refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
datamweb merged 9 commits into from
Sep 25, 2023
Merged

refactor: move config items #845

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
75cf64d
refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…
kenjis Sep 19, 2023
faf90f6
style: break long lines
kenjis Sep 19, 2023
4664eb7
config: add comments
kenjis Sep 19, 2023
0f85914
config: move items to right place
kenjis Sep 19, 2023
68ce900
refactor: move $usernameValidationRules and $emailValidationRules to …
kenjis Sep 19, 2023
e09b0bf
docs: add UPGRADING.md
kenjis Sep 19, 2023
1ce4093
config: remove unused items
kenjis Sep 19, 2023
b0535e5
docs: fix typos
kenjis Sep 19, 2023
cc5d01f
docs: update config file path
kenjis Sep 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 13 additions & 1 deletion UPGRADING.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down
2 changes: 1 addition & 1 deletion docs/addons/jwt.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
return setting('Validation.login') ?? [
'email' => [
'label' => 'Auth.email',
'rules' => config(AuthSession::class)->emailValidationRules,
'rules' => config('Auth')->emailValidationRules,
],
'password' => [
'label' => 'Auth.password',
Expand Down
2 changes: 1 addition & 1 deletion docs/getting_started/configuration.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down
2 changes: 1 addition & 1 deletion docs/guides/api_hmac_keys.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down
2 changes: 1 addition & 1 deletion docs/guides/api_tokens.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down
4 changes: 2 additions & 2 deletions docs/guides/mobile_apps.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
$rules = setting('Validation.login') ?? [
'email' => [
'label' => 'Auth.email',
'rules' => config('AuthSession')->emailValidationRules,
'rules' => config('Auth')->emailValidationRules,
],
'password' => [
'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.
2 changes: 1 addition & 1 deletion docs/references/authentication/hmac.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down
2 changes: 1 addition & 1 deletion docs/references/authentication/tokens.md
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down
15 changes: 11 additions & 4 deletions src/Authentication/Authenticators/AccessTokens.php
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
return new Result([
'success' => false,
'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
'reason' => lang(
'Auth.noToken',
[config('AuthToken')->authenticatorHeader['tokens']]
),
]);
}

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
// Hasn't been used in a long time
if (
$token->last_used_at
&& $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
&& $token->last_used_at->isBefore(
Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
)
) {
return new Result([
'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
$request = service('request');

return $this->attempt([
'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
'token' => $request->getHeaderLine(
config('AuthToken')->authenticatorHeader['tokens']
),
])->isOK();
}

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
/** @var IncomingRequest $request */
$request = service('request');

$header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
$header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

if (empty($header)) {
return null;
Expand Down
15 changes: 11 additions & 4 deletions src/Authentication/Authenticators/HmacSha256.php
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
return new Result([
'success' => false,
'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
'reason' => lang(
'Auth.noToken',
[config('AuthToken')->authenticatorHeader['hmac']]
),
]);
}

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
// Hasn't been used in a long time
if (
isset($token->last_used_at)
&& $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
&& $token->last_used_at->isBefore(
Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
)
) {
return new Result([
'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
$request = service('request');

return $this->attempt([
'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
'token' => $request->getHeaderLine(
config('AuthToken')->authenticatorHeader['hmac']
),
])->isOK();
}

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
/** @var IncomingRequest $request */
$request = service('request');

$header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
$header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

if ($header === '') {
return null;
Expand Down
141 changes: 77 additions & 64 deletions src/Config/Auth.php
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
/**
* ////////////////////////////////////////////////////////////////////
* AUTHENTICATION
* ////////////////////////////////////////////////////////////////////
*/

// Constants for Record Login Attempts. Do not change.
public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

/**
* ////////////////////////////////////////////////////////////////////
* AUTHENTICATION
* ////////////////////////////////////////////////////////////////////
* --------------------------------------------------------------------
* View files
* --------------------------------------------------------------------
*/
public array $views = [
'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
];

/**
* --------------------------------------------------------------------
* Customize the DB group used for each model
* --------------------------------------------------------------------
*/
public ?string $DBGroup = null;

