Session Auth

Walkthrough

1. 1

   Start a session, hash passwords

   Auth::file($path) auto-starts the session, lazy-creates users.json, and uses password_hash(PASSWORD_DEFAULT) for storage and password_verify for comparison. Plaintext passwords never touch disk.

   PHP Copy

   use DemoBuilder\Auth;
   
   $auth = Auth::file(__DIR__ . '/users.json');
   
   // Register: hashes + persists + auto-logs-in.
   $auth->register('alice@example.com', 'a-good-password');
   
   // Login: verifies + writes the user-id into the session.
   if (!$auth->login($email, $password)) {
       JsonResponse::error('Invalid credentials', 401);
   }
   
   $user = $auth->currentUser();   // ['id' => 1, 'email' => '…']

2. 2

   Guard the save endpoint

   On every save call, $auth->requireUser() returns the row or emits 401 + exit. The save handler can assume $user is non-null after the guard and key the storage path by user['id'].

   PHP Copy

   $user = $auth->requireUser();   // 401 + exit if not logged-in
   
   $payload = Validator::make($_POST)
       ->required('slug')->regex('/^[a-z0-9-]+$/i')->maxLength(120)
       ->required('html')->maxLength(5_000_000)
       ->required('data')->maxLength(10_000_000)
       ->validateOrFail();
   
   $dir  = $storageRoot . '/' . (int) $user['id'];
   $slug = (string) $payload['slug'];
   file_put_contents("$dir/$slug.html", $payload['html']);
   file_put_contents("$dir/$slug.json", $payload['data']);

3. 3

   Wire the builder

   Point endpoints.save in $builderConfig at save-as-user.php. The browser already carries the PHPSESSID cookie, so the saved data lands under that user's directory automatically. Logged-out clicks return 401; the chrome's toast surfaces the error.

   PHP Copy

   // demo/builder.php — top of file
   $builderConfig = [
       'endpoints' => [
           'save' => '/examples/backend/3-auth/save-as-user.php',  // ← here
           // …
       ],
       // …
   ];

4. 4

   Swap to PDO for production

   When you outgrow a flat file, swap to PDO with one line. The Auth::pdo($pdo) driver expects a users table; the schema is in _lib/Auth.php's class DocBlock and reproduced below. Same fluent API; same session contract.

   PHP Copy

   use DemoBuilder\Db;
   use DemoBuilder\Auth;
   
   $pdo  = Db::connect();           // resolves DB_DSN env
   $auth = Auth::pdo($pdo);
   
   // Schema (run once):
   //   CREATE TABLE users (
   //     id            INTEGER PRIMARY KEY AUTOINCREMENT,
   //     email         TEXT NOT NULL UNIQUE,
   //     password_hash TEXT NOT NULL,
   //     created_at    TEXT NOT NULL DEFAULT (CURRENT_TIMESTAMP)
   //   );