user_api_session_functions.php
Table of Contents
Functions
- get_api_session_destination() : array<string|int, mixed>|false
- Resolve an allowlisted API credential destination and its delivery mode.
- get_api_session_code_user() : array<string|int, mixed>|false
- Read an eligible credential owner's current details from the primary database without caching.
- create_api_session_code() : string|false
- Issue a 120-second, single-use code after browser authentication and CSRF-protected consent.
- redeem_api_session_code() : array<string|int, mixed>|false
- Redeem an API session code using its original destination and PKCE verifier.
Functions
get_api_session_destination()
Resolve an allowlisted API credential destination and its delivery mode.
get_api_session_destination(string $system[, string|null $url = null ]) : array<string|int, mixed>|false
Parameters
- $system : string
-
Destination configuration key.
- $url : string|null = null
-
Selected callback; required for destinations with multiple URLs.
Return values
array<string|int, mixed>|false —Destination with a single resolved URL, or false for invalid configuration/input.
get_api_session_code_user()
Read an eligible credential owner's current details from the primary database without caching.
get_api_session_code_user(int $user) : array<string|int, mixed>|false
Account approval, expiry, group membership and API download-limit restrictions must still hold.
Parameters
- $user : int
-
User reference.
Return values
array<string|int, mixed>|false —Current user details, or false if session/API access is unavailable.
create_api_session_code()
Issue a 120-second, single-use code after browser authentication and CSRF-protected consent.
create_api_session_code(int $user, string $system, string $redirect_uri, string $code_challenge, string $session) : string|false
Only code/key hashes are persisted. Expired codes are removed on issuance.
Parameters
- $user : int
-
Consenting user reference.
- $system : string
-
Allowlisted destination configuration key.
- $redirect_uri : string
-
Exact approved callback URL.
- $code_challenge : string
-
Base64url-encoded SHA-256 PKCE challenge (S256 only).
- $session : string
-
Browser session that authorized issuance.
Return values
string|false —Opaque code, or false if API access, destination, challenge or user is invalid.
redeem_api_session_code()
Redeem an API session code using its original destination and PKCE verifier.
redeem_api_session_code(string $system, string $code, string $code_verifier, string $redirect_uri) : array<string|int, mixed>|false
Invalid attempts return false without consuming a valid code. An atomic DELETE elects exactly one successful redeemer even when transactions are disabled. Reads deliberately bypass caches/replicas.
Parameters
- $system : string
-
Destination configuration key.
- $code : string
-
Opaque code received through the browser redirect.
- $code_verifier : string
-
Original RFC 7636 verifier (43-128 unreserved ASCII characters).
- $redirect_uri : string
-
Exact callback URL used when issuing the code.
Return values
array<string|int, mixed>|false —Session signing key and authorized identity fields, or false if validation fails.