nette-securitylisted

Invoke before implementing or modifying authentication, login/logout or permission checks in Nette. Covers the Authenticator interface, SimpleIdentity, Nette\Security\User, the Passwords hashing service, Authorizator, Permission ACL (roles, resources, privileges, assertions), IdentityHandler, user storage (session/cookie), login expiration, and the `security:` NEON section (users, roles, resources, rules). Also trigger for sign-in presenters and forms, isAllowed()/isInRole() checks, password hashing or rehashing, AuthenticationException error codes, and stale roles in the session. Not for Nette Forms validation rules nor for HTTP session configuration itself.
nette/agent-plugins · ★ 44 · AI & Automation · score 81

Install: claude install-skill nette/agent-plugins

## Nette Security Installed with `composer require nette/security`. The framework registers `security.user` (`Nette\Security\User`), `security.passwords`, `security.userStorage`, plus `security.authenticator` / `security.authorizator` when the `security:` config section defines them. All are autowired – inject `Nette\Security\User` or `Nette\Security\Passwords` by type; in presenters use `$this->getUser()`. ### Current names vs. Nette 2.x names Using an old name still "works" (aliases/deprecated stubs exist), which makes the mistake silent. Always write the current one: | Current (all in `Nette\Security\`) | Deprecated 2.x name | |---|---| | `SimpleIdentity` | `Identity` | | `Authenticator` | `IAuthenticator` – a **different, array-based** `authenticate(array $credentials)` contract; never implement it | | `Authorizator`, `Role`, `Resource` | `IAuthorizator`, `IRole`, `IResource` | | `Authenticator::IdentityNotFound`, `InvalidCredential` | `IDENTITY_NOT_FOUND`, `INVALID_CREDENTIAL` | | `Authorizator::All`, `Allow`, `Deny` | `ALL`, `ALLOW`, `DENY` | | `User::LogoutManual`, `LogoutInactivity` | `LOGOUT_MANUAL`/`MANUAL`, `LOGOUT_INACTIVITY`/`INACTIVITY` | ### Authenticator ```php // interface Nette\Security\Authenticator – error codes: IdentityNotFound, InvalidCredential, Failure, NotApproved function authenticate(string $username, string $password): IIdentity; ``` `InvalidCredential` is **singular**, no trailing `s`. The error code is the exception's second argument: ``