this->actingAs($user, 'api', ['tasks:write']);
    self::assertSame(403, $this->request('GET', '/api/tasks', ['Accept' => 'application/json'])->getStatusCode());
}