At the moment, there are a couple different places where authenticated sessions get created. One is checkauth() and another is check_api_auth(). I would also like to create consistently structured authenticated sessions from Koha Plugins. There should be a standard API for creating and fetching sessions. I propose a Koha::Session wrapper. It will define Koha's standard session key set and have some automatic population for things like 'ip' and 'lasttime'. There will also be a method for setting the C4::Context->userenv, which is something that gets done repeatedly in checkauth(), check_api_auth(), check_cookie_auth(), and other less relevant places (like checkpw_internal which is bizarre). I think that this is a reasonable step forward as we add AuthN and AuthZ to things like Koha plugins and Mojolicious controllers.
For instance: Koha::Session->set_user_session({ user => $patron, session => $session, extensions => { desk_id => $desk_id, shibboleth => $shibboleth, }, }); We'd take both the session object and data to put into it. The $session object would have 'ip' and 'lasttime' set automatically. Likewise: Koha::Session->set_userenv({ session => $session, extensions => { id => $userid, } }); The above would use session data or let you override particular key/value pairs using extensions. Although personally I find the concept of C4::Context->userenv to be unnecessary. You just need sessions, but Koha has a dependency on C4::Context->userenv...
Actually, I think the key thing is having Koha::Session enforce a number of mandatory session variables. After reviewing C4::Auth::check_api_auth(), C4::Auth::checkauth(), C4::InstallAuth::checkauth(), the required keys for an authenticated user appear to be: - number - id - cardnumber - firstname - surname - branch - branchname - flags - emailaddress - ip - lasttime - interface (not set by C4::InstallAuth::checkauth() but is by the other 2) C4::Auth::checkauth() also sets "search_history", "desk_id", "desk_name", "shibboleth", "register_id", "register_name", "sco_user", and "cas_ticket". C4::Auth::check_api_auth() also sets "cas_ticket".
*** This bug has been marked as a duplicate of bug 31050 ***