/**
* --------------------------------------------------------------------
* Customize Name of Shield Tables
* --------------------------------------------------------------------
* Only change if you want to rename the default Shield table names
*
* It may be necessary to change the names of the tables for
* security reasons, to prevent the conflict of table names,
* the internal policy of the companies or any other reason.
*
* - users Auth Users Table, the users info is stored.
* - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
* - auth_logins Auth Login Attempts, Table records login attempts.
* - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
* - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
* - auth_groups_users Groups Users Table.
* - auth_permissions_users Users Permissions Table.
*
* @var array<string, string>
*/
public array $tables = [
'users' => 'users',
'identities' => 'auth_identities',
'logins' => 'auth_logins',
'token_logins' => 'auth_token_logins',
'remember_tokens' => 'auth_remember_tokens',
'groups_users' => 'auth_groups_users',
'permissions_users' => 'auth_permissions_users',
];

/**
* --------------------------------------------------------------------
* Redirect URLs
* --------------------------------------------------------------------
* The default URL that a user will be redirected to after various auth
* auth actions. This can be either of the following:
* actions. This can be either of the following:
*
* 1. An absolute URL. E.g. http://example.com OR https://example.com
* 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
// 'jwt' => JWT::class,
];

/**
* --------------------------------------------------------------------
* Name of Authenticator Header
* --------------------------------------------------------------------
* The name of Header that the Authorization token should be found.
* According to the specs, this should be `Authorization`, but rare
* circumstances might need a different header.
*/
public array $authenticatorHeader = [
'tokens' => 'Authorization',
'hmac' => 'Authorization',
];

/**
* --------------------------------------------------------------------
* Unused Token Lifetime
* --------------------------------------------------------------------
* Determines the amount of time, in seconds, that an unused
* access token can be used.
*/
public int $unusedTokenLifetime = YEAR;

/**
* --------------------------------------------------------------------
* Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
* Record Last Active Date
* --------------------------------------------------------------------
* If true, will always update the `last_active` datetime for the
* loggedin user on every page request.
* logged-in user on every page request.
* This feature only works when session/tokens filter is active.
*
* @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
'rememberLength' => 30 * DAY,
];

/**
* --------------------------------------------------------------------
* The validation rules for username
* --------------------------------------------------------------------
*
* @var string[]
*/
public array $usernameValidationRules = [
'required',
'max_length[30]',
'min_length[3]',
'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
];

/**
* --------------------------------------------------------------------
* The validation rules for email
* --------------------------------------------------------------------
*
* @var string[]
*/
public array $emailValidationRules = [
'required',
'max_length[254]',
'valid_email',
];

/**
* --------------------------------------------------------------------
* Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
* OTHER SETTINGS
* ////////////////////////////////////////////////////////////////////
*/

/**
* --------------------------------------------------------------------
* Customize the DB group used for each model
* --------------------------------------------------------------------
*/
public ?string $DBGroup = null;

/**
* --------------------------------------------------------------------
* Customize Name of Shield Tables
* --------------------------------------------------------------------
* Only change if you want to rename the default Shield table names
*
* It may be necessary to change the names of the tables for
* security reasons, to prevent the conflict of table names,
* the internal policy of the companies or any other reason.
*
* - users Auth Users Table, the users info is stored.
* - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
* - auth_logins Auth Login Attempts, Table records login attempts.
* - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
* - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
* - auth_groups_users Groups Users Table.
* - auth_permissions_users Users Permissions Table.
*
* @var array<string, string>
*/
public array $tables = [
'users' => 'users',
'identities' => 'auth_identities',
'logins' => 'auth_logins',
'token_logins' => 'auth_token_logins',
'remember_tokens' => 'auth_remember_tokens',
'groups_users' => 'auth_groups_users',
'permissions_users' => 'auth_permissions_users',
];

/**
* --------------------------------------------------------------------
* User Provider
Expand Down
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
refactor: move config items#845

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Merged

datamweb
merged 9 commits into

from

Sep 25, 2023
 Merged


refactor: move config items
#845
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


