SessionGuard

Determine if the current user is authenticated. If not, throw an exception.

Determine if the current user is authenticated.

Determine if the current user is a guest.

Get the ID for the currently authenticated user.

Get the user provider used by the guard.

Set the user provider used by the guard.

Boot or tests only. The provider is stored on the worker-lifetime guard and affects every subsequent request.

Register a custom macro.

Boot-only. Macros persist in a static property for the worker lifetime and apply to every subsequent call on the macroable class.

Mix another object into the class.

Boot-only. Delegates to macro() for each method; registered macros persist in a static property for the worker lifetime.

Check if macro is registered.

Flush the existing macros.

Boot or tests only. Clears worker-wide macros; concurrent coroutines may resolve different methods depending on timing.

Dynamically handle calls to the class.

Dynamically handle calls to the class.

Create a new authentication guard.

Get the currently authenticated user.

Uses coroutine Context to cache the resolved user per-request, since this guard is a process-global singleton. A sentinel value caches "no user found" so repeated calls don't trigger redundant provider lookups.

Pull a user from the repository by its "remember me" cookie token.

Get the decrypted recaller cookie for the request.

Log a user into the application without sessions or cookies.

Log the given user ID into the application without sessions or cookies.

Validate a user's credentials.

Attempt to authenticate using HTTP Basic Auth.

Perform a stateless HTTP Basic login attempt.

Attempt to authenticate using basic authentication.

Get the credential array for an HTTP Basic request.

Get the response for basic authentication.

Attempt to authenticate a user using the given credentials.

Attempt to authenticate a user with credentials and additional callbacks.

Determine if the user matches the credentials.

Determine if the user should login by executing the given callbacks.

Rehash the user's password if enabled and required.

Log the given user ID into the application.

Log a user into the application.

Update the session with the given ID and regenerate the session's token.

Create a new "remember me" token for the user if one doesn't already exist.

Queue the recaller cookie into the cookie jar.

Create a "remember me" cookie for a given ID.

Create a HMAC of the password hash for storage in cookies.

Log the user out of the application.

Log the user out of the application on their current device only.

This method does not cycle the "remember" token.

Remove the user data from the session and cookies.

Refresh the "remember me" token for the user.

Invalidate other sessions for the current user.

The application must be using the AuthenticateSession middleware.

Rehash the current user's password for logging out other devices via AuthenticateSession.

Register an authentication attempt event listener.

Boot-only. Listener registrations persist on the worker-lifetime dispatcher and affect every subsequent request.

Fire the attempt event with the arguments.

Fire the validated event if the dispatcher is set.

Fire the login event if the dispatcher is set.

Fire the authenticated event if the dispatcher is set.

Fire the other device logout event if the dispatcher is set.

Fire the failed authentication attempt event with the given arguments.

Dispatch the given event if listeners are registered.

Get the last user we attempted to authenticate.

Get a unique identifier for the auth session value.

Get the name of the cookie used to store the "recaller".

Determine if the user was authenticated via "remember me" cookie.

Get the number of minutes the remember me cookie should be valid for.

Set the number of minutes the remember me cookie should be valid for.

Boot-only. The duration is stored on the worker-lifetime guard and affects every subsequent request.

Get the cookie creator instance used by the guard.

Set the cookie creator instance used by the guard.

Boot or tests only. The cookie jar is stored on the worker-lifetime guard and affects every subsequent request.

Get the event dispatcher instance.

Set the event dispatcher instance.

Boot or tests only. The dispatcher is stored on the worker-lifetime guard and affects every subsequent request.

Get the session store used by the guard.

Return the currently cached user.

Determine if the guard has a user instance.

Set the current user.

Uses coroutine Context for per-request isolation. Routes to the "unstarted" key if the session hasn't started yet (e.g. during middleware before session initialization).

Forget the current user.

Get durable authentication Context keys for the current guard.

Transient request state such as remember-cookie attempts and last-attempted users is intentionally excluded.

Get the current request instance.

Resolved lazily from the container because this guard is a process-global singleton and must not store per-request state.

Get the timebox instance used by the guard.

Get the Context key for caching the authenticated user.

Get the Context key for user set before session starts.

Get a per-request state value from Context.

Set a per-request state value in Context.

Get a per-request state Context key.

Flush all static state.