Redux Authentication 1.4a (24th July 2008)

[eluser]Mellis[/eluser]
This is a response to the previous post (#270)

Hello,

This is how I handle authentication in an application with redux auth.

I altered some files:
(btw sorry that documentation in the code is non existent at the moment)

./app/libraries/redux_auth.php

// added this to constructor:

Code:

...

    /**
    * get group->titles and group->ids from the groups table and define them as constants
    * this defines USER = 2, ADMINISTRATOR = ... (and other groups i have created) as constants
    */
        $this->_define_groups();

    /*
    *
    * Set permissions for different sections in the application here
    * AED_ELEMENT stands for: ADD, EDIT and DELETE ELEMENT
    */
    define('USER_ACC', USER + MODERATOR + ADMINISTRATOR);
    define('ADMIN_ACC', ADMINISTRATOR);
    
            
    define('ENTER_APP', USER + MODERATOR + ADMINISTRATOR);
    define('REGISTER_USER', ADMINISTRATOR);

     define('AED_SHOP', ADMINISTRATOR);

}

this is the function used in the constructor

Code:

/**
* _get_groups
* this function gets all the groups out of the groups table
* this function is used to define the rights in the application
**/
protected function _get_groups($groups)
{
    $i = $this->ci->db->select($groups.'.id, '.$groups.'.title')
    ->from($groups)
    ->order_by('id','asc')
    ->get();
            
    return $var = ($i->num_rows() > 0) ? $i->result() : false;
}
        
public function get_groups(){return $this->_get_groups($this->groups_table);}

/**
*
**/
protected function _define_groups()
{
$groups = $this->get_groups();
            
    foreach($groups as $object)
    {
    define($object->title, $object->id);
    }
}

This is the code I added to the library to be able to check if a user belongs to the right group for a certain area of the app.

Code:

/**
* if the second argument is set to 'LOGIN', this function will redirect to the
* login page (set in config[auth][auth_controller] + 'login')
**/
public function is_auth($sectionlevel, $redirect = FALSE)
{    
    $userlevel = $this->get_group_id($this->ci->session->userdata('id'));
            
    $authorized = false;
            
      if($userlevel && $sectionlevel)
        {
        //use bitwise AND operator to check if user has access
        $authorized = ($userlevel & $sectionlevel) > 0;
        }

          if(!$authorized)
        {
        switch($redirect)
        {
            case 'LOGIN':
        $this->logout();
        $this->ci->session->set_flashdata('auth', $this->ci->uri->uri_string());
        redirect($this->auth_controller.'login/');
                    
            default:
            //nutt'n yet, just return false if not authorized
        }
    }
                        
    return $authorized;
            
}

I have altered the logout function in redux_auth because I was unable to send flashdata through the is_auth() function (was caused by the sess_destroy)

Code:

/**
    * logout
    *
    * @access public
    * @param void
    * @return void
    **/
    public function logout ()
    {
        $this->ci->session->unset_userdata('id');
        //I disabled this line because it's unnecessary and this way i can still use flashdata
        //and logout a user at the same time.
        //$this->ci->session->sess_destroy();
        }

this is what is altered in my login function in my user controller:
./app/controller/user_controller.php

Code:

public function login()
    {
      //set validation rules
                
        if ($this->validation->run())
        {
                            
          $login = $this->redux_auth->login
            (
                $this->input->post('email'),
                $this->input->post('password')
            );
            
            if($login)
            {
            // redirects to the path saved in flashdata('auth') through the is_auth() function in redux_auth library
              $rdr = ($this->session->flashdata('auth')) ? $this->session->flashdata('auth') : $this->redux_auth->route_start;

              redirect($rdr);
            }
            else
            {
            // whatever
            }
        }
        else
        {
   // keep the flash data alive that was received through is_auth() function in redux_auth library
          if($this->session->flashdata('auth')){$this->session->keep_flashdata('auth');}
          //display data
        }
    }

and then, anywhere I want (and load the redux_auth library) I check for the right level of auth like this:

./app/controller/shop_controller.php

Code:

public function shop($id, $next)
{
        
  $this->redux_auth->is_auth(AED_SHOP, 'LOGIN');

  ...
}

or you can use it in the constructor of the controller to check with the same arguments for every function in that controller
or you can use it without the second argument and check like this:

Code:

if($this->redux_auth->is_auth(AED_SHOP, 'LOGIN'))
{
...
}

for whatever secion I have, I can create a new privilege rule.

This works for me, however I have some questions of my own:
There must be a better place to declare the rights than the constructor of the redux_auth library. Anybody have a suggestion?
Is it ok to just unset the userdata('id') to log someone out? (seems fine, but maybe I'm missing something)
Does anybody have any suggestions in general?

Thanks in advance.
And hope this helps a little.

Bye now.