Bug: last_active not set when filter set to chain

[LufinityLucas]

PHP Version

8.2.16

CodeIgniter4 Version

4.5.4

Shield Version

1.1.0

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

MariaDB 10.6.11

Did you customize Shield?

Added Shield oAuth

What happened?

When logging in, last_active is not set in the database when filter is configured 'chain' => ['except' => ['login*', 'auth/a/*', 'oauth/*', 'logout']],. When configured 'session' => ['except' => ['login*', 'auth/a/*', 'oauth/*', 'logout']], it works, but for my specific use case I need chain as I'm using both session and access token for different purposes.

Steps to Reproduce

Configure Filters.php file with e.g.,

public $globals = [
    'before' => [
        // ...
        'chain' => ['except' => ['login*', 'register', 'auth/a/*', 'logout']],
    ],
    // ...
];

Expected Output

last_active to be set in the database.

Anything else?

No response

[LufinityLucas]

Sorry, my bad. I thought chain used either session or tokens. Can we have it implemented so that chain works as well?

…

________________________________ From: Aselsan ***@***.***> Sent: Wednesday, August 7, 2024 11:26:51 pm To: codeigniter4/shield ***@***.***> Cc: Lucas Hökerberg ***@***.***>; Author ***@***.***> Subject: Re: [codeigniter4/shield] Bug: last_active not sen when filter set to chain (Issue #1154) its not a bug. record active date only work with session. https://github.com/codeigniter4/shield/blob/7a118f32243452a68b43aa8b910490345d8ac7a4/src/Filters/SessionAuth.php#L55-L57 — Reply to this email directly, view it on GitHub<#1154 (comment)>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AW3RSEO6HCCN6CTZIVNRL4TZQKGJNAVCNFSM6AAAAABMEBVDOKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDENZUGM3TONRRHA>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[warcooft]

Try this:

<?php

declare(strict_types=1);

/**
 * This file is part of CodeIgniter Shield.
 *
 * (c) CodeIgniter Foundation <admin@codeigniter.com>
 *
 * For the full copyright and license information, please view
 * the LICENSE file that was distributed with this source code.
 */

namespace CodeIgniter\Shield\Filters;

use CodeIgniter\Filters\FilterInterface;
use CodeIgniter\HTTP\IncomingRequest;
use CodeIgniter\HTTP\RedirectResponse;
use CodeIgniter\HTTP\RequestInterface;
use CodeIgniter\HTTP\Response;
use CodeIgniter\HTTP\ResponseInterface;

/**
 * Chain Authentication Filter.
 *
 * Checks all authentication systems specified within
 * `Config\Auth->authenticationChain`
 */
class ChainAuth implements FilterInterface
{
    /**
     * Do whatever processing this filter needs to do.
     * By default it should not return anything during
     * normal execution. However, when an abnormal state
     * is found, it should return an instance of
     * CodeIgniter\HTTP\Response. If it does, script
     * execution will end and that Response will be
     * sent back to the client, allowing for error pages,
     * redirects, etc.
     *
     * @param array|null $arguments
     *
     * @return RedirectResponse|void
     */
    public function before(RequestInterface $request, $arguments = null)
    {
        if (!$request instanceof IncomingRequest) {
            return;
        }

        helper('settings');

        $chain = config('Auth')->authenticationChain;

        foreach ($chain as $alias) {
            $auth = auth($alias);

            if ($auth->loggedIn()) {
                // Make sure Auth uses this Authenticator
                auth()->setAuthenticator($alias);

                $authenticator = $auth->getAuthenticator();

                if (setting('Auth.recordActiveDate')) {
                    $authenticator->recordActiveDate();
                }

                return;
            }
        }

        return redirect()->route('login');
    }

    /**
     * We don't have anything to do here.
     *
     * @param array|null $arguments
     */
    public function after(RequestInterface $request, ResponseInterface $response, $arguments = null): void
    {
        // Nothing required
    }
}

[kenjis]

Sorry, my bad. I thought chain used either session or tokens.

Yes,chain uses either session or tokens or hmac by default.

chain
The filter will check authenticators in sequence to see if the user is logged in through either of authenticators, allowing a single API endpoint to work for both an SPA using session auth, and a mobile app using access tokens.
https://shield.codeigniter.com/references/controller_filters/?h=chain#provided-filters

[kenjis]

@LufinityLucas @warcooft I sent #1160. Check, please.

[LufinityLucas]

@LufinityLucas @warcooft I sent #1160. Check, please.

Works like a charm.
Thanks! :)