Core\Lib\Auth

Static entry point to the application's auth guard. Lazily constructs a single SessionGuard so every caller shares one resolved user per request, and forwards the common guard operations (check, user, id) to it. A guard may also be injected via setGuard() to support testing.

Immutable result of a login attempt. Carries the outcome as a status constant plus, where relevant, the user the attempt concerned. Lets the login policy (LoginService) decide the outcome while the caller (controller) owns the resulting HTTP behavior — redirects, flash messages — rather than those being fired from inside the service.

Retrieves and validates Principals backed by the Users model. Isolates all knowledge of how users are stored and looked up, so the guard can authenticate against the Users model through the UserProvider contract without depending on it directly.

Owns remember-me persistence: minting the cookie token and its hashed user_sessions row, and tearing both down on logout.

Generates and hashes remember-me tokens. The raw token lives only in the user's cookie; only its hash is ever stored in user_sessions.

Session-backed guard. Owns "who is logged in right now" and delegates all storage to a UserProvider. Resolves the current user from the session once per request and caches the result, writes the session on login, and clears it on logout. Remember-me persistence is delegated to a RememberMeStore.