9 commits


Select commit
Hold shift + click to select a range
75cf64d

refactor: move $authenticatorHeader and $unusedTokenLifetime to Confi…


kenjis Sep 19, 2023
faf90f6

style: break long lines


kenjis Sep 19, 2023
4664eb7

config: add comments


kenjis Sep 19, 2023
0f85914

config: move items to right place


kenjis Sep 19, 2023
68ce900

refactor: move $usernameValidationRules and $emailValidationRules to …


kenjis Sep 19, 2023
e09b0bf

docs: add UPGRADING.md


kenjis Sep 19, 2023
1ce4093

config: remove unused items


kenjis Sep 19, 2023
b0535e5

docs: fix typos


kenjis Sep 19, 2023
cc5d01f

docs: update config file path


kenjis Sep 23, 2023

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


14 changes: 13 additions & 1 deletion
UPGRADING.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -2,7 +2,9 @@

## Version 1.0.0-beta.6 to 1.0.0-beta.7

### Install New Config AuthToken.php
### Mandatory Config Changes

#### New Config\AuthToken

A new Config file **AuthToken.php** has been introduced. Run `php spark shield:setup`
again to install it into **app/Config/**, or install it manually.
Expand All@@ -11,6 +13,16 @@ Then change the default settings as necessary. When using Token authentication,
the default value has been changed from all accesses to be recorded in the
``token_logins`` table to only accesses that fail authentication to be recorded.

#### Config\Auth

The following items have been moved. They are no longer used and should be removed.

- `$authenticatorHeader` and `$unusedTokenLifetime` are moved to `Config\AuthToken`.

The following items have been added. Copy the properties in **src/Config/Auth.php**.

- `$usernameValidationRules` and `$emailValidationRules` are added.

## Version 1.0.0-beta.3 to 1.0.0-beta.4

### Important Password Changes
Expand Down

2 changes: 1 addition & 1 deletion
docs/addons/jwt.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -215,7 +215,7 @@ class LoginController extends BaseController
 return setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config(AuthSession::class)->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand Down

2 changes: 1 addition & 1 deletion
docs/getting_started/configuration.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,7 +20,7 @@ This section describes the major Config items that are not described elsewhere.

