[Copilot]

AuthenticationFilter allowed stale sessions (valid session ID but deleted user record) to bypass authentication, exposing protected routes without a user principal.

Changes

• Check user() first instead of check() to ensure user record exists
• Redirect on null user (handles both missing sessions and stale sessions)
• Remove redundant null check after redirect gate

// Before: check() returns true for stale sessions
if( !$this->_authManager->check() )
{
    // redirect...
}
$user = $this->_authManager->user(); // May be null after logout
if( $user ) { /* set registry */ }   // Request continues without user!

// After: user() clears stale sessions and returns null
$user = $this->_authManager->user();
if( !$user )
{
    // redirect...
}
// User guaranteed non-null here
Registry::getInstance()->set( 'Auth.User', $user );

AuthManager::user() clears stale sessions via logout() when user record is missing, ensuring protected routes only execute with valid user objects.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}