Layer: Core · Source: lib/core/ApiAuth.php:21 (lines 21–590)

class ApiAuth

API Authentication

Handles token-based authentication for the RESTful API Supports API Key and Bearer Token authentication

^ Tag ^ Value ^
| ''@category'' | Core Class |
| ''@author'' | Blogware Team |
| ''@license'' | MIT |
| ''@version'' | 1.0 |
| ''@since'' | Since Release 1.0 |

No parent, interface or trait. This is a root type.

^ Visibility ^ Name ^ Value ^ Line ^
| ''-'' | ''AUTH_API_KEY'' | '''api_key';'' | 26 |
| ''-'' | ''AUTH_BEARER'' | '''bearer';'' | 27 |
| ''-'' | ''AUTH_NONE'' | '''none';'' | 28 |
| ''-'' | ''TOKEN_EXPIRY'' | ''86400;'' | 34 |
| ''-'' | ''MAX_LOGIN_ATTEMPTS'' | ''5;'' | 39 |
| ''-'' | ''LOCKOUT_DURATION'' | ''900;'' | 44 |

^ Visibility ^ Type ^ Name ^ Default ^ Line ^
| ''private static'' | ''static'' | ''$user'' | ''null;'' | 49 |
| ''private static'' | ''static'' | ''$authType'' | ''self::AUTH_NONE;'' | 54 |
| ''private static'' | ''static'' | ''$isAuthenticated'' | ''false;'' | 59 |

^ Visibility ^ Method ^ Summary ^ Line ^
| public static | ''authenticate()'' | Initialize and authenticate the request | 66 |
| private static | ''authenticateWithApiKey()'' | Authenticate using API Key | 95 |
| private static | ''authenticateWithToken()'' | Authenticate using Bearer Token | 170 |
| private static | ''getApiKey()'' | Get API Key from request headers | 226 |
| private static | ''getBearerToken()'' | Get Bearer Token from request headers | 238 |
| public static | ''isAuthenticated()'' | Check if user is authenticated | 254 |
| public static | ''getUser()'' | Get authenticated user data | 264 |
| public static | ''getUserId()'' | Get authenticated user ID | 274 |
| public static | ''getUserLevel()'' | Get authenticated user level | 284 |
| public static | ''getAuthType()'' | Get authentication type used | 294 |
| public static | ''hasPermission()'' | Check if user has required permission level | 305 |
| private static | ''isAccountLocked()'' | Check if account is locked | 326 |
| private static | ''logAccess()'' | Log API access attempt | 343 |
| private static | ''hasApiOrBearerAuth()'' | Check whether the current request carries API-key or Bearer auth headers. | 396 |
| public static | ''validateCsrfForWrite()'' | (undocumented) | 408 |
| public static | ''generateCsrfToken()'' | Generate a CSRF token for API write operations and store it in session. | 463 |
| private static | ''getClientIp()'' | Get client IP address | 484 |
| public static | ''setSessionUser()'' | Set authenticated user from session-based authentication | 501 |
| public static | ''getUserLogin()'' | Get authenticated user login name | 513 |
| public static | ''generateApiKey()'' | Generate API key for a user | 528 |
| public static | ''revokeApiKey()'' | Revoke all API keys for a user | 559 |
| public static | ''revokeApiKeyById()'' | Revoke a specific API key by ID | 578 |

public static function authenticate()

lines 66–83 (18)

Initialize and authenticate the request

Takes no parameters.

Returns: (none declared) — bool Whether authentication was successful

private static function authenticateWithApiKey($apiKey)

lines 95–162 (68)

Authenticate using API Key

Looks up the key in the dedicated tbl_api_keys table and verifies it against the stored password_hash(). Falls back to direct comparison for legacy plaintext keys that may exist in tbl_settings.

^ Parameter ^ Type ^ Default ^ Description ^
| ''$apiKey'' | ''(untyped)'' | //required// | The API key |

Returns: (none declared) — bool Authentication success

private static function authenticateWithToken($token)

lines 170–216 (47)

Authenticate using Bearer Token

^ Parameter ^ Type ^ Default ^ Description ^
| ''$token'' | ''(untyped)'' | //required// | The bearer token |

Returns: (none declared) — bool Authentication success

private static function getApiKey()

lines 226–231 (6)

Get API Key from request headers

Only the X-API-Key header is accepted. Query-string keys were removed: they leak into access logs and defeat the point of a secret header.

Takes no parameters.

