Create the 'yiisoft/auth-session' package to replace the 'yiisoft/user' package

[klsoft-web]

The 'user' term is more relevant to a package that implements the Yiisoft\Auth\IdentityInterface interface, whereas the yiisoft/user package implements various authentication methods via the session:

• The authenticate(ServerRequestInterface $request) method checks if an identity ID is saved in the session.
• The login(IdentityInterface $identity) method sets an identity ID in the session.
• The logout() method removes an identity ID from the session.
  And so on.

The names 'ApiAuth' and 'WebAuth' do not have to be related to the API or web application.
The AuthenticatorInterface is a universal interface for any application that uses sessions.

As the 'yiisoft/user' package contains many misleading names, including its own, the following names were suggested for the new package:

• 'yiisoft/auth-session' instead of 'yiisoft/user'
• AuthManager instead of CurrentUser
• Authenticator instead of ApiAuth and WebAuth

The AuthManager method names are:

• isAuthenticated() instead of isGuest()

Originally posted by @klsoft-web in yiisoft/docs#514

[samdark]

That's a very good idea. We can start a new package and transition to it instead of doing major release for this one. Indeed, your suggested names are good 👍

[samdark]

Do you want to work on it? If so, I can create a new repo for it.

[klsoft-web]

Do you want to work on it? If so, I can create a new repo for it.

Yes, I'll try it.

[klsoft-web]

I would wait until the following issues have been resolved: yiisoft/auth#129,
since I want to implement this: yiisoft/yii-auth-session#4 (comment).

[samdark]

@klsoft-web The issues you have linked are both backwards compatibility breaking and are meant to be implemented in the major release, which is likely not going to happen.

[samdark]

Here you go: https://github.com/yiisoft/yiisoft-auth-session

[klsoft-web]

@klsoft-web The issues you have linked are both backwards compatibility breaking and are meant to be implemented in the major release, which is likely not going to happen.

Let's postpone while the issue: yiisoft/yii-auth-session#4 (comment).

Yes, the issue yiisoft/auth#129 breaks backwards compatibility, but only if you use the $responseFactory parameter when configuring Yiisoft\Auth\Middleware\Authentication.

//config/web/di/application.php
use Psr\Http\Message\ResponseFactoryInterface;
use Yiisoft\Access\AccessCheckerInterface;
use Yiisoft\Auth\AuthenticationMethodInterface;
use Yiisoft\Auth\AuthenticatorInterface;
use Yiisoft\Auth\Middleware\Authentication;
use Yiisoft\User\Method\WebAuth;


return [
    // ...
    AuthenticatorInterface::class => WebAuth::class,
    Authentication::class => static function (ContainerInterface $container) {
        return new Authentication(
            authenticationMethod: $container->get(AuthenticatorInterface::class),
            responseFactory: $container->get(ResponseFactoryInterface::class),
            authenticationFailureHandler: $container->get(MyAuthenticationFailureHandler::class)
        );
    },
];

and, you can still resolve the issue of breaking backwards compatibility:

//config/web/di/application.php
return [
    Authentication::class => [
        '__construct()' => [
            'authenticationFailureHandler' => Reference::to(MyAuthenticationFailureHandler::class),
        ],
    ],
];

However, if you use the standard configuration:

//config/web/di/application.php
use Yiisoft\Auth\AuthenticationMethodInterface;
use Yiisoft\User\Method\WebAuth;

return [
    // ...
    AuthenticationMethodInterface::class => WebAuth::class,
];

or like this:

//config/web/di/application.php
return [
    Authentication::class => [
        '__construct()' => [
            'authenticationFailureHandler' => Reference::to(MyAuthenticationFailureHandler::class),
        ],
    ],
];

You get the same result.

So while the backwards compatibility issue affects a small number of users and you are still resolving it, you will get an additional feature that allows you to configure the RequestHandlerInterface:

//config/web/di/application.php
use Psr\Http\Server\RequestHandlerInterface;

return [
    RequestHandlerInterface::class => MyAuthenticationFailureHandler::class
];

[klsoft-web]

Here you go: https://github.com/yiisoft/yiisoft-auth-session

Why is the repository name yiisoft/yiisoft-auth-session and not yiisoft/auth-session, as with yiisoft/auth-jwt?

[samdark]

Typo. Fixed already.

[samdark]

I've added the package to packagist.

[samdark]

Moved 3.0 issues there.