AuthController
class AuthController extends Controller (View source)
Handles user authentication, registration, and JWT token lifecycle operations.
This controller provides endpoints for login, logout, token refresh, and user self-identification, all returning JSON-based API responses.
Traits
Trait JsonResponseTrait.
Trait JsonResponseTrait.
Provides standardized and safe error logging with UTF-8 encoding, sensitive data masking, and controlled stack traces.
Constants
| private DUMMY_HASH |
A static hash used to prevent timing attacks when the user does not exist. |
| private MAX_LOGIN_ATTEMPTS |
Maximum allowed login attempts before temporary lockout. |
| private DECAY_SECONDS |
Number of seconds before login attempt counter resets. |
Methods
Return a 200 OK JSON response.
Return a 201 Created JSON response.
Return a 202 Accepted JSON response (request accepted for processing).
Return a 205 Reset Content JSON response.
Return a 400 Bad Request JSON response.
Return a 401 Unauthorized JSON response.
Return a 403 Forbidden JSON response.
Return a 404 Not Found JSON response.
Return a 409 Conflict JSON response.
Return a 422 Unprocessable Entity JSON response for validation errors.
Return a 429 Too Many Requests JSON response.
Return a 500 Internal Server Error JSON response.
Logs an error with consistent formatting and context.
Masks common sensitive fields (e.g., passwords, tokens) in the given context array.
Recursively converts all string values to UTF-8.
Returns a string representation of the exception trace, limited to the given number of lines.
Authenticates a user and issues JWT access and refresh tokens via secure cookies.
Retrieves the currently authenticated user's data.
Logs out the authenticated user by invalidating the current JWT and clearing authentication cookies.
Refreshes the JWT token to extend session validity.
Details
protected JsonResponse
successResponse(array $data = [])
Return a 200 OK JSON response.
protected JsonResponse
createdResponse(array $data = [])
Return a 201 Created JSON response.
protected JsonResponse
acceptedResponse()
Return a 202 Accepted JSON response (request accepted for processing).
protected JsonResponse
noContentResponse()
Return a 204 No Content JSON response.
protected JsonResponse
resetContentResponse()
Return a 205 Reset Content JSON response.
protected JsonResponse
badRequestResponse(array $errors)
Return a 400 Bad Request JSON response.
protected JsonResponse
unauthorizedResponse(string $message = 'Não autorizado.')
Return a 401 Unauthorized JSON response.
protected JsonResponse
forbiddenResponse(string $message = 'Acesso negado.')
Return a 403 Forbidden JSON response.
protected JsonResponse
notFoundResponse(string $message = 'Recurso não encontrado.')
Return a 404 Not Found JSON response.
protected JsonResponse
conflictResponse(array $errors)
Return a 409 Conflict JSON response.
protected JsonResponse
validationErrorResponse(array $errors)
Return a 422 Unprocessable Entity JSON response for validation errors.
protected JsonResponse
tooManyRequestsResponse(string $message = 'Muitas requisições. Tente novamente mais tarde.')
Return a 429 Too Many Requests JSON response.
protected JsonResponse
internalErrorResponse(Throwable $e, string $message = 'Erro interno.')
Return a 500 Internal Server Error JSON response.
Logs the exception and returns a standardized JSON error message.
protected void
logError(string $message, Throwable $exception, array $context = [], string|null $channel = null)
Logs an error with consistent formatting and context.
protected array
sanitizeSensitiveData(array $data)
Masks common sensitive fields (e.g., passwords, tokens) in the given context array.
protected array
encodeStringsUtf8(array $data)
Recursively converts all string values to UTF-8.
protected string
getLimitedTrace(Throwable $exception, int $maxLines = 10)
Returns a string representation of the exception trace, limited to the given number of lines.
JsonResponse
register(UserStoreRequest $request)
Registers the first user in the system.
This method allows registration only if there are no users yet. It ensures that the first admin or root account is securely created.
JsonResponse
login(LoginRequest $request)
Authenticates a user and issues JWT access and refresh tokens via secure cookies.
Validates email and password, enforces rate limiting, and returns a JSON response with basic user information and secure cookies for access and refresh tokens.
Security features:
- Access and refresh cookies are HttpOnly and Secure in non-local environments.
- SameSite=Strict is used to mitigate CSRF attacks.
JsonResponse
me()
Retrieves the currently authenticated user's data.
Parses the JWT token and returns the associated user's basic information.
JsonResponse
logout()
Logs out the authenticated user by invalidating the current JWT and clearing authentication cookies.
The access and refresh cookies are removed to prevent further authenticated requests.
JsonResponse
refresh()
Refreshes the JWT token to extend session validity.