SessionManager

Starts, resumes and ends authenticated sessions.

class SessionManager

The manager owns a Hazaar\Auth\Interface\SessionBackend (where session state lives and how tokens are made) and a Hazaar\Auth\Interface\SessionTransport (how tokens travel between client and server), and keeps the per-request state that says whether the response needs new tokens written to it.

It does not check credentials. Hazaar\Auth\SessionManager::login trusts the Hazaar\Auth\Identity it is given, so it must only be called with an identity an authenticator has verified.

Properties

commitChanges

Whether Hazaar\Auth\SessionManager::commit has tokens to write to (or clear from) the response.

private bool $commitChanges

Type: bool

backend

private SessionBackend $backend

Type: Hazaar\Auth\Interface\SessionBackend

transport

private SessionTransport $transport

Type: Hazaar\Auth\Interface\SessionTransport

Methods

__construct

public __construct(SessionBackend $backend, SessionTransport $transport): void

Parameters

Parameter	Type	Description
$backend	Hazaar\Auth\Interface\SessionBackend
$transport	Hazaar\Auth\Interface\SessionTransport

fromOptions

Builds a session manager from the auth options: the backend and transport options, configured by

public fromOptions(Options $options): self

Returns: self

their sub-arrays (e.g. jwt, cookie) plus expire and refresh.

Parameters

Parameter	Type	Description
$options	Hazaar\Auth\Adapter\Options

createBackend

Builds a session backend from a class-string, configured by the matching auth sub-array (jwt for

public createBackend(SessionBackend|string $backend, array $config): SessionBackend

Returns: Hazaar\Auth\Interface\SessionBackend

JWT, and so on) plus the expire and refresh options. An instance is returned as is.

Parameters

Parameter	Type	Description
$backend	Hazaar\Auth\Interface\SessionBackend	string
$config	array	the auth config

createTransport

Builds a session transport from a class-string, configured by the matching auth sub-array (cookie for

public createTransport(SessionTransport|string $transport, array $config): SessionTransport

Returns: Hazaar\Auth\Interface\SessionTransport

Cookie, and so on). An instance is returned as is.

Parameters

Parameter	Type	Description
$transport	Hazaar\Auth\Interface\SessionTransport	string
$config	array	the auth config

getBackend

public getBackend(): SessionBackend

Returns: Hazaar\Auth\Interface\SessionBackend

setBackend

public setBackend(SessionBackend $backend): void

Returns: void

Parameters

Parameter	Type	Description
$backend	Hazaar\Auth\Interface\SessionBackend

getTransport

public getTransport(): SessionTransport

Returns: Hazaar\Auth\Interface\SessionTransport

setTransport

public setTransport(SessionTransport $transport): void

Returns: void

Parameters

Parameter	Type	Description
$transport	Hazaar\Auth\Interface\SessionTransport

login

Starts a session for a verified identity.

public login(Identity $identity): Result

Returns: Hazaar\Auth\Result

The new tokens are in the result, and are written to the response by Hazaar\Auth\SessionManager::commit.

Parameters

Parameter	Type	Description
$identity	Hazaar\Auth\Identity

resume

Resumes the session for the current request.

public resume(UserProvider $users): bool

Returns: bool

Loads the session from the access token the client sent. If there is none, or it has expired, tries the refresh token instead.

Parameters

Parameter	Type	Description
$users	Hazaar\Auth\Interface\UserProvider	used to re-read the user when refreshing, so a deleted user can't refresh

refresh

Exchanges a refresh token for a new session.

public refresh(?string $token, UserProvider $users): Result

Returns: Hazaar\Auth\Result

The user is looked up again, so a user who has been deleted or disabled since logging in can't refresh, and the session gets their current data.

Parameters

Parameter	Type	Description
$token	string
$users	Hazaar\Auth\Interface\UserProvider

assumeIdentity

Sets the identity for the current request only, without creating a token or persisting anything.

public assumeIdentity(string $identity, array $data): void

Returns: void

Parameters

Parameter	Type	Description
$identity	string
$data	array

logout

Ends the session, and clears the client's tokens on Hazaar\Auth\SessionManager::commit.

public logout(): void

Returns: void

authenticated

public authenticated(): bool

Returns: bool

identity

public identity(): ?string

Returns: string

get

public get(string $key): mixed

Returns: mixed

Parameters

Parameter	Type	Description
$key	string

set

public set(string $key, mixed $value): void

Returns: void

Parameters

Parameter	Type	Description
$key	string
$value	mixed

has

public has(string $key): bool

Returns: bool

Parameters

Parameter	Type	Description
$key	string

public (string $key): void

Returns: void

Parameters

Parameter	Type	Description
$key	string

all

public all(): array

Returns: array

getToken

public getToken(): ?ExpiringToken

Returns: Hazaar\Auth\ExpiringToken

getRefreshToken

public getRefreshToken(): ?ExpiringToken

Returns: Hazaar\Auth\ExpiringToken

commit

Writes new tokens to the response after a login or refresh, or clears them after a logout. Does nothing

public commit(Response $response): void

Returns: void

if neither happened during this request.

Parameters

Parameter	Type	Description
$response	Hazaar\Controller\Response

revokeRefreshToken

Revokes one refresh token.

public revokeRefreshToken(string $token): bool

Returns: bool

Parameters

Parameter	Type	Description
$token	string

revokeAllSessions

Revokes every refresh token of the current identity, logging it out everywhere.

public revokeAllSessions(): bool

Returns: bool

listDevices

Lists the current identity's devices (active refresh-token sessions).

public listDevices(): array

Returns: array

revokeDevice

Revokes one of the current identity's devices.

public revokeDevice(string $sessionId): bool

Returns: bool

Parameters

Parameter	Type	Description
$sessionId	string

persistenceMode

public persistenceMode(): TransportPersistence

Returns: Hazaar\Auth\Enum\TransportPersistence

reset

Drops this request's in-memory state, without ending the session. Must be called at the end of every

public reset(): void

Returns: void

request when the manager is reused across requests (e.g. FrankenPHP worker mode).

---

Generated by Hazaar API Doc Generator on Wed, 28 Oct 2026 08:43:30 +0000