Auth

Authentication and authorization in Semitexa PHP: session auth, Google sign-in, machine tokens, RBAC and permission checks on protected routes.

• Session Auth

  Google signs the user in, then the session stores the selected demo role and re-hydrates it on every request.

• Session Payloads

  Semitexa forbids string-key session chaos: session state lives in typed Session Payloads or it does not exist.

• CSRF

  Every unsafe request from a browser session, signed in or not, must carry the session's CSRF token; a plain HTML form gets it with csrf_field(), JavaScript with the X-CSRF-Token header.

• Google Authorization

  Sign in with Google in Semitexa PHP: the OAuth flow, CSRF state, a typed session identity, and why long-lived SSE streams require an authenticated user.

• Machine Auth

  Service-to-service authentication via Bearer tokens — issued from the CLI, scoped per route with #[RequiresScope], expiring, rotatable, revocable and audited.

• Protected Route

  Add one access attribute and one optional permission attribute, and the framework enforces access: 401 for unauthenticated requests, 403 for unauthorized ones.

• Requires Permission

  Declare one permission slug on the payload and let the framework enforce it before your handler runs.

• RBAC

  Hybrid RBAC with coarse-grained capabilities, exact permission slugs, and module-owned permission catalogs.

• Encryption and Signed URLs

  Encrypt a value that must come back unread and untouched, and hand out links that prove they came from your application — both keyed from APP_SECRET, with rotation.