### Access Token Lifetime

By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/Auth.php** config file.
By default, Access Tokens can be used for 1 year since the last use. This can be easily modified in the **app/Config/AuthToken.php** config file.

```php
public int $unusedTokenLifetime = YEAR;
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_hmac_keys.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -10,7 +10,7 @@ API. When making requests using HMAC keys, the token should be included in the `

> **Note**
> By default, `$authenticatorHeader['hmac']` is set to `Authorization`. You can change this value by
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/Auth.php** config file.
> setting the `$authenticatorHeader['hmac']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateHmacToken()` method on the user. This returns a
`CodeIgniter\Shield\Entities\AccessToken` instance. These shared keys are saved to the database in plain text. The
Expand Down

2 changes: 1 addition & 1 deletion
docs/guides/api_tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -3,7 +3,7 @@
Access Tokens can be used to authenticate users for your own site, or when allowing third-party developers to access your API. When making requests using access tokens, the token should be included in the `Authorization` header as a `Bearer` token.

> **Note**
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change this value by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.

Tokens are issued with the `generateAccessToken()` method on the user. This returns a `CodeIgniter\Shield\Entities\AccessToken` instance. Tokens are hashed using a SHA-256 algorithm before being saved to the database. The access token returned when you generate it will include a `raw_token` field that contains the plain-text, un-hashed, token. You should display this to your user at once so they have a chance to copy it somewhere safe, as this is the only time this will be available. After this request, there is no way to get the raw token.

Expand Down

4 changes: 2 additions & 2 deletions
docs/guides/mobile_apps.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -26,7 +26,7 @@ class LoginController extends BaseController
 $rules = setting('Validation.login') ?? [
 'email' => [
 'label' => 'Auth.email',
 'rules' => config('AuthSession')->emailValidationRules,
 'rules' => config('Auth')->emailValidationRules,
 ],
 'password' => [
 'label' => 'Auth.password',
Expand DownExpand Up@@ -70,6 +70,6 @@ When making all future requests to the API, the mobile client should return the

> **Note**
>
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/Auth.php** config file.
> By default, `$authenticatorHeader['tokens']` is set to `Authorization`. You can change the header name by setting the `$authenticatorHeader['tokens']` value in the **app/Config/AuthToken.php** config file.
>
> e.g. if `$authenticatorHeader['tokens']` is set to `PersonalAccessCodes` then the mobile client should return the raw token in the `PersonalAccessCodes` header as a `Bearer` token.

2 changes: 1 addition & 1 deletion
docs/references/authentication/hmac.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -117,7 +117,7 @@ HMAC Keys/Tokens will expire after a specified amount of time has passed since t
This uses the same configuration value as AccessTokens.

By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

2 changes: 1 addition & 1 deletion
docs/references/authentication/tokens.md

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -81,7 +81,7 @@ $tokens = $user->accessTokens();

Tokens will expire after a specified amount of time has passed since they have been used.
By default, this is set to 1 year. You can change this value by setting the `$unusedTokenLifetime`
value in the `Auth` config file. This is in seconds so that you can use the
value in the **app/Config/AuthToken.php** config file. This is in seconds so that you can use the
[time constants](https://codeigniter.com/user_guide/general/common_functions.html#time-constants)
that CodeIgniter provides.

Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/AccessTokens.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || empty($credentials['token'])) {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['tokens']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['tokens']]
 ),
 ]);
 }

Expand All@@ -149,7 +152,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 $token->last_used_at
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -188,7 +193,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['tokens']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -246,7 +253,7 @@ public function getBearerToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['tokens']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['tokens']);

 if (empty($header)) {
 return null;
Expand Down

15 changes: 11 additions & 4 deletions
src/Authentication/Authenticators/HmacSha256.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -124,7 +124,10 @@ public function check(array $credentials): Result
 if (! array_key_exists('token', $credentials) || $credentials['token'] === '') {
 return new Result([
 'success' => false,
 'reason' => lang('Auth.noToken', [config('Auth')->authenticatorHeader['hmac']]),
 'reason' => lang(
 'Auth.noToken',
 [config('AuthToken')->authenticatorHeader['hmac']]
 ),
 ]);
 }

Expand DownExpand Up@@ -161,7 +164,9 @@ public function check(array $credentials): Result
 // Hasn't been used in a long time
 if (
 isset($token->last_used_at)
 && $token->last_used_at->isBefore(Time::now()->subSeconds(config('Auth')->unusedTokenLifetime))
 && $token->last_used_at->isBefore(
 Time::now()->subSeconds(config('AuthToken')->unusedTokenLifetime)
 )
 ) {
 return new Result([
 'success' => false,
Expand DownExpand Up@@ -200,7 +205,9 @@ public function loggedIn(): bool
 $request = service('request');

 return $this->attempt([
 'token' => $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']),
