Library Group: security

Generated by php build/docs/rvn-docs.php. Do not edit this file by hand.

| Symbol | Kind | Summary | @return |
| --- | --- | --- | --- |
| authenticatorDataHasUserVerification() | function | Checks one authenticator-data payload for the user-verification flag. | bool True when the authenticator indicated user verification. |
| e() | function | Escapes a string for safe HTML output, preventing XSS via unescaped user-supplied values. | string HTML-safe encoded string. |
| modernTotp() | function | Builds a TwoFactorAuth instance with Raven's canonical TOTP settings. | TwoFactorAuth Configured TOTP helper instance. |
| normalizeAccountEmail() | function | Normalizes one account email for otpauth label generation. | string Validated lowercase email, or account@local fallback. |
| normalizeIssuer() | function | Normalizes one issuer label used in authenticator-app account entries. | string Non-empty issuer label. |
| provisioningUri() | function | Builds the otpauth:// provisioning URI for QR code display during TOTP setup. | string otpauth:// URI, or empty string on failure. |
| Raven\Lib\Security\Captcha::__construct() | method | (No summary.) | (No @return.) |
| Raven\Lib\Security\Captcha::markup() | method | Builds the HTML widget markup and optional JS script tag for embedding a captcha on a form. | array{markup: string, script_included: bool} Widget HTML and updated script-included flag. |
| Raven\Lib\Security\Captcha::provider() | method | Returns the active captcha provider slug from config. | string Provider slug ('none', 'hcaptcha', 'recaptcha2', or 'recaptcha3'). |
| Raven\Lib\Security\Captcha::responseField() | method | Returns the POST field name that carries the captcha token for a given provider. | string POST field name. |
| Raven\Lib\Security\Captcha::secretKey() | method | Returns the secret/server key for a given provider. | string Secret server key, or empty string when not configured. |
| Raven\Lib\Security\Captcha::siteKey() | method | Returns the public/site key for a given provider. | string Public site key, or empty string when not configured. |
| Raven\Lib\Security\Captcha::validateSubmission() | method | Validates a captcha submission and returns a user-facing error message on failure. | string\|null One user-facing validation error, or null when captcha passes. |
| Raven\Lib\Security\Csrf::__construct() | method | (No summary.) | (No @return.) |
| Raven\Lib\Security\Csrf::field() | method | Renders an HTML hidden input element carrying the current CSRF token. | string HTML hidden input tag. |
| Raven\Lib\Security\Csrf::rotate() | method | Invalidates the current token and returns a freshly generated replacement. | string New hex-encoded CSRF token. |
| Raven\Lib\Security\Csrf::token() | method | Returns the current CSRF token, generating and persisting a new one if none exists. | string Hex-encoded CSRF token. |
| Raven\Lib\Security\Csrf::validate() | method | Validates a submitted CSRF token using a constant-time comparison. | bool True when the submitted token matches the stored token. |
| Raven\Lib\Security\CsrfToken::get() | method | Fetches one stored token value by key. | string\|null Stored token string when present. |
| Raven\Lib\Security\CsrfToken::remove() | method | Removes one stored token value by key. | void |
| Raven\Lib\Security\CsrfToken::set() | method | Persists one token value under the provided key. | void |
| Raven\Lib\Security\EmailGenerate::code() | method | Generates one cryptographically random eight-digit numeric code. | string Eight-digit zero-padded numeric code string. |
| Raven\Lib\Security\EmailValidate::normalize() | method | Normalizes and validates one email address string. | string\|null Lowercase-trimmed address on success, null on rejection. |
| Raven\Lib\Security\EmailValidate::normalizeCode() | method | Normalizes a submitted numeric email code to its canonical 8-digit form. | string Eight-digit code string, or empty string when format is invalid. |
| Raven\Lib\Security\InputSanitizer::email() | method | Normalizes and validates an email address. | string\|null Lowercase valid email address, or null when invalid. |
| Raven\Lib\Security\InputSanitizer::html() | method | Strips null bytes and truncates HTML/rich-text content. | string Sanitized string, never null. |
| Raven\Lib\Security\InputSanitizer::int() | method | Parses and range-validates an integer from any scalar input type. | int\|null Validated integer, or null when the value is missing, non-numeric, or out of range. |
| Raven\Lib\Security\InputSanitizer::slug() | method | Normalizes a slug and returns null when the value does not match the slug character rules. | string\|null Valid slug string, or null when the value fails validation. |
| Raven\Lib\Security\InputSanitizer::text() | method | Trims, strips control characters, and truncates a plain-text string. | string Sanitized string, never null. |
| Raven\Lib\Security\InputSanitizer::username() | method | Normalizes and validates a username string. | string\|null Lowercase valid username, or null when invalid. |
| Raven\Lib\Security\PasswordValidator::validateNewPass() | method | Validates a new-password submission and returns a list of user-facing error strings. | array<int, string> Validation errors; empty array on success. |
| Raven\Lib\Security\PhraseGenerate::generate() | method | Generates a new random recovery phrase from the BIP39 word list. | string\|null Space-separated phrase, or null on failure. |
