Download the PHP package saeven/zf3-circlical-user without Composer

On this page you can find all versions of the php package saeven/zf3-circlical-user. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package zf3-circlical-user

Authentication, Identity, and RBAC for the Laminas Framework

Codacy Badge Codacy Badge Latest Stable Version Total Downloads Quality Gate Status Gitter

Plug and play authentication, roles, resource, and action control for Laminas.

Quickly Installs:

You can see it in action, in this ready-to-use skeleton.

Missive

Sure - there are other Authentication, ACL, and User modules out there. This one comes with out-of-the-box support for Doctrine - just plug in your user entity and go.

Authentication is persisted using cookies, meaning no session usage at all. This was done because I develop for circumstances where this is preferable, removing any need for complex or error-prone solutions for session management on an EC2 auto-scale group for example.

Lastly, authenticated encryption is handled using the well-trusted Halite, and password hashing is properly done with PHP's new password functions. Feedback always solicited on r/php.. If you are a paranoid fellow like me, this library should serve well!

This library works on a deny-first basis. Everything defined by its parts below, are 'allow' grants.

User Authentication

The module provides full identity/auth management, starting at the user-level. A design goal was to connect this to registration or login processes with little more than one-liners.

Login

Validate your submitted Login form, and then execute this to get your user through the door:

$user = $this->auth()->authenticate( $emailOrUsername, $password );

Successful authentication, will drop cookies that satisfy subsequent identity retrieval.

Logout

Trash cookies and regenerate the session key for that user, using this command:

 $this->auth()->clearIdentity();

Pluggable Deny Strategy

Someone trying to do something they shouldn't? It's easy to control what happens with a pluggable DenyStrategy. Create a class that implements DenyStrategyInterface and plug it into your config. This module comes with a default RedirectStrategy that will send users to a login page, if the problem was that there was no auth, and it wasn't an XHTTP request. Easy to use, you'd configure it like so:

'deny_strategy' => [

    'class' => \CirclicalUser\Strategy\RedirectStrategy::class,

    'options' => [
        'controller' => \Application\Controller\LoginController::class,
        'action' => 'index',
    ],
],

Writing your own should be very simple, see provided tests.

Pluggable Password Strength Checker

You can use the built-in support for paragonie/passwdqc by uncommenting the password_strength_checker config key. You can also roll your own if you have more complex needs; uncomment the key and specify your own implementation of PasswordCheckerInterface. This will cause the password input routines to throw WeakPasswordExceptions when weak input is received.

Configuration of the password checker can be done two ways:

Class without options

'password_strength_checker' => \CirclicalUser\Service\PasswordChecker\Passwdqc::class,

Class with options

'password_strength_checker' => [
    'implementation' => \CirclicalUser\Service\PasswordChecker\Zxcvbn::class,
    'config' => [
        'required_strength' => 3,
    ],
],

Creating Access For Your Users

Your app needs to be modified to create a distinct auth record for each user. It's very simple.

create & authenticate

During user registration routines, you probably want to create the records and also log them in. To accomplish this, you can use the helper or the 'create' method on AccessService.

From a Controller, you can use the auth plugin:

 $this->auth()->create(User $user, string $usernameOrEmail, string $password); // controller helper

or, the AuthenticationService:

$container->get(AuthenticationService::class)->create($user, $usernameOrEmail, $password);

create only

Otherwise, if you simply want to create a user auth record but not log them in, use:

$container->get(AuthenticationService::class)->registerAuthenticationRecord(User $user, string $username, string $password)

Roles

Your users belong to hierarchical roles that are configured in the database. The default guest user, is group-less.
Roles are used to restrict access to controllers, actions, or resources.

Guards

Guards are conditions on controllers & actions -- or middleware -- that examine group or user privileges to permit/decline attempted access. It works very similarly to BjyAuthorize (a great module I used for years).

