psycodepath/hrp
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages 1 Wiki Activity Actions

issue/4-sessions-auth #10

Merged
psycodepath merged 2 commits from issue/4-sessions-auth into main 2026-07-03 18:50:50 +00:00
Conversation 0 Commits 2 Files changed 8 +461 -8
psycodepath commented 2026-07-03 18:50:45 +00:00
Owner
Copy link
No description provided. 
- Add TenantAwareSessionManager for per-tenant session isolation
- Implement TenantAwareLocalSessionAuthenticationService
- Session cookies scoped to tenant-specific subdomains
- Session data partitioned by tenant within global $_SESSION
- Prevent cross-tenant session hijacking via domain scoping
- Add comprehensive unit tests for session isolation
- Add Behat feature tests for authentication scenarios
- Add step definitions for session isolation verification

Session initialization configures:
- Cookie domain scoped to tenant subdomain (e.g., family1.localhost)
- HttpOnly flag for security
- Secure flag in production (HTTPS only)
- Per-tenant session containers in $_SESSION['tenants'][$tenantId]

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
fix: resolve all critical, important, and minor code review findings
Some checks failed
CI/CD Pipeline / test (pull_request) Failing after 2s
Details
CI/CD Pipeline / build-and-push (pull_request) Failing after 0s
Details
ed80354cbd 
CRITICAL FIXES:
1. SessionManager.php:127 - Fix operator precedence in production check
   - Changed: ($_ENV['APP_ENV'] ?? getenv('APP_ENV') === 'production')
   - To: (($_ENV['APP_ENV'] ?? getenv('APP_ENV')) === 'production')
   - Ensures secure flag only set in production environment

2. MigrationRunner.php:98-99 - Fix misleading lock comment
   - Changed comment from 'non-blocking' to accurate description
   - flock(LOCK_EX) is blocking, used to ensure only one process migrates

IMPORTANT FIXES:
3. SessionManager.php:71-74 - Add session initialization check
   - Check session_status() !== PHP_SESSION_ACTIVE before accessing $_SESSION
   - Prevents E_WARNING on array key access

4. PdoFactory.php:21-29 - Add error handling for PDO creation
   - Wrap in try-catch for PDOException
   - Throw RuntimeException with context (tenant ID, path, original error)

5. MigrationRunner.php:86-108 - Add proper lock error handling
   - fopen() failure now throws RuntimeException instead of silent null
   - flock() check validates lock was actually acquired
   - Prevents race conditions when lock fails

MINOR FIX:
6. TenantContextHolder.php:31-35 - Add validation logging
   - Log warning when getTenantIdForDatabase() called without setFromRequest()
   - Helps detect integration issues where tenant context wasn't initialized

All 84 unit tests pass with these changes.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
psycodepath/hrp!10
No description provided.