feat: HMAC SHA256 Authentication

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840

[tswagger]

Adding HMAC-SHA256 as an authenticator. This method has a slight security advantage to a standard token authentication by signing the request with a shared secret.

Usage and coding mirrors closely the established Access Token Authentication classes and methods.

References:

• https://datatracker.ietf.org/doc/html/rfc4868
• https://www.techtarget.com/searchsecurity/definition/Hash-based-Message-Authentication-Code-HMAC

[kenjis]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

[kenjis]

And we don't use git merge to update PR branches.
Please use git rebase instead.
See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#updating-your-branch

[tswagger]

Thank you for sending this PR!

You must GPG-sign your work, certifying that you either wrote the work or otherwise have the right to pass it on to an open-source project. See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/pull_request.md#signing

@kenjis My apologies, I thought I had that setup correctly. Since I obviously didn't, how do I retroactively sign what I have submitted?

[kenjis]

See https://github.com/codeigniter4/CodeIgniter4/blob/develop/contributing/workflow.md#gpg-signing-old-commits

[tswagger]

@kenjis I have rebased and signed my code. I appreciate your assistance on that.

[kenjis]

@tswagger Thank you!

[tswagger]

I am not sure how you would like me to address the final failed check. I intentionally mirrored the Authorize Tokens classes. I could create a shared trait or abstract parent class, but some of the differences, while subtle, are major enough to make that challenging.

[kenjis]

We will give it some consideration, so please leave it as it is.
In any case, this PR is too large to review easily.

Adding Trait or abstract classes could make the design worse.
We can also suppress errors by PHPCPD.

[tswagger]

That was my thought. I will leave it in your hands. Please let me know if you need anything else from me.

[kenjis]

Cannot reproduce the PHPStan errors.

(feature/HMAC $)$ vendor/bin/phpstan
Note: Using configuration file /Users/kenji/work/codeigniter/official/codeigniter-shield/phpstan.neon.dist.
176/176 [▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓▓] 100%
[OK] No errors 

 ------ -------------------------------------------------------------------- Line src/Models/UserModel.php ------ -------------------------------------------------------------------- 215 Offset 'email' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 216 Cannot unset offset 'email' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 217 Offset 'password_hash' does not exist on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. 218 Cannot unset offset 'password_hash' on array{username: string, status: string, status_message: string, active: bool, last_active: string, deleted_at: string}. ------ -------------------------------------------------------------------- ------ ------------------------------------------------------------------- Line tests/Unit/UserTest.php ------ ------------------------------------------------------------------- Ignored error pattern #^Cannot access property \$active on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. Ignored error pattern #^Cannot access property \$password_hash on array\|object\.$# in path /home/runner/work/shield/shield/tests/Unit/UserTest.php was not matched in reported errors. ------ ------------------------------------------------------------------- Error: [ERROR] Found 6 errors 

https://github.com/codeigniter4/shield/actions/runs/6223741069/job/16907463318?pr=795

[kenjis]

LGTM!

[kenjis]

@tswagger Thank you!

[kenjis]

Oh, my dependencies were old.

 - Upgrading codeigniter/coding-standard (v1.7.8 => v1.7.9)
- Upgrading codeigniter/phpstan-codeigniter (v1.2.0.70400 => v1.3.0.70400)
- Upgrading nexusphp/cs-config (v3.15.0 => v3.16.0)
- Upgrading phpstan/phpdoc-parser (1.24.0 => 1.24.1)

Fixed by #840