CoreAdminAuth
extends Auth
in package
implements
AdminAuthInterface
Provides user authentication functions for the admin
Table of Contents
Interfaces
- AdminAuthInterface
- Provides admin authentication functions for the back-end
Constants
- KEY : mixed = 'admin'
- LOGIN_LIMIT_SECONDS : mixed = 3600
- LOGIN_URL : mixed = 'admin/login'
Properties
- $category_cache : array<string|int, mixed>
Methods
- changePassword() : mixed
- Sets the password for a operator, or the current operator if a operator-id is not specified.
- checkAlgorithm() : bool
- Checks if a given password algorithm is available
- checkLogin() : void
- If the user is not logged, redirect them to a login page
- checkPassword() : mixed
- Checks the password on the database matches the one provided For re-authenticating certain actions of logged in operators
- checkRateLimit() : array<string|int, mixed>
- Does a rate-limit check for admin logins against the login_attempts table
- configure() : void
- Configure the service.
- createUser() : int
- Create a new user with a set of details, excluding password
- defaultAlgorithm() : int
- Return the algorithm for new accounts.
- deleteUser() : bool
- Called after internal record deletion.
- doPasswordCheck() : bool
- Check a password hash against an entered password
- getAllCategories() : mixed
- Gets a list of all of the admin categories Returned as an array of id => name
- getDetails() : array<string|int, mixed>|bool
- Gets the id, name, username and email of the currently logged in operator.
- getId() : int
- Returns the id of the currently logged in operator
- getLocalId() : int
- Fetches the ID of current operator if and only if they're a local operator, otherwise 0.
- getOperatorCategories() : mixed
- Returns an array of all categories the currently logged in operator is in
- getPrimaryCategoryId() : int
- Get the ID of the 'Primary administrators' category
- getSessionKey() : string
- Get the session key, e.g. 'admin'
- hasDatabaseRecord() : bool
- Does the record-id for this login correspond to a local database record?
- hashPassword() : array<string|int, mixed>|null
- Return a hashed password, password algorithm, and salt, for inserting into the database
- inCategory() : mixed
- Returns true if the currently logged in user is in the specified category.
- injectLocalSuperConf() : array<string|int, mixed>
- Load the existing super-operators list from config, inject another operator, return new array
- isLoggedIn() : bool
- Check if the user is logged in or not
- isSuper() : bool
- A super-operator -- has access to everything (dev tools, all permissions, etc)
- loginComplete() : string
- Set up various login params and redirect into admin
- logout() : void
- Logs an operator out
- processLocal() : bool
- Process a local (developer) login, with details stored in a config file
- processLogin() : bool
- Processes the login by a operator with the specified username and password
- processOpenid() : bool
- Stub function for future development using OpenID
- processRemote() : bool
- Process a remote (developer) login, as provided by the external web service
- saveLoginAttempt() : mixed
- Store a login attempt (used for rate checking)
- updateDetails() : bool
- Update a set of details for a user, excluding password
Constants
KEY
public
mixed
KEY
= 'admin'
LOGIN_LIMIT_SECONDS
public
mixed
LOGIN_LIMIT_SECONDS
= 3600
LOGIN_URL
public
mixed
LOGIN_URL
= 'admin/login'
Properties
$category_cache
private
static array<string|int, mixed>
$category_cache
= []
A cache of categories the current operator is a member of, populated on demand
Methods
changePassword()
Sets the password for a operator, or the current operator if a operator-id is not specified.
public
static changePassword(string $new_password[, int $operator_id = null ]) : mixed
Parameters
- $new_password : string
-
The new password.
- $operator_id : int = null
-
The operator to update. If not specified, the currently logged in operator is used.
checkAlgorithm()
Checks if a given password algorithm is available
public
static checkAlgorithm(int $algorithm) : bool
Parameters
- $algorithm : int
-
Password algorithm, Constants
Return values
bool —True if the specified algorithm is available, False otherwise
checkLogin()
If the user is not logged, redirect them to a login page
public
static checkLogin([mixed $msg = null ]) : void
Parameters
- $msg : mixed = null
-
Optional message to display on the login page
checkPassword()
Checks the password on the database matches the one provided For re-authenticating certain actions of logged in operators
public
static checkPassword(mixed $password[, mixed $operator_id = null ]) : mixed
Parameters
- $password : mixed
- $operator_id : mixed = null
checkRateLimit()
Does a rate-limit check for admin logins against the login_attempts table
public
static checkRateLimit(mixed $username, mixed $ip) : array<string|int, mixed>
Parameters
- $username : mixed
- $ip : mixed
Return values
array<string|int, mixed> —If the rate limit has been hit. Keys: 0 => problematic field, 1 => max rate
configure()
Configure the service.
public
static configure(array<string|int, mixed> $config) : void
Parameters
- $config : array<string|int, mixed>
Tags
createUser()
Create a new user with a set of details, excluding password
public
static createUser(array<string|int, mixed> $details, string $password) : int
Parameters
- $details : array<string|int, mixed>
- $password : string
Tags
Return values
int —The ID of the new user
defaultAlgorithm()
Return the algorithm for new accounts.
public
static defaultAlgorithm() : int
Existing accounts will be re-crypted into this algorithm upon next login.