| Raven\Lib\Security\PhraseGenerate::hash() | method | Normalizes and hashes a recovery phrase for at-rest storage. | string\|null Hashed phrase string, or null on failure. |
| Raven\Lib\Security\PhraseValidate::isValid() | method | Returns true when a normalized phrase contains exactly the expected count of valid BIP39 words. | bool True when the phrase is non-empty, the correct length, and every word is in the BIP39 list. |
| Raven\Lib\Security\PhraseValidate::isValidHash() | method | Returns true when a stored hash string carries a recognized passwordhash algorithm identifier. | bool True when the hash is non-empty and passwordget_info reports a known algorithm. |
| Raven\Lib\Security\PhraseValidate::matchRecoveryMethod() | method | Returns match metadata when the submitted phrase verifies against any confirmed recovery method. | array{index: int, reusable: bool}\|null Match result with row index and reusable flag, or null on no match. |
| Raven\Lib\Security\PhraseValidate::normalize() | method | Lowercases, trims, and collapses whitespace in a raw recovery phrase string. | string Normalized lowercase phrase with single spaces between words. |
| Raven\Lib\Security\PhraseValidate::verify() | method | Verifies a submitted phrase against a stored password hash. | bool True when the phrase verifies against the stored hash. |
| Raven\Lib\Security\PublicCaptchaFlow::__construct() | method | (No summary.) | void |
| Raven\Lib\Security\PublicCaptchaFlow::markup() | method | Returns public captcha widget markup for the current request. | string Captcha widget markup. |
| Raven\Lib\Security\PublicCaptchaFlow::validateSubmission() | method | Validates one submitted public captcha payload. | string\|null One user-facing error string, or null when captcha passes. |
| Raven\Lib\Security\SymlinkGuard::assertSymlinkFreePath() | method | Rejects a path whose existing components include a symbolic link. | void |
| Raven\Lib\Security\SymlinkGuard::isSymlinkFreePath() | method | Returns whether an absolute path contains no symbolic-link component. | bool True when no path component resolves through a symbolic link. |
| Raven\Lib\Security\Totp::generateSecret() | method | Generates a new cryptographically random TOTP secret using the vendor library. | string\|null Normalized base32 secret, or null on failure. |
| Raven\Lib\Security\Totp::isValidCode() | method | Returns true when the normalized code is exactly the expected digit count. | bool True when the code contains exactly MODERN_DIGITS digits. |
| Raven\Lib\Security\Totp::isValidSecret() | method | Returns true when the normalized secret meets the required base32 length constraints. | bool True when the secret is a valid base32 string of acceptable length. |
| Raven\Lib\Security\Totp::normalizeCode() | method | Strips all non-digit characters from a submitted TOTP code. | string Digit-only code string. |
| Raven\Lib\Security\Totp::normalizeSecret() | method | Strips non-base32 characters and uppercases a TOTP secret string. | string Cleaned uppercase base32 secret. |
| Raven\Lib\Security\TotpCipher::__construct() | method | (No summary.) | (No @return.) |
| Raven\Lib\Security\TotpCipher::decryptMethodSecrets() | method | Decrypts encrypted TOTP secrets in a 2FA method list after reads. | array<int, array<string, mixed>> Method rows with TOTP secrets decrypted. |
| Raven\Lib\Security\TotpCipher::decryptSecret() | method | Decrypts an encrypted TOTP secret string and returns the normalized plaintext. | string\|null Normalized plaintext TOTP secret, or null on failure. |
| Raven\Lib\Security\TotpCipher::encryptMethodSecrets() | method | Encrypts plaintext TOTP secrets in a 2FA method list before persistence. | array<int, array<string, mixed>> Method rows with TOTP secrets encrypted. |
| Raven\Lib\Security\TotpCipher::encryptSecret() | method | Encrypts a plaintext TOTP secret using AES-256-GCM and returns the encoded ciphertext string. | string\|null Encoded ciphertext with prefix, or null on failure. |
| Raven\Lib\Security\TotpCipher::isEncrypted() | method | Returns true when a stored secret string carries the encryption prefix. | bool True when the value was encrypted by this class. |
| Raven\Lib\Security\TotpVerify::verify() | method | Returns true when the submitted code matches any confirmed TOTP method. | bool True when any confirmed TOTP method verifies the submitted code. |
| Raven\Lib\Security\UserString::generate() | method | Generates a single random string from the alphanumeric alphabet without uniqueness checking. | string Random alphanumeric string of the requested length. |
| Raven\Lib\Security\UserString::generateUnique() | method | Generates a random user string that is confirmed unique by the provided existence check. | string Unique random string of the requested length. |
| Raven\Lib\Security\UserString::normalizeLength() | method | Normalizes a length value to a valid positive integer capped at 128. | int Normalized length in the range [1, 128]. |
| Raven\Lib\Security\WebAuthn::createServer() | method | Builds one configured vendor WebAuthn runtime for the current site. | VendorWebAuthn\|null Configured vendor runtime when available. |
| resolveRpId() | function | Resolves one relying-party id from request host or configured domain. | string Normalized relying-party id, or an empty string when invalid. |
| verifyCode() | function | Verifies a submitted TOTP code against a secret using the vendor library. | bool True when the code is valid for the given secret within the clock window. |
| void() | function | RAVEN CMS | (No @return.) |
| void() | function | RAVEN CMS | (No @return.) |

