Ferreteria/v0.5/login: Difference between revisions

Revision as of 13:57, 20 March 2022

The login feature consists of several filesets:

There are two major phases of a logged-in session:

1. right after the user has attempted a login: if login is successful, the user's browser is given a session-cookie to use and is then immediately redirected (to clear out the POST input, thus preventing accidental multiple logins) and we go to phase 2.
2. when we need to check the user's session-cookie before we can know whether they're logged in or not (i.e. most of the time)

Login state is stored in the static csLogin class (login/status.php).

There are two ways the login status can be set: (a) actively logging in, (b) checking authenticity of a requested session

<Account Feature>->TryLogin($sUser,$sPass) : handle the logic for user login attempt; do necessary bookkeeping for result

→ <Account Storage Row>->AuthorizeLogin($sUser,$sPass) : lookup the given username, see if the password hash matches the stored hash
- Set the internal login status: csLogin::SetAccountStatus(<results of search for login name>)
Log the results ($this->CreateEvent(...))
On success:
- update the applicable Session record (<Session Storage Row>->UpdateForLogin($idAcct))

<Session Feature>->UserIsLoggedIn()

Example: see code in cMenuLink->FigureIfAuthorized() in tree/items/MenuLink.php

This is called once per object from ftRequiresPermit->OnRunCalculations() in tree/items/traits.php.

@@ Line 14: / Line 14: @@
 There are two ways the login status can be set: (a) actively logging in, (b) checking authenticity of a requested session
 ====logging in====
-{{arg|Account Feature}}<code>->TryLogin($sUser,$sPass)</code> : handle the logic for user login attempt; do necessary bookkeeping for result
+<code>{{arg|Account Feature}}->TryLogin($sUser,$sPass)</code> : handle the logic for user login attempt; do necessary bookkeeping for result
-* &rarr; {{arg|Account Storage Row}}<code>->AuthorizeLogin($sUser,$sPass)</code> : lookup the given username, see if the password hash matches the stored hash
+* &rarr; <code>{{arg|Account Storage Row}}->AuthorizeLogin($sUser,$sPass)</code> : lookup the given username, see if the password hash matches the stored hash
+** Set the internal login status: <code>csLogin::SetAccountStatus({{arg|results of search for login name}})</code>
 * Log the results (<code>$this->CreateEvent(...)</code>)
 * On success:
-** update the applicable Session record ({{arg|Session Storage Row}}<code>->UpdateForLogin($idAcct)</code>)
+** update the applicable Session record (<code>{{arg|Session Storage Row}}->UpdateForLogin($idAcct)</code>)
 ====authenticating session====
-{{arg|Session Feature}}<code>->UserIsLoggedIn()</code>
+<code>{{arg|Session Feature}}->UserIsLoggedIn()</code>
 * &rarr; <code>NativeRow()->UserIsLoggedIn()</code>