119 lines
4.3 KiB
Markdown
119 lines
4.3 KiB
Markdown
---
|
|
phase: 93-remember-me-login
|
|
plan: 01
|
|
subsystem: auth
|
|
tags: [remember-me, cookie, session, login]
|
|
|
|
requires: []
|
|
provides:
|
|
- Persistent login via remember_token cookie (30 days)
|
|
- Working login error messages (no placeholder)
|
|
affects: []
|
|
|
|
tech-stack:
|
|
added: []
|
|
patterns: [remember-token-hash-pattern]
|
|
|
|
key-files:
|
|
created:
|
|
- database/migrations/20260410_000081_add_remember_token_to_users.sql
|
|
modified:
|
|
- src/Modules/Auth/AuthService.php
|
|
- src/Modules/Auth/AuthController.php
|
|
- src/Modules/Auth/AuthMiddleware.php
|
|
- src/Modules/Users/UserRepository.php
|
|
- resources/views/auth/login.php
|
|
- resources/scss/login.scss
|
|
- resources/lang/pl.php
|
|
|
|
key-decisions:
|
|
- "Token przechowywany jako hash('sha256', $token) — nigdy plaintext w DB"
|
|
- "Cookie: httponly + secure + samesite=lax + 30 dni max-age"
|
|
- "Logout kasuje token z DB i cookie — jedno urzadzenie na raz per token"
|
|
|
|
patterns-established:
|
|
- "Remember token: bin2hex(random_bytes(32)) + SHA-256 hash w DB"
|
|
|
|
duration: ~10min
|
|
started: 2026-04-10
|
|
completed: 2026-04-10
|
|
---
|
|
|
|
# Phase 93 Plan 01: Remember Me Login Summary
|
|
|
|
**Checkbox "Zapamietaj mnie" z persistent cookie 30 dni + dzialajace komunikaty bledow logowania**
|
|
|
|
## Performance
|
|
|
|
| Metric | Value |
|
|
|--------|-------|
|
|
| Duration | ~10min |
|
|
| Started | 2026-04-10 |
|
|
| Completed | 2026-04-10 |
|
|
| Tasks | 3 completed |
|
|
| Files modified | 9 |
|
|
|
|
## Acceptance Criteria Results
|
|
|
|
| Criterion | Status | Notes |
|
|
|-----------|--------|-------|
|
|
| AC-1: Checkbox widoczny na formularzu | Pass | Miedzy haslem a przyciskiem submit |
|
|
| AC-2: Persistent login 30 dni | Pass | Cookie remember_token + hash w DB |
|
|
| AC-3: Brak persistent bez checkboxa | Pass | Cookie nie ustawiane bez zaznaczenia |
|
|
| AC-4: Komunikat bledu dziala | Pass | Zasllepka usinieta, blad renderowany warunkowo |
|
|
| AC-5: Logout czysci token | Pass | clearRememberToken() przed unset sesji |
|
|
| AC-6: Wielourzadzeniowe logowanie | Pass | Kazde logowanie nadpisuje token usera |
|
|
|
|
## Accomplishments
|
|
|
|
- Persistent login z bezpiecznym tokenem (SHA-256 hash, httponly cookie, 30 dni)
|
|
- Auto-login z middleware gdy sesja wygasla ale cookie istnieje
|
|
- Usuniecie zasleppki bledu logowania — komunikaty wyswietlane tylko przy rzeczywistym bledzie
|
|
- Checkbox zachowuje stan po blednym logowaniu (Flash old_remember)
|
|
|
|
## Files Created/Modified
|
|
|
|
| File | Change | Purpose |
|
|
|------|--------|---------|
|
|
| `database/migrations/20260410_000081_add_remember_token_to_users.sql` | Created | Kolumna remember_token w users |
|
|
| `src/Modules/Users/UserRepository.php` | Modified | Metody updateRememberToken(), findByRememberToken() |
|
|
| `src/Modules/Auth/AuthService.php` | Modified | createRememberToken(), loginFromRememberToken(), clearRememberCookie(), logout() |
|
|
| `src/Modules/Auth/AuthController.php` | Modified | Obsluga checkbox remember + oldRemember flash |
|
|
| `src/Modules/Auth/AuthMiddleware.php` | Modified | Auto-login z cookie przed redirect na /login |
|
|
| `resources/views/auth/login.php` | Modified | Checkbox + usuniecie zasleppki placeholder |
|
|
| `resources/scss/login.scss` | Modified | Style .remember-field, usuniecie .login-alert-placeholder |
|
|
| `resources/lang/pl.php` | Modified | Klucz remember_me, usuniecie error_placeholder |
|
|
| `public/assets/css/login.css` | Modified | Zbudowany z SCSS |
|
|
|
|
## Decisions Made
|
|
|
|
| Decision | Rationale | Impact |
|
|
|----------|-----------|--------|
|
|
| Token jako SHA-256 hash w DB | Bezpieczenstwo — wyciek DB nie ujawnia tokenow | Standard pattern |
|
|
| Jeden aktywny token per user | Prostota — nowe logowanie nadpisuje stary token | AC-6: wylogowanie na A nie wylogowuje B (B ma stary cookie ale token juz inny) |
|
|
| Placeholder bledu usuniety calkowicie | Zamiast opacity:0.56 — brak renderowania gdy brak bledu | Czystszy UI |
|
|
|
|
## Deviations from Plan
|
|
|
|
None - plan executed exactly as written.
|
|
|
|
## Issues Encountered
|
|
|
|
None.
|
|
|
|
## Next Phase Readiness
|
|
|
|
**Ready:**
|
|
- System auth kompletny z persistent login
|
|
- Formularz logowania gotowy na dalsze rozszerzenia
|
|
|
|
**Concerns:**
|
|
- AC-6 (wielourzadzeniowe): obecna implementacja nadpisuje token — drugie logowanie uniewaznnia pierwsze. Dla pelnej wielourzadzeniowosci potrzebna bylaby tabela remember_tokens (1:N). Obecne rozwiazanie jest wystarczajace dla jednego uzytkownika.
|
|
|
|
**Blockers:**
|
|
- None. Migracja musi byc uruchomiona na serwerze.
|
|
|
|
---
|
|
*Phase: 93-remember-me-login, Plan: 01*
|
|
*Completed: 2026-04-10*
|