 'token' => $request->getHeaderLine(
 config('AuthToken')->authenticatorHeader['hmac']
 ),
 ])->isOK();
 }

Expand DownExpand Up@@ -260,7 +267,7 @@ public function getFullHmacToken(): ?string
 /** @var IncomingRequest $request */
 $request = service('request');

 $header = $request->getHeaderLine(config('Auth')->authenticatorHeader['hmac']);
 $header = $request->getHeaderLine(config('AuthToken')->authenticatorHeader['hmac']);

 if ($header === '') {
 return null;
Expand Down

141 changes: 77 additions & 64 deletions
src/Config/Auth.php

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -20,14 +20,21 @@

class Auth extends BaseConfig
{
 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 */

 // Constants for Record Login Attempts. Do not change.
 public const RECORD_LOGIN_ATTEMPT_NONE = 0; // Do not record at all
 public const RECORD_LOGIN_ATTEMPT_FAILURE = 1; // Record only failures
 public const RECORD_LOGIN_ATTEMPT_ALL = 2; // Record all login attempts

 /**
 * ////////////////////////////////////////////////////////////////////
 * AUTHENTICATION
 * ////////////////////////////////////////////////////////////////////
 * --------------------------------------------------------------------
 * View files
 * --------------------------------------------------------------------
 */
 public array $views = [
 'login' => '\CodeIgniter\Shield\Views\login',
Expand All@@ -43,49 +50,12 @@ class Auth extends BaseConfig
 'magic-link-email' => '\CodeIgniter\Shield\Views\Email\magic_link_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * Redirect URLs
 * --------------------------------------------------------------------
 * The default URL that a user will be redirected to after various auth
 * auth actions. This can be either of the following:
 * actions. This can be either of the following:
 *
 * 1. An absolute URL. E.g. http://example.com OR https://example.com
 * 2. A named route that can be accessed using `route_to()` or `url_to()`
Expand DownExpand Up@@ -139,28 +109,6 @@ class Auth extends BaseConfig
 // 'jwt' => JWT::class,
 ];

 /**
 * --------------------------------------------------------------------
 * Name of Authenticator Header
 * --------------------------------------------------------------------
 * The name of Header that the Authorization token should be found.
 * According to the specs, this should be `Authorization`, but rare
 * circumstances might need a different header.
 */
 public array $authenticatorHeader = [
 'tokens' => 'Authorization',
 'hmac' => 'Authorization',
 ];

 /**
 * --------------------------------------------------------------------
 * Unused Token Lifetime
 * --------------------------------------------------------------------
 * Determines the amount of time, in seconds, that an unused
 * access token can be used.
 */
 public int $unusedTokenLifetime = YEAR;

 /**
 * --------------------------------------------------------------------
 * Default Authenticator
Expand DownExpand Up@@ -201,7 +149,7 @@ class Auth extends BaseConfig
 * Record Last Active Date
 * --------------------------------------------------------------------
 * If true, will always update the `last_active` datetime for the
 * loggedin user on every page request.
 * logged-in user on every page request.
 * This feature only works when session/tokens filter is active.
 *
 * @see https://codeigniter4.github.io/shield/install/#protect-all-pages for set filters.
Expand DownExpand Up@@ -250,6 +198,33 @@ class Auth extends BaseConfig
 'rememberLength' => 30 * DAY,
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for username
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $usernameValidationRules = [
 'required',
 'max_length[30]',
 'min_length[3]',
 'regex_match[/\A[a-zA-Z0-9\.]+\z/]',
 ];

 /**
 * --------------------------------------------------------------------
 * The validation rules for email
 * --------------------------------------------------------------------
 *
 * @var string[]
 */
 public array $emailValidationRules = [
 'required',
 'max_length[254]',
 'valid_email',
 ];

 /**
 * --------------------------------------------------------------------
 * Minimum Password Length
Expand DownExpand Up@@ -393,6 +368,44 @@ class Auth extends BaseConfig
 * OTHER SETTINGS
 * ////////////////////////////////////////////////////////////////////
 */

 /**
 * --------------------------------------------------------------------
 * Customize the DB group used for each model
 * --------------------------------------------------------------------
 */
 public ?string $DBGroup = null;

 /**
 * --------------------------------------------------------------------
 * Customize Name of Shield Tables
 * --------------------------------------------------------------------
 * Only change if you want to rename the default Shield table names
 *
 * It may be necessary to change the names of the tables for
 * security reasons, to prevent the conflict of table names,
 * the internal policy of the companies or any other reason.
 *
 * - users Auth Users Table, the users info is stored.
 * - auth_identities Auth Identities Table, Used for storage of passwords, access tokens, social login identities, etc.
 * - auth_logins Auth Login Attempts, Table records login attempts.
 * - auth_token_logins Auth Token Login Attempts Table, Records Bearer Token type login attempts.
 * - auth_remember_tokens Auth Remember Tokens (remember-me) Table.
 * - auth_groups_users Groups Users Table.
 * - auth_permissions_users Users Permissions Table.
 *
 * @var array<string, string>
 */
 public array $tables = [
 'users' => 'users',
 'identities' => 'auth_identities',
 'logins' => 'auth_logins',
 'token_logins' => 'auth_token_logins',
 'remember_tokens' => 'auth_remember_tokens',
 'groups_users' => 'auth_groups_users',
 'permissions_users' => 'auth_permissions_users',
 ];

 /**
 * --------------------------------------------------------------------
 * User Provider
Expand Down
Loading