lyra
b89070e985
Documentation: - Create CHANGELOG.md with full version history (v0.0.1 through unreleased) - Rewrite README with comprehensive setup guide, configuration reference, architecture overview, security model, and feature list - Update ROADMAP.md: fix branch status table, mark completed security review items, update TOTP leeway description - Fix 'centeral' typo in docs/Caddyfile - Remove TODO comment from docs/compose.yaml - Add DESIGN_CONSIDERATIONS.md (design review document) Code quality: - Extract duplicated cookie name/domain logic into CookieNameTrait methods: sessionCookieName() and sessionCookieDomain() - Update AcceptListener, AllowListener, InterceptListener, and LoginManager to use the shared methods - Remove fragile cross-file coupling comment between LoginManager and InterceptListener Error handling: - Wrap cache operations in AcceptListener and AllowListener with try/catch to fail closed (don't authenticate on cache errors) - Log cache errors at error level instead of propagating as 500s - Early return pattern in AcceptListener and AllowListener for cleaner control flow
49 lines
1.4 KiB
PHP
49 lines
1.4 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace App\Trait;
|
|
|
|
use App\Service\DomainInterface;
|
|
|
|
trait CookieNameTrait
|
|
{
|
|
private const string COOKIE_NAME = '__Host-Http-Preauth';
|
|
private const string AUTH_COOKIE_NAME = '__Http-Domain-Preauth';
|
|
private const string HEADER_NAME = 'X-Preauth';
|
|
|
|
final protected function cookieName(): string
|
|
{
|
|
return static::COOKIE_NAME;
|
|
}
|
|
|
|
final protected function authCookieName(): string
|
|
{
|
|
return static::AUTH_COOKIE_NAME;
|
|
}
|
|
|
|
final protected function headerName(): string
|
|
{
|
|
return static::HEADER_NAME;
|
|
}
|
|
|
|
/**
|
|
* Returns the appropriate cookie name based on whether central auth is active.
|
|
* Uses the __Host- prefix for single-domain mode (no Domain attribute),
|
|
* and a non-prefixed name for central auth (Domain attribute required).
|
|
*/
|
|
final protected function sessionCookieName(DomainInterface $domainManager): string
|
|
{
|
|
return $domainManager->authBase() ? $this->authCookieName() : $this->cookieName();
|
|
}
|
|
|
|
/**
|
|
* Returns the cookie domain for central auth mode, or null for single-domain.
|
|
* The domain is only set when the host matches the auth base domain.
|
|
*/
|
|
final protected function sessionCookieDomain(DomainInterface $domainManager, string $host): ?string
|
|
{
|
|
return $domainManager->matchesAuth($host) ? $domainManager->authBase() : null;
|
|
}
|
|
}
|