Authentication, session management and RBAC | API

Install

composer require rudra/auth

Usage

use Rudra\Auth\AuthFacade as Auth;

Configuration

For the component to work correctly, you need to add the following parameters to the Rudra configuration file:

# Secret key for encrypting cookies and generating session hashes
secret: your_super_secret_key_here

# Roles for Role-Based Access Control (the smaller the number, the higher the privilege)
roles:
    admin: 0
    editor: 1
    moderator: 2
    user: 3

# Environment (in the 'test' environment, cookies are not deleted on logout)
environment: production

User registration

$user = [
    'email'    => '[email protected]',
    'password' => Auth::bcrypt('password')
];

Getting a user from the database

$user = [
    'email'    => '[email protected]',
    'password' => 'password_hash',
    'role'     => 'admin'
];

Authentication

The second argument is the plain text password entered by the user. The $user['password'] must contain a hash from the database.

Auth::authentication(
    $user, 
    'password', 
    ['admin/dashboard', 'login'],
    ['error' => 'Wrong access data']
);

Note: For the 'Remember Me' feature to work, the login form must contain a checkbox with the name remember_me.

Login form example

<form method='POST' action='/login'>
    <input type='email' name='email' required>
    <input type='password' name='password' required>
    <label>
        <input type='checkbox' name='remember_me'> Remember me / Запомнить меня
    </label>
    <button type='submit'>Login</button>
</form>

Restoring session (Remember Me)

Called at the beginning of the application loading (before authorization check). If the user has valid 'Remember Me' cookies, the session will be restored automatically.

Auth::restoreSessionIfSetRememberMe('login');

Authorization check

General authorization check

Check if the user is authorized. If not — redirect to 'login'

if (!Auth::authorization(null, 'login')) {
    exit;
}

If you just need to get a boolean value without a redirect (for example, for an API):

$isLoggedIn = Auth::authorization(); 

Access to personal user resources

For access control to a specific user's resources (e.g., profile, personal data), a token is used. The token is generated from the user's password, email, and session hash.

// Generate token for the current user
$token = md5($user['password'] . $user['email'] . Auth::getSessionHash());

// Check if the token matches the session token
if (!Auth::authorization($token, 'login')) {
    exit;
}

Role-Based Access Control

Check if the current role ('admin') has privileges not lower than the requested ones ('editor'). If privileges are insufficient — redirect to 'error/403'

use Rudra\Container\Facades\Session;

// Get the role of the current user from the session (for example, after authorization)
if (Session::has('user')) {
   $currentRole = Session::get('user')['role'] ?? 'user';
}

// Check if the permissions are sufficient for access (for example, 'editor' level is required)
if (!Auth::roleBasedAccess($currentRole, 'editor', 'error/403')) {
    exit;
}

Log out of the authentication session with a redirect to the login page

Auth::logout('login');

License

This project is licensed under the Mozilla Public License 2.0 (MPL-2.0) — a free, open-source license that:

• Requires preservation of copyright and license notices,
• Allows commercial and non-commercial use,
• Requires that any modifications to the original files remain open under MPL-2.0,
• Permits combining with proprietary code in larger works.

📄 Full license text: LICENSE
🌐 Official MPL-2.0 page: https://mozilla.org/MPL/2.0/