MfaSessionManager
class MfaSessionManager (View source)
MfaSessionManager
Centralizes all MFA-related session operations to provide consistency across different parts of the application.
Methods
No description
Flags a user as requiring MFA verification
Marks MFA as completed and sets the user as fully authenticated
Check if MFA is required for the current user
The session's verification state.
Record that no second factor applies, so the four slots cannot disagree.
Reset all MFA-related session variables
Details
static void
setLogger(LoggerInterface $logger)
No description
static void
setMfaRequired(int $userId)
Flags a user as requiring MFA verification
static void
setMfaVerified()
Marks MFA as completed and sets the user as fully authenticated
static bool
isMfaRequired()
Check if MFA is required for the current user
static MfaSessionState
currentState()
The session's verification state.
Sessions established before MFA_STATE existed are classified from the legacy slots, which is why that reconciliation is still here. Its "absent means not required" default is load-bearing: users who have no second factor never get any of these keys set.
static void
setMfaNotRequired()
Record that no second factor applies, so the four slots cannot disagree.
static void
reset()
Reset all MFA-related session variables