Returns: (none declared) — string|null

private static function getBearerToken()

lines 238–247 (10)

Get Bearer Token from request headers

Takes no parameters.

Returns: (none declared) — string|null

public static function isAuthenticated()

lines 254–257 (4)

Check if user is authenticated

Takes no parameters.

Returns: (none declared) — bool

public static function getUser()

lines 264–267 (4)

Get authenticated user data

Takes no parameters.

Returns: (none declared) — array|null

public static function getUserId()

lines 274–277 (4)

Get authenticated user ID

Takes no parameters.

Returns: (none declared) — int|null

public static function getUserLevel()

lines 284–287 (4)

Get authenticated user level

Takes no parameters.

Returns: (none declared) — string|null

public static function getAuthType()

lines 294–297 (4)

Get authentication type used

Takes no parameters.

Returns: (none declared) — string

public static function hasPermission($requiredLevels)

lines 305–318 (14)

Check if user has required permission level

^ Parameter ^ Type ^ Default ^ Description ^
| ''$requiredLevels'' | ''(untyped)'' | //required// | Required user level(s) |

Returns: (none declared) — bool

private static function isAccountLocked($user)

lines 326–335 (10)

Check if account is locked

^ Parameter ^ Type ^ Default ^ Description ^
| ''$user'' | ''(untyped)'' | //required// | User data |

Returns: (none declared) — bool

private static function logAccess($userId, $success)

lines 343–378 (36)

Log API access attempt

^ Parameter ^ Type ^ Default ^ Description ^
| ''$userId'' | ''(untyped)'' | //required// | User ID (0 if failed) |
| ''$success'' | ''(untyped)'' | //required// | Whether authentication was successful |

Returns: (none declared)

private static function hasApiOrBearerAuth()

lines 396–406 (11)

Check whether the current request carries API-key or Bearer auth headers.

Takes no parameters.

Returns: (none declared) — bool

public static function validateCsrfForWrite()

lines 408–456 (49)

Takes no parameters.

Returns: (none declared)

public static function generateCsrfToken()

lines 463–471 (9)

Generate a CSRF token for API write operations and store it in session.

Takes no parameters.

Returns: (none declared) — string The generated token

private static function getClientIp()

lines 484–489 (6)

Get client IP address

Delegates to the application-wide get_ip_address() helper, which trusts only REMOTE_ADDR (or a Cloudflare CF-Connecting-IP header). Client-supplied forwarding headers (X-Forwarded-For etc.) are never trusted, so the login-attempt and rate-limit accounting cannot be bypassed by spoofing. Falls back to the “0.0.0.0” sentinel when no REMOTE_ADDR is present.

Takes no parameters.

Returns: (none declared) — string

public static function setSessionUser(array $userData, $authType = 'session')

lines 501–506 (6)

Set authenticated user from session-based authentication

Used by MediaApiController and other admin panel entry points that authenticate via session/cookie rather than API key/token.

^ Parameter ^ Type ^ Default ^ Description ^
| ''$userData'' | ''array'' | //required// | Must contain 'user_login' and optionally 'user_level' |
| ''$authType'' | ''(untyped)'' | '''session''' | The authentication type (default: 'session') |

Returns: (none declared) — void

public static function getUserLogin()

lines 513–516 (4)

Get authenticated user login name

Takes no parameters.

Returns: (none declared) — string|null

public static function generateApiKey($userId, $description = '')

lines 528–549 (22)

Generate API key for a user

Stores the key hash (bcrypt) in the dedicated tbl_api_keys table and returns the raw key to the caller for one-time display.

^ Parameter ^ Type ^ Default ^ Description ^
| ''$userId'' | ''(untyped)'' | //required// | User ID |
| ''$description'' | ''(untyped)'' | '''''' | Optional description for the key |

Returns: (none declared) — string Generated API key (plaintext, show once)

public static function revokeApiKey($userId)

lines 559–570 (12)

Revoke all API keys for a user

Sets is_revoked = 1 on all active keys for the given user.

^ Parameter ^ Type ^ Default ^ Description ^
| ''$userId'' | ''(untyped)'' | //required// | User ID |

Returns: (none declared) — bool Success

public static function revokeApiKeyById($keyId)

lines 578–589 (12)

Revoke a specific API key by ID

^ Parameter ^ Type ^ Default ^ Description ^
| ''$keyId'' | ''(untyped)'' | //required// | The API key ID |

Returns: (none declared) — bool Success

This page is generated from source by 'tools/gendoc'. Edits will be overwritten.