Working with the authenticated user

Once authentication has completed, we can ask the client for an AuthUser. This gives the rest of our application a small object to work with, without passing around tokens or encrypted response data.

The examples here assume the shared auth.php setup from the Quick start guide.

Protecting a page

Check the login state before reading the user or producing protected content:

require __DIR__ . "/auth.php";

if(!$auth->isLoggedIn()) {
	$auth->login();
}

$user = $auth->getAuthUser();

With the default redirect handler, an unauthenticated request ends inside login(). Once the visitor returns successfully, the page can continue with the restored user. If you replace the redirect handler, preserve that control flow in your integration.

Calling getAuthUser() while logged out throws Authwave\NotLoggedInException.

Identifying a user

$user = $auth->getAuthUser();
$userId = $user->id;
$email = $user->email;

Use the provider's user ID to associate local records with an account. An email address may change, so it is better suited to contact details and display than to identifying the owner of a database record. Treat the ID as a string.

Both properties are read-only. Updating application data does not update the provider's user record.

Keeping permissions in the application

A successful login identifies the visitor. Before showing a private record or allowing a change, check that this user has the required access in our application. For example, load an order using both its order ID and the authenticated user's ID.

---

Next, use Responding to a new authentication to run application code when a login completes.