class.ilAuthSession.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
use ILIAS\Authentication\Domain\SessionRotationPolicy;
use ILIAS\Authentication\Domain\SubmittedSessionId;
 
class ilAuthSession
{
    private const string SESSION_AUTH_AUTHENTICATED = '_authsession_authenticated';
    private const string SESSION_AUTH_USER_ID = '_authsession_user_id';
    private const string SESSION_AUTH_EXPIRED = '_authsession_expired';
 
    private static ?ilAuthSession $instance = null;
 
    private ilLogger $logger;
 
    private string $id = '';
    private int $user_id = 0;
    private bool $expired = false;
    private bool $authenticated = false;
 
    private function __construct(ilLogger $logger)
    {
        $this->logger = $logger;
    }
 
    public static function getInstance(ilLogger $logger): self
    {
        return self::$instance ??= new self($logger);
    }
 
    protected function getLogger(): ilLogger
    {
        return $this->logger;
    }
 
    public function init(SubmittedSessionId $submitted_session_id): bool
    {
        if (session_status() === PHP_SESSION_ACTIVE) {
            $this->getLogger()->error(__METHOD__ . ' called with active session.');
            $this->getLogger()->logStack(ilLogLevel::ERROR);
            return false;
        }
 
        session_start();
 
        $this->setId(session_id());
        $this->rejectForeignSessionIdIfUnknown($submitted_session_id);
 
        $user_id = (int) (ilSession::get(self::SESSION_AUTH_USER_ID) ?? ANONYMOUS_USER_ID);
        if ($user_id) {
            $this->getLogger()->debug('Resuming old session for user: ' . $user_id);
            $this->setUserId($user_id);
            $this->expired = (bool) ilSession::get(self::SESSION_AUTH_EXPIRED);
            $this->authenticated = (bool) ilSession::get(self::SESSION_AUTH_AUTHENTICATED);
 
            $this->validateExpiration();
        } else {
            $this->getLogger()->debug('Started new session.');
            $this->setUserId(ANONYMOUS_USER_ID);
            $this->expired = false;
            $this->authenticated = false;
        }
 
        return true;
    }
 
    public function isValid(): bool
    {
        return !$this->isExpired() && $this->isAuthenticated();
    }
 
    public function regenerateId(): void
    {
        $this->applySessionRotation(SessionRotationPolicy::Rotate);
    }
 
    public function logout(): void
    {
        $this->getLogger()->debug('Logout called for: ' . $this->getUserId());
 
        $this->clearSessionPayload();
 
        session_destroy();
        session_start();
 
        $this->setAuthenticated(ANONYMOUS_USER_ID);
        $this->applySessionRotation(SessionRotationPolicy::Rotate);
    }
 
    public function ensureAnonymousContext(): void
    {
        $this->getLogger()->debug(
            'Ensure anonymous context for: ' . $this->getUserId()
        );
        $this->establishAnonymousAuthState();
    }
 
    public function onLoginSuccess(int $user_id): void
    {
        $this->setAuthenticated($user_id);
        $this->applySessionRotation(SessionRotationPolicy::Rotate);
    }
 
    public function onSessionExpired(): void
    {
        $this->establishAnonymousAuthState();
        $this->applySessionRotation(SessionRotationPolicy::Rotate);
    }
 
    public function isAuthenticated(): bool
    {
        return $this->authenticated || $this->user_id === ANONYMOUS_USER_ID;
    }
 
    private function setAuthenticated(int $a_user_id): void
    {
        $this->authenticated = true;
        $this->user_id = $a_user_id;
        ilSession::set(self::SESSION_AUTH_AUTHENTICATED, true);
        ilSession::set(self::SESSION_AUTH_USER_ID, $a_user_id);
        $this->setExpired(false);
    }
 
    public function isFullyAuthenticated(): bool
    {
        return $this->isValid() && $this->user_id !== ANONYMOUS_USER_ID && $this->user_id > 0;
    }
 
    public function isAnonymouslyAuthenticated(): bool
    {
        return $this->isValid() && $this->user_id === ANONYMOUS_USER_ID;
    }
 
    public function isExpired(): bool
    {
        return $this->expired && $this->user_id !== ANONYMOUS_USER_ID;
    }
 
    public function setExpired(bool $a_status): void
    {
        $this->expired = $a_status;
        ilSession::set(self::SESSION_AUTH_EXPIRED, (int) $a_status);
    }
 
    public function setUserId(int $a_id): void
    {
        $this->user_id = $a_id;
    }
 
    public function getUserId(): int
    {
        return $this->user_id;
    }
 
    protected function validateExpiration(): bool
    {
        if ($this->isExpired()) {
            // keep status
            return false;
        }
 
        if (time() > ilSession::lookupExpireTime($this->getId())) {
            $this->setExpired(true);
            return false;
        }
 
        return true;
    }
 
    protected function setId(string $a_id): void
    {
        $this->id = $a_id;
    }
 
    public function getId(): string
    {
        return $this->id;
    }
 
    private function establishAnonymousAuthState(): void
    {
        if ($this->holdsLoggedInAccount()) {
            $this->clearSessionPayload();
        }
 
        $this->setAuthenticated(ANONYMOUS_USER_ID);
    }
 
    private function holdsLoggedInAccount(): bool
    {
        return $this->user_id > 0 && $this->user_id !== ANONYMOUS_USER_ID;
    }
 
    private function clearSessionPayload(): void
    {
        ilSession::purge();
    }
 
    private function rejectForeignSessionIdIfUnknown(SubmittedSessionId $submitted_session_id): void
    {
        if (defined('IL_PHPUNIT_TEST')) {
            return;
        }
 
        $submitted_id = $submitted_session_id->get();
        if ($submitted_id === '' || $submitted_id !== session_id()) {
            return;
        }
 
        if (!ilSession::exists($submitted_id)) {
            $this->applySessionRotation(SessionRotationPolicy::RejectForeign);
        }
    }
 
    private function applySessionRotation(SessionRotationPolicy $policy): void
    {
        $old_session_id = session_id();
 
        session_regenerate_id(
            $policy === SessionRotationPolicy::Rotate
        );
 
        $this->setId(session_id());
 
        $label = $policy === SessionRotationPolicy::RejectForeign
            ? 'Session reject foreign id'
            : 'Session regenerate id';
        $this->getLogger()->info(
            $label . ': [' . substr($old_session_id, 0, 5) . '] -> [' . substr($this->getId(), 0, 5) . ']'
        );
    }
}