Parameter Details

authenticatorDataHasUserVerification()

  • File: private/lib/Security/WebAuthn.php
  • Params:
  • string $authenticatorData Raw authenticator-data bytes from the assertion payload.

e()

  • File: private/lib/Security/OutputEncoder.php
  • Params:
  • string $value Raw string to encode.

modernTotp()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $issuer Issuer label shown in authenticator apps.

normalizeAccountEmail()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $accountEmail Candidate account email.

normalizeIssuer()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $issuer Configured/site issuer name.

provisioningUri()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $issuer Site or app name shown in the authenticator app.
  • string $accountEmail User email address shown in the authenticator app.
  • string $secret Base32 TOTP secret to encode in the URI.

Raven\Lib\Security\Captcha::__construct()

  • File: private/lib/Security/Captcha.php
  • Params:
  • Config $config Runtime config for captcha provider settings.
  • InputSanitizer $input Input sanitizer used to normalize config reads.

Raven\Lib\Security\Captcha::markup()

  • File: private/lib/Security/Captcha.php
  • Params:
  • bool $scriptIncluded Whether the provider JS script has already been emitted on this page.

Raven\Lib\Security\Captcha::provider()

  • File: private/lib/Security/Captcha.php
  • Params: (none)

Raven\Lib\Security\Captcha::responseField()

  • File: private/lib/Security/Captcha.php
  • Params:
  • string $provider Provider slug as returned by \provider()\.

Raven\Lib\Security\Captcha::secretKey()

  • File: private/lib/Security/Captcha.php
  • Params:
  • string $provider Provider slug as returned by \provider()\.

Raven\Lib\Security\Captcha::siteKey()

  • File: private/lib/Security/Captcha.php
  • Params:
  • string $provider Provider slug as returned by \provider()\.

Raven\Lib\Security\Captcha::validateSubmission()

  • File: private/lib/Security/Captcha.php
  • Params:
  • array&lt;string, mixed&gt; $post Submitted POST data.
  • string|null $remoteIp Client IP address forwarded to the captcha verification endpoint.

Raven\Lib\Security\Csrf::__construct()

  • File: private/lib/Security/Csrf.php
  • Params:
  • CsrfToken|null $store Token persistence store; defaults to session-backed SessionToken.
  • string $tokenKey Session/store key used to persist the CSRF token.
  • int $tokenBytes Byte length of generated tokens; clamped to [16, 128].

Raven\Lib\Security\Csrf::field()

  • File: private/lib/Security/Csrf.php
  • Params:
  • string $fieldName Name attribute for the hidden input element.

Raven\Lib\Security\Csrf::rotate()

  • File: private/lib/Security/Csrf.php
  • Params: (none)

Raven\Lib\Security\Csrf::token()

  • File: private/lib/Security/Csrf.php
  • Params: (none)

Raven\Lib\Security\Csrf::validate()

  • File: private/lib/Security/Csrf.php
  • Params:
  • string|null $submitted Token value from the submitted form.

