What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a
Recognition service that will validate a user trying to login, but what about checking if they're already logged in? Assuming I'm storing the user's state in the session, how do I check for this? My application also requires a whitelist. On top of that, I need to redirect the user to a 403 page if they aren't in the whitelist, as opposed to the login page, or whatever page they requested if they are logged in.
My main roadblocks are:
- Where to implement whitelist logic? Router, domain object?
- Check if user is logged in? Controller?
- How to get current user's role if they are logged in for my ACL? Do I call the Recognition service in my index.php and have my Recognition service return the user or their role and pass that along to the acl for the controller to use?
Note: I'm not really fond of the Controller Decorator because if the user can't access the method in the controller, how and where is that handled?