Access to authentication about web-auth

[thekid]

This is a primitive logout implementation (abbreviated example inside App::routes()):

return [
  '/logout' => function($req, $res) use($sessions) {
    if ($session= $sessions->locate($req)) {
      $session->destroy();
      $session->transmit($res); // This is necessary with the current implementation but IMO shouldn't be
    }

    $res->answer(302);
    $res->header('Location', '/?logged-out');
  },
  // ...
}

As can be seen, it needs to know that the authentication uses a session-based approach.

[thekid]

First ideas

Logout:

'/logout' => function($req, $res) {
  if ($req->value('authentication')->logout($req, $res)) {
    $res->answer(302);
    $res->header('Location', '/?logged-out');
  }
},

Updating user value:

'/' => function($req, $res) {
  $user= $req->value('user');

  // Fetch user from database
  $current= $this->repo->user($user['id']);
  $req->value('authentication')->update('user', $current);
},

[thekid]

Another idea

Instead of a web.Request class, authentication could pass a class inherited from that, web.auth.Authenticated, thus simplifying the code as follows:

'/logout' => function(Authenticated $req, Response $res) {
  if ($req->logout($res)) {
    $res->answer(302);
    $res->header('Location', '/?logged-out');
  }
},
'/refresh' => function(Authenticated $req, Response $res) {
  $req->update('user', $this->repo->user($req->user()['id']));
},