Raven\Lib\Security\CsrfToken::get()

  • File: private/lib/Security/CsrfToken.php
  • Params:
  • string $key Storage key for the token value.

Raven\Lib\Security\CsrfToken::remove()

  • File: private/lib/Security/CsrfToken.php
  • Params:
  • string $key Storage key for the token value.

Raven\Lib\Security\CsrfToken::set()

  • File: private/lib/Security/CsrfToken.php
  • Params:
  • string $key Storage key for the token value.
  • string $value Token string to persist.

Raven\Lib\Security\EmailGenerate::code()

  • File: private/lib/Security/EmailGenerate.php
  • Params: (none)

Raven\Lib\Security\EmailValidate::normalize()

  • File: private/lib/Security/EmailValidate.php
  • Params:
  • string $email Raw email address from user input.

Raven\Lib\Security\EmailValidate::normalizeCode()

  • File: private/lib/Security/EmailValidate.php
  • Params:
  • string $submittedCode Raw code string from the login form.

Raven\Lib\Security\InputSanitizer::email()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • string|null $value Raw input.

Raven\Lib\Security\InputSanitizer::html()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • string|null $value Raw HTML input; treated as empty when null.
  • int $maxLength Maximum allowed character length.

Raven\Lib\Security\InputSanitizer::int()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • mixed $value Raw value to parse; empty strings are treated as absent.
  • int $min Minimum accepted value (inclusive).
  • int $max Maximum accepted value (inclusive).

Raven\Lib\Security\InputSanitizer::slug()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • string|null $value Raw input.

Raven\Lib\Security\InputSanitizer::text()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • string|null $value Raw input string; treated as empty when null.
  • int $maxLength Maximum allowed character length after trimming.

Raven\Lib\Security\InputSanitizer::username()

  • File: private/lib/Security/InputSanitizer.php
  • Params:
  • string|null $value Raw input.

Raven\Lib\Security\PasswordValidator::validateNewPass()

  • File: private/lib/Security/PasswordValidator.php
  • Params:
  • string $newPass Submitted new password value.
  • string $confirmNewPass Submitted confirmation value.
  • int $minimumLength Minimum required password character length.

Raven\Lib\Security\PhraseGenerate::generate()

  • File: private/lib/Security/PhraseGenerate.php
  • Params:
  • int $wordCount Number of words in the phrase; clamped to at least 1.

Raven\Lib\Security\PhraseGenerate::hash()

  • File: private/lib/Security/PhraseGenerate.php
  • Params:
  • string $phrase Recovery phrase to hash; normalization is applied before hashing.
  • int $wordCount Expected word count used for pre-hash validation.

Raven\Lib\Security\PhraseValidate::isValid()

  • File: private/lib/Security/PhraseValidate.php
  • Params:
  • string $phrase Phrase string; should be normalized before calling.
  • int $wordCount Expected number of words; clamped to at least 1.

Raven\Lib\Security\PhraseValidate::isValidHash()

  • File: private/lib/Security/PhraseValidate.php
  • Params:
  • string $hash Stored hash value to inspect.

Raven\Lib\Security\PhraseValidate::matchRecoveryMethod()

  • File: private/lib/Security/PhraseValidate.php
  • Params:
  • array&lt;int, array&lt;string, mixed&gt;&gt; $methods 2FA method rows decoded from the user preferences column.
  • string $submittedPhrase Recovery phrase submitted by the user.
  • string $selectedMethodKey Specific method key to check, or the pool key to check all.

Raven\Lib\Security\PhraseValidate::normalize()

  • File: private/lib/Security/PhraseValidate.php
  • Params:
  • string $raw Raw phrase from user input or storage.

Raven\Lib\Security\PhraseValidate::verify()

  • File: private/lib/Security/PhraseValidate.php
  • Params:
  • string $submittedPhrase Raw phrase from the user.
  • string $hash Stored hash to verify against.
  • int $wordCount Expected word count; passed through to isValid.

Raven\Lib\Security\PublicCaptchaFlow::__construct()

  • File: private/lib/Security/PublicCaptchaFlow.php
  • Params:
  • Config $config Runtime configuration reader for captcha provider settings.
  • InputSanitizer $input Shared input sanitizer for captcha payload checks.
  • ClientProfiler $clientProfiler Shared client-network normalizer.

