Documentation: An alternative login workflow

[weierophinney]

As requested in #19 here is my current login workflow.

I've laid out all the related code in this gist

I'm not sure how to present an alternative workflow in the documentation therefor I'm starting this discussion to figure out the how's and where's. If you want take the code and incorporate it into the documentation yourselves then that's fine too, I'm not much of a documentation guy 😄

---

Originally posted by @jonsa at zendframework/zend-expressive-authentication-session#20

[kfeldt]

Thank you - this solution was helpful as the PhPSession class in the documented example wasn't managing the referrer properly.

[froschdesign]

@kfeldt
I haven't tried the alternative solution, but should we include this solution in the documentation?

[imonteiro]

Hi everyone,

I just implement a different workflow, and now I see this topic. I try to adapt the current example in documentation, to the following code.

class UserMiddleware implements MiddlewareInterface
{
    private const REDIRECT_ATTRIBUTE = 'authentication:redirect';

    /** @var callable */
    private $user;

    public function __construct(callable $user, string $redirect)
    {
        $this->user     = $user;
        $this->redirect = $redirect;
    }

    public function process(
        ServerRequestInterface $request,
        RequestHandlerInterface $handler
    ): ResponseInterface {
        $session     = $request->getAttribute(SessionMiddleware::SESSION_ATTRIBUTE);
        $sessionData = $session->get(UserInterface::class);

        $currentPath = $request->getUri()->getPath() ?? '/';
        if ($currentPath != '/login' && $currentPath != '/logout') {
            $session->set(self::REDIRECT_ATTRIBUTE, $currentPath);
        }

        $request  = $request->withAttribute(
            UserInterface::class,
            $user = ($this->user)($sessionData['username'] ?? '', $sessionData['roles'] ?? ['guest'])
        );

        $response      = $handler->handle($request);
        $isGuest       = current($user->getRoles()) === 'guest';
        $isAtLoginPage = $request->getUri()->getPath() === $this->redirect;

        if (! $isGuest && $isAtLoginPage) {
            $session->unset(self::REDIRECT_ATTRIBUTE);
            return new RedirectResponse($currentPath);
        }

        return $response;
    }
}

At LoginHandler, after login successful I change the code to:
(removed all other stuff, which are implemented at UserMiddleware)

        // Login was successful
        if ($this->adapter->authenticate($request)) {
            $redirect = $session->get(self::REDIRECT_ATTRIBUTE) ?? '/';
            $session->unset(self::REDIRECT_ATTRIBUTE);
            return new RedirectResponse($redirect);
        }

Is this a "good" practise? Or this example is a better approach?

Thanks.