如何在域驱动设计中处理用户会话

Question

How are user sessions handled in domain driven design (in a MVC framework)?

I've got a User domain object, a UserRepository and a UserService .

I've got this method in my UserService class that logs users in.

public function login($email, $password, $remember = false)
{
    $user = $this->userRepo->findByEmail($email);

    if ($user && $user->getPassword() === $password) {
        return $user;
    }

    return false;
}

How do I keep them logged in with sessions?

How would I automatically load the user based on a session user id?

Can somebody give me an example with code how I could sustain the user in my application in DDD?

Answer 1

From a DDD perspective, managing sessions is a distinct set of behaviors, therefor deserves a dedicated service. So create such a service.

You can pass that service to your UserService as a dependency, so the UserService can use the session manager for storing authentication information.

Better yet, the concept of authentication might also be seen as a distinct set of behaviors, so create a service for that too. Pass your UserService and session manager to this authentication service as dependencies. (So the session manager is no longer a dependency of UserService .)

But even authentication could be broken down into several distinct parts, it depends on how far you want to go.

I unfortunately can't show you any code, because that would highly depend on what kind of authentication you want to perform (HTTP Basic, Form login, OAuth, etc), what level of abstraction you want to achieve, and your personal preferences.

But if you want to see what a complex system can look like, have a look at the Security Component of Symfony 2, here in the documentation and here on github .

And if you would consider using this component, you can look at how Silex implements it ( github ) to get a feel for how you can use it.

Side note

DDD is about much more than writing your code in a certain way. If you want to learn DDD, I suggest you read the Domain-Driven Design: Tackling Complexity in the Heart of Software (the blue book), Implementing Domain-Driven Design (the red book), or you can start of with Domain Driven Design Quickly which is available for download.

Answer 2

if(!isset($_SESSION['user'])) {
    if ($user && $user->getPassword() === $password) {
        $_SESSION['user'] = $user;
        return $user;
    }
} else {
    return $_SESSION['user'];
}

maybe something like that. just make sure that on the log out function your destroy the sessions