Raven\Lib\Security\PublicCaptchaFlow::markup()

  • File: private/lib/Security/PublicCaptchaFlow.php
  • Params: (none)

Raven\Lib\Security\PublicCaptchaFlow::validateSubmission()

  • File: private/lib/Security/PublicCaptchaFlow.php
  • Params:
  • array&lt;string, mixed&gt; $post Submitted request payload.
  • array&lt;string, mixed&gt; $server Server environment payload.

Raven\Lib\Security\SymlinkGuard::assertSymlinkFreePath()

  • File: private/lib/Security/SymlinkGuard.php
  • Params:
  • string $path Absolute path to inspect.
  • string $label Human-readable path role for the exception message.

Raven\Lib\Security\SymlinkGuard::isSymlinkFreePath()

  • File: private/lib/Security/SymlinkGuard.php
  • Params:
  • string $path Absolute path to inspect.

Raven\Lib\Security\Totp::generateSecret()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $issuer Display name embedded in the provisioning URI.

Raven\Lib\Security\Totp::isValidCode()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $code Code string; normalization is applied before the check.

Raven\Lib\Security\Totp::isValidSecret()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $secret Secret string; normalization is applied before the check.

Raven\Lib\Security\Totp::normalizeCode()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $code Raw code from user input, potentially with spaces or dashes.

Raven\Lib\Security\Totp::normalizeSecret()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $secret Raw secret value from user input or storage.

Raven\Lib\Security\TotpCipher::__construct()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • string|null $keyPath Absolute path to the AES key file; defaults to \private/dat/.totp_secret.key\.

Raven\Lib\Security\TotpCipher::decryptMethodSecrets()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • array&lt;int, array&lt;string, mixed&gt;&gt; $methods 2FA method rows.

Raven\Lib\Security\TotpCipher::decryptSecret()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • string $value Stored secret value (encrypted or legacy plaintext).

Raven\Lib\Security\TotpCipher::encryptMethodSecrets()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • array&lt;int, array&lt;string, mixed&gt;&gt; $methods 2FA method rows.

Raven\Lib\Security\TotpCipher::encryptSecret()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • string $secret Plaintext base32 TOTP secret.

Raven\Lib\Security\TotpCipher::isEncrypted()

  • File: private/lib/Security/TotpCipher.php
  • Params:
  • string $value Stored secret value to inspect.

Raven\Lib\Security\TotpVerify::verify()

  • File: private/lib/Security/TotpVerify.php
  • Params:
  • array&lt;int, array&lt;string, mixed&gt;&gt; $methods 2FA method rows decoded from the user preferences column.
  • string $submittedCode Six-digit code submitted by the user.
  • string $issuer TOTP issuer label used during verification; defaults to &#039;Raven CMS&#039;.

Raven\Lib\Security\UserString::generate()

  • File: private/lib/Security/UserString.php
  • Params:
  • int $length Desired string length; normalized via \normalizeLength()\.

Raven\Lib\Security\UserString::generateUnique()

  • File: private/lib/Security/UserString.php
  • Params:
  • int $length Desired string length; normalized via \normalizeLength()\.
  • callable(string): bool $exists Callback that returns true when a candidate already exists.

Raven\Lib\Security\UserString::normalizeLength()

  • File: private/lib/Security/UserString.php
  • Params:
  • mixed $value Raw length value (numeric string or integer).
  • int $default Fallback length when normalization fails.

Raven\Lib\Security\WebAuthn::createServer()

  • File: private/lib/Security/WebAuthn.php
  • Params:
  • string $siteName Configured site name used as the relying-party display name.
  • string $siteDomain Configured site domain used to resolve the relying-party id.
  • array&lt;string, mixed&gt; $server Current request server array for host overrides.

resolveRpId()

  • File: private/lib/Security/WebAuthn.php
  • Params:
  • string $siteDomain Configured site domain or URL.
  • array&lt;string, mixed&gt; $server Current request server array for host overrides.

verifyCode()

  • File: private/lib/Security/Totp.php
  • Params:
  • string $secret Base32 TOTP secret.
  • string $code Submitted code from the user.
  • int $window Clock drift tolerance in steps; clamped to ≥ 0.
  • string $issuer TOTP issuer label used during verification.

void()

  • File: private/lib/Security/Totp.php
  • Params: (none)

void()

  • File: private/lib/Security/WebAuthn.php
  • Params: (none)