1. class
  2. Core
  3. \
  4. Lib
  5. \
  6. Auth
  7. \
  8. SessionGuard

SessionGuard

final class SessionGuard implements Guard

Session-backed guard. Owns "who is logged in right now" and delegates all storage to a UserProvider. Resolves the current user from the session once per request and caches the result, writes the session on login, and clears it on logout. Remember-me persistence is delegated to a RememberMeStore.

Properties

private UserProvider $provider

Retrieves and validates users on the guard's behalf.
private string $sessionKey

The session key under which the authenticated user's identifier is stored.
private Principal|null $user

The resolved user for the current request, or null if none is authenticated or resolution has not yet occurred.
private bool $resolved

Whether the current user has been resolved from the session yet.
private RememberMeStore|null $remember

Handles persistence and teardown of remember-me tokens.

Methods

__construct(UserProvider $provider, string|null $sessionKey = null, RememberMeStore|null $remember = null)

No description

bool
check()

Determines whether a user is currently authenticated.

mixed
id()

Gets the identifier of the currently authenticated user.

void
login(Principal $user, bool $remember = false)

Logs the given user in, storing their identifier in the session and caching them for the current request. When $remember is true, a remember-me token is also persisted.

Principal|null
loginUsingId(mixed $id)

Resolves a user by identifier and logs them in.

void
logout()

Logs the current user out, clearing the session, the cached user, and any persisted remember-me token.

Principal|null
user()

Resolves the current user from the session once, then caches it.

bool
validate(array $credentials)

Checks credentials WITHOUT logging anyone in.

Details

at line 65
__construct(UserProvider $provider, string|null $sessionKey = null, RememberMeStore|null $remember = null)

No description

Parameters

UserProvider $provider

The provider used to retrieve and validate users.
string|null $sessionKey

The session key holding the user's identifier. Defaults to the CURRENT_USER_SESSION_NAME environment value when null.
RememberMeStore|null $remember

The remember-me store. A default store is constructed when null.

at line 81
bool check()

Determines whether a user is currently authenticated.

Return Value

bool

True if a user is resolved for the current request, otherwise false.

at line 91
mixed id()

Gets the identifier of the currently authenticated user.

Return Value

mixed

The authenticated user's identifier, or null if no user is authenticated.

at line 106
void login(Principal $user, bool $remember = false)

Logs the given user in, storing their identifier in the session and caching them for the current request. When $remember is true, a remember-me token is also persisted.

Parameters

Principal $user

The user to authenticate.
bool $remember

Whether to persist a remember-me token so the user remains logged in across sessions. Defaults to false.

Return Value

void

at line 120
Principal|null loginUsingId(mixed $id)

Resolves a user by identifier and logs them in.

Parameters

mixed $id

The identifier of the user to authenticate.

Return Value

Principal|null

The authenticated user, or null if no user matches the given identifier.

at line 132
void logout()

Logs the current user out, clearing the session, the cached user, and any persisted remember-me token.

Return Value

void

at line 145
Principal|null user()

Resolves the current user from the session once, then caches it.

Return Value

Principal|null

The authenticated user, or null if no user is authenticated.

at line 161
bool validate(array $credentials)

Checks credentials WITHOUT logging anyone in.

Parameters

array $credentials

The credentials to validate (e.g. ['username' => ..., 'password' => ...]).

Return Value

bool

True if the credentials are valid, otherwise false.