CodeIgniter was my go to framework long time ago but then I started using Laravel PHP framework and went on using other technologies for backend such as Java Spring boot, node js based Nest JS etc. Now I am back to use CodeIgniter, this time I am going to upgrade my PHP CodeIgniter website generator at thephpcode.com to generate CI 4 based code instead of CI 3. Also the generator itself was built on CodeIgniter 3 in 2011. So the goal is first upgrade the generator to use CI4 framework then make changes to the generator also to generate CodeIgniter 4 websites. As part of the implementation I have implemented a Security module which is very light weight and supports role based permissions. As I couldn’t find any modules publicly available built specific to CodeIgniter I thought to share with others who needs a similar module. The source code for the project is available for download at https://github.com/msnisha/codeigniter-jwt/archive/refs/heads/main.zip or by visiting the repository at https://github.com/msnisha/codeigniter-jwt.

You can follow the read me of how to use and what functionalities are available in it. Here is the detail documentation if you want to know more about the design and implementation details.

Data model design

First I came up with the data model considering that the admin should be able to configure the access for users without touching the code. Also it should be possible for users to have more than one role.

Features

The following features are supported by the modules. The current version is built for using by the API so uses JWT based authentication and the same can be easily extended to support cookie / session based authentication.

User Management

Users can register, login, verify email address and see the profile data about themselves. The following routes are available related to user management.

User registration

End point: /api/register

Example:

User login

End point: /api/login

Example:

User Profile

End point: /api/me

Example:

Notice in the above scenario the jwt token return in the logged in API call has been passed as bearer token.

Filters

There are two filters provided by the module. One is for throttling and the other one is for securing end points.

Throttling filter is used to protect the login end point from hacking by limiting number of login attempt possible within given time frame. Currently it is limited to 3 per minute and can be changed easily as per your requirement.

The “authFilter” can be used to protect routes/endpoint from unlogged in users. Below is an example setup where the authFilter is used.

Helpers

Helper functions are provided to further fine tune the access. Functions are available for checking whether logged in user has got given role or permission. It is useful to implement permission based functionalities within the controllers. The following helper functions are available.

For using this function first needs to load the helper then can call any of the function as shown below.

  helper('Modules\Auth\Auth');

    if (!hasPermission('manage_user')) {
        return $this->respond([
            'status' => 'fail',
            'message' => 'You don\'t have permission to access the data'
        ], 403);
    }

Further changes

I am working on a Admin dashboard which provide portal for admins to manage users, configure roles, permissions and associate roles and permissions. Below are some screenshots from the portal. The portal is compatible with the above user auth module but not part of the open source project but you can contact me if you want to buy it for price of two coffee ($9).