Configuring guards is very simple. Your module's config would look like so:

 return [
    'circlical' => [
        'user' => [
            'guards' => [
                'ModuleName' => [
                    "controllers" => [
                        \Application\Controller\IndexController::class => [
                            'default' => [], // anyone can access
                        ],
                        \Application\Controller\MemberController::class => [
                            'default' => ['user'], // specific role access
                        ],
                        \Application\Controller\AdminController::class => [
                            'default' => ['admin'],
                            'actions' => [  // action-level guards
                                'list' => [ 'user' ], // role 'user' can access 'listAction' on AdminController
                            ],
                        ],
                        \Application\Controller\ComplexController::class => [
                            'default' => ['user'],
                            'actions' => [  // action-level guards
                                'save' => [
                                    AccessService::GUARD_ACTION => 'save',      // you can lean on action/resource rules as well
                                    AccessService::GUARD_RESOURCE => 'complex', // which call 'isAllowed' on AccessService
                                ],
                                'delete' => [
                                    AccessService::GUARD_ROLE => 'admin',       // it is also possible to override the role requirement
                                    AccessService::GUARD_ACTION => 'save',
                                    AccessService::GUARD_RESOURCE => 'complex',
                                ],
                            ],
                        ],
                    ],
                ],
            ],
        ],
    ],
 ];   

If you are defining access for middleware route definitions, then you don't need to configure the 'actions' section above. Further, the Module is then ignored, so you can place your middleware handler's class in any module; example:

 return [
    'circlical' => [
        'user' => [
            'guards' => [
                'Middleware' => [
                    "controllers" => [
                        \Application\Middleware\MiddlewareHandler::class => [
                            'default' => [], // anyone can access
                        ],
                    ],
                ],
            ],
        ],
    ],
 ];  

Resources & Permissions

Resources can be:

Both these usages are valid from a controller:

$this->auth()->isAllowed('door','open');

or if an object:

// server implements ResourceInterface
$server = $serverMapper->get(142);
$this->auth()->isAllowed($server,'shutdown');

The AccessService is also similarly usable. See AccessService tests for more usage examples.

Granting a role a permission is done through the AccessService

User Permissions

You can also give individual users, access to specific actions on resources as well. This library provides Doctrine entities and a mapper to make this happen -- but you could wire your own UserPermissionProviderInterface very easily. In short, this lets the AccessService use the authenticated user to determine whether or not the logged-in individual can perform an action that supersedes what his role permissions otherwise grant. User Permissions are meant to be more permissive, not restrictive.

User API Tokens

This module also provides a utility with which to generate UserApiToken objects. See tests for usage.

Adding the mapping for this entity to your User entity is very trivial

/**
 * @ORM\OneToMany(targetEntity="CirclicalUser\Entity\UserApiToken", mappedBy="user");
 */
private $api_tokens;

Pulling a token to perform your own logic with it, is done with UserApiTokenMapper, e.g.

$token = $this->userApiTokenMapper->get('d0cad39b-f269-405e-b3f9-d45b349c0587');

When it is used/consumed, you can tag it:

$token->tagUse();

Scope (as defined by your application) is defined with bit flags

$token->addScope(FooApi::SCOPE_QUERY);

Cookie Security

You can configure whether or not your cookies should have the secure flag set to 'true' by adjusting the auth/secure_cookies configuration value. This value accepts a boolean or closure if you need to run a discovery method on your server, perhaps, for example, to check if the current request is coming through SSL.

Installation

Composer Tune-Ups

This package's dependency chain depends on doctrine/doctrine-module, which in turn depends on laminas/laminas-cache.

Laminas cache is wired in a strange way, and might attempt to install a ton of problematic adapters (depending on your PHP version). It is recommended that you use composer's replace to keep that mess out of your application, like so:

What's more, since you are using this library, you probably aren't using laminas/laminas-authentication, which is also installed by doctrine-module. You can go ahead and throw this line into your replace block as well:


All versions of zf3-circlical-user with dependencies

PHP Build Version
Package Version
Requires ext-json Version *
php Version ^7.4.0 || ~8.0.12 || ~8.1.0 || ~8.2.0
laminas/laminas-eventmanager Version ^3.4
laminas/laminas-servicemanager Version ^3.7
laminas/laminas-mvc Version ^3.3
laminas/laminas-view Version ^2.13
laminas/laminas-http Version ^2.15
laminas/laminas-router Version ^3.5
doctrine/doctrine-orm-module Version ^4.1|~5.1
doctrine/doctrine-module Version ^4.2|~5.1
doctrine/orm Version ^2.10
paragonie/halite Version ^4.7| ^5.0
ramsey/uuid Version ^4
ramsey/uuid-doctrine Version ^1.6
laminas/laminas-validator Version ^2.15
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package saeven/zf3-circlical-user contains the following files

Loading the files please wait ....