Return values
int —Password algorithm, Constants
deleteUser()
Called after internal record deletion.
public
static deleteUser(int $item_id) : bool
Nothing needs doing for internal records.
Parameters
- $item_id : int
Return values
booldoPasswordCheck()
Check a password hash against an entered password
public
static doPasswordCheck(string $known_hash, int $algorithm, string $salt, string $user_string) : bool
Parameters
- $known_hash : string
-
The known hash to check against, typically from the database
- $algorithm : int
-
Password algorithm, Constants
- $salt : string
- $user_string : string
-
Password which was entered by the user, to check against the stored hash
Return values
bool —True if the password matches, false if it doesn't
getAllCategories()
Gets a list of all of the admin categories Returned as an array of id => name
public
static getAllCategories() : mixed
getDetails()
Gets the id, name, username and email of the currently logged in operator.
public
static getDetails() : array<string|int, mixed>|bool
N.B. the id will be 0 for remote users
Return values
array<string|int, mixed>|bool —Under normal circumstances, with keys 'id', 'name', 'username', 'email' and 'editor'. False if fetching data for a remote operator failed
getId()
Returns the id of the currently logged in operator
public
static getId() : int
Return values
int —0 if user isn't logged in
getLocalId()
Fetches the ID of current operator if and only if they're a local operator, otherwise 0.
public
static getLocalId() : int
Return values
int —An ID if a local operator, 0 otherwise
getOperatorCategories()
Returns an array of all categories the currently logged in operator is in
public
static getOperatorCategories() : mixed
getPrimaryCategoryId()
Get the ID of the 'Primary administrators' category
public
static getPrimaryCategoryId() : int
i.e. the first category with permission to manage operators
Return values
intgetSessionKey()
Get the session key, e.g. 'admin'
public
static getSessionKey() : string
Tags
Return values
stringhasDatabaseRecord()
Does the record-id for this login correspond to a local database record?
public
static hasDatabaseRecord() : bool
Tags
Return values
bool —True if the logged-in operator has a database record
hashPassword()
Return a hashed password, password algorithm, and salt, for inserting into the database
public
static hashPassword(string $password[, int $algorithm = null ]) : array<string|int, mixed>|null
Parameters
- $password : string
-
Plaintext password
- $algorithm : int = null
-
Password algorithm, Constants. If not specified, the default is used.
Return values
array<string|int, mixed>|null —0 => hash, 1 => algorithm, 2 => salt
inCategory()
Returns true if the currently logged in user is in the specified category.
public
static inCategory(int $category_id) : mixed
Always returns true for remotely-logged in users.
Parameters
- $category_id : int
-
The category to check
injectLocalSuperConf()
Load the existing super-operators list from config, inject another operator, return new array
public
static injectLocalSuperConf(string $username, string $pass_hash, string $pass_salt) : array<string|int, mixed>
Parameters
- $username : string
-
The username to add or edit
- $pass_hash : string
-
The password hash, as generated by Auth::hashPassword
- $pass_salt : string
-
The password salt, as generated by Auth::hashPassword
Return values
array<string|int, mixed> —New users array
isLoggedIn()
Check if the user is logged in or not
public
static isLoggedIn() : bool
Return values
bool —True if the user is logged in, false otherwise
isSuper()
A super-operator -- has access to everything (dev tools, all permissions, etc)
public
static isSuper() : bool
Tags
Return values
bool —True if the logged-in user is a super-operator
loginComplete()
Set up various login params and redirect into admin
public
static loginComplete([string|null $username = '' ][, string|null $redirect = '' ]) : string
Parameters
- $username : string|null = ''
-
Provided username or empty string
- $redirect : string|null = ''
-
URL to redirect to after login (or empty string)
Tags
Return values
string —URL to redirect to
logout()
Logs an operator out
public
static logout() : void
processLocal()
Process a local (developer) login, with details stored in a config file
public
static processLocal(string $username, string $password) : bool
Parameters
- $username : string
-
The username to attempt login with
- $password : string
-
The password to attempt login with
Return values
bool —True on success, false on failure
processLogin()
Processes the login by a operator with the specified username and password
public
static processLogin(string $username, string $password) : bool
Parameters
- $username : string
-
The username to attempt login with
- $password : string
-
The password to attempt login with
Return values
bool —True on success, false on failure
processOpenid()
Stub function for future development using OpenID
public
static processOpenid(string $openid) : bool
Parameters
- $openid : string
-
The openid username url
Return values
bool —True on success, false on failure
processRemote()
Process a remote (developer) login, as provided by the external web service
public
static processRemote(string $username, string $password) : bool
Parameters
- $username : string
-
The username to attempt login with
- $password : string
-
The password to attempt login with
Return values
bool —True on success, false on failure
saveLoginAttempt()
Store a login attempt (used for rate checking)
public
static saveLoginAttempt(mixed $username, mixed $ip, mixed $success) : mixed
Parameters
- $username : mixed
- $ip : mixed
- $success : mixed
updateDetails()
Update a set of details for a user, excluding password
public
static updateDetails(int $item_id, array<string|int, mixed> $details) : bool
Parameters
- $item_id : int
- $details : array<string|int, mixed>