SessionBackend

interface SessionBackend

Methods

__construct

Construct the session.

public __construct(array $config): void

Parameters

Parameter	Type	Description
$config	array

create

Creates a new session for the given identity with the provided data.

public create(string $identity, array $data): ExpiringToken

Returns: Hazaar\Auth\ExpiringToken

Parameters

Parameter	Type	Description
$identity	string
$data	array

assumeIdentity

Establishes in-memory identity/data for the current request without issuing a token.

public assumeIdentity(string $identity, array $data): void

Returns: void

Unlike Hazaar\Auth\Interface\SessionBackend::create, this does not generate or sign a token and does not write to any persisted storage (no cache entry, no PHP session, no cookie) — it only sets this backend instance's in-memory identity/data, for the current request only. After calling this, Hazaar\Auth\Interface\SessionBackend::isEmpty, Hazaar\Auth\Interface\SessionBackend::getIdentity, Hazaar\Auth\Interface\SessionBackend::read, and the has()/get()/unset() accessors must behave exactly as they would after a successful Hazaar\Auth\Interface\SessionBackend::load.

This exists for services that have already verified an identity through some channel other than a session token (e.g. validating an API key against another system) and want to mark the current request as authenticated for that identity. No token needs to be issued because the client will simply re-present its own credential on the next request, and — importantly — this must not require anything a verify-only service lacks (e.g. a private signing key).

Parameters

Parameter	Type	Description
$identity	string
$data	array

load

Validates the given session token and optionally populates session data.

public load(string $token, ?array $sessionData, string $tokenType = 'access', ?string $passphrase): bool

Returns: bool

Parameters

Parameter	Type	Description
$token	string
$sessionData	array
$tokenType	string
$passphrase	string

getToken

Retrieve the current authentication token from the session backend.

public getToken(): ?ExpiringToken

Returns: Hazaar\Auth\ExpiringToken

getRefreshToken

Retrieve the current refresh token from the session backend.

public getRefreshToken(): ?ExpiringToken

Returns: Hazaar\Auth\ExpiringToken

refresh

Refreshes the authentication session using the provided token.

public refresh(string $token): bool

Returns: bool

Parameters

Parameter	Type	Description
$token	string

getIdentity

Retrieves the identity associated with the current session.

public getIdentity(): ?string

Returns: string

isEmpty

Determines if the session backend is empty.

public isEmpty(): bool

Returns: bool

has

Checks if a key exists in session.

public has(string $key): bool

Returns: bool

Parameters

Parameter	Type	Description
$key	string

get

Gets a value from session.

public get(string $key): mixed

Returns: mixed

Parameters

Parameter	Type	Description
$key	string

set

Sets a value in session.

public set(string $key, mixed $value): void

Returns: void

Parameters

Parameter	Type	Description
$key	string
$value	mixed

Unsets a value in session.

public (string $key): void

Returns: void

Parameters

Parameter	Type	Description
$key	string

clear

Clears data from session.

public clear(): void

Returns: void

This destroys the persisted session (e.g. cache entry, PHP session, or logical equivalent) as part of a logout. Contrast with Hazaar\Auth\Interface\SessionBackend::reset.

reset

Resets all in-memory session state on this backend instance.

public reset(): void

Returns: void

Unlike Hazaar\Auth\Interface\SessionBackend::clear, this must NOT touch persisted storage (no cache eviction, no session_destroy(), etc). It only drops the backend's in-memory reference to whatever identity/data it currently holds.

This exists so that a single long-lived backend instance (e.g. when an authentication adapter singleton is reused across requests, such as under FrankenPHP worker mode) can be safely reused for the next, unrelated request without leaking the previous request's identity/session data.

read

Reads and returns the session data.

public read(): array

Returns: array

---

Generated by Hazaar API Doc Generator on Fri, 04 Sep 2026 23:32:17 +0000