Authentication about web HOT 4 CLOSED

class Authentication implements Filter {

  // ...

  public function filter($request, $response, $invocation) {
    if ($session= $this->sessions->locate($request)) {
      $request->pass('user', $session->value('user'));
      try {
        return $invocation->proceed($request, $response);
      } finally {
        $session->transmit($response);
      }
    }
    // Redirect to login screen, it will fill the session
  }
}

/** Base user model. Can be extended by applications if necessary. */
class User {
  public function __construct(private string $id, private array<string> $roles) { }

  /** Returns user ID */
  public function id() ==> $this->id;

  /** Returns all of the user's roles */
  public function roles() ==> $this->roles;

  /** Checks whether user is in a given role */
  public function hasRole($role) ==> in_array($role, $this->roles, true);
}

// HTTP Basic Auth
$authenticate= new class() implements Filter {
  public function filter($request, $response, $invocation) {
    sscanf($request->header('Authorization'), 'Basic %s', $authorization);
    [$username, $password]= explode(':', base64_decode($authorization));
    if ($user= $this->users->authenticate($username, new Secret($password)) {
      return $invocation->proceed($request->authenticate($user), $response);
    }

    $response->header('WWW-Authenticate', 'Basic realm="Administration"');
    $response->answer(401, 'Unauthorized');
  }
};

// Inside a handler
$handler= new class() implements Handler {
  public function handle($request, $response) {
    $user= $request->user();

    // ...
  }
};