First in a series of Q on Auth (again)

in function login() we have this block... if (!empty($this->username)) { // validate data if (true === $this->storage->fetchData($this->username, $this->password) ) { $login_ok = true; } else { if (is_callable($this->loginFailedCallback)) { call_user_func($this->loginFailedCallback,$this->username, $this); } } } If username is not empty, we will call 'fetchData' (which basically uses the defined container type to retrieve a record that matches the give username and validates the password in the record against what was given). If this ID and pasword passes, then we move on. If it failes 'loginFailedCallback' is called (to do whatever the developer needs to happen at that point.). (I'm getting to my question...) Next block... // Everything seems to be OK if (!empty($this->username) && $login_ok) { $this->setAuth($this->username); if (is_callable($this->loginCallback)) { call_user_func($this->loginCallback,$this->username, $this); } } (I added the comment) Now, if USERNAME is not empty AND LOGIN is OK, setAuth is called to insert the account info into the SESSION data. And then a developer defined call back is ran to do whatever the develop needs to happen at that point. Then it goes on to... /** * If the login failed: * - username given not found * - password does not match * - or the user entered no username, * set STATUS as such. */ if (!empty($this->username) && !$login_ok) { $this->status = AUTH_WRONG_LOGIN; } (again, comments are mine) Comments pretty much says what this does. But, if USERNAME *is* empty AND login is NOT ok then status is set to AUTH_WRONG_LOGIN. But if USERNAME is *not* empty AND login is NOT ok then status is NOT set. ?????? And lastly... // Something failed, so show Login again if ((empty($this->username) || !$login_ok) && $this->showLogin) { $this->drawLogin($this->storage->activeUser); return; if USERNAME is empty OR login is bad AND showlogin is ON, then display login again. Fine, simple enough. This recurses back on itself to do all this again. Potentionally forever. OK, now for my questions(s)... I'm trying to understand why this method doesn't simply check for the existance of a USERNAME right off the bat and then drop into its recursion sequence. I'm trying to see why this needs to do the DB (or whatever your container is) query with an empty KEY field. I figure I must be missing something. Something subtle or something in how autrhentication system should/need/are run. I'm trying to understand why (!empty($this->username) is called 3 times in succession. Why not just ask the question, and then as the subquestions if TRUE, and jump down to the end if FALSE? Or is this all a matter of style? And one last item... Why is status set here? Why is status not set in the methods that do the varous checking? ie: 'fetchData()' checks for the existance of a record with USERNAME, and if found then goes and calls 'verifyPassword()' to check the password. I guess, from my POV, I would have expected 'fetchData()' to set status if the USERNAME search failed (or even if the DB access failed) and that 'verifyPassword()' would have set status if that failed. Current Auth version, neither happens. Now, 'fetchData()' sets 'PEAR::raiseError()', but 'verifyPassword()' does not. I was not expecting that difference. I modified the login() method (and yes, it works) to address the issues I've brought up. [see below] I didn't touch 'fetchData()' or 'verifyPassword()' for fear of having missed something being the case that this set of methods were created as they are. Can someone please tell me what I'm missing. Thanks for reading this. Walter ================== function login() { if (!empty($this->username)) { // validate data if (true === $this->storage->fetchData($this->username, $this->password) ) { $this->setAuth($this->username); if (is_callable($this->loginCallback)) { call_user_func($this->loginCallback,$this->username, $this); } $login_ok = true; } else { if (is_callable($this->loginFailedCallback)) { call_user_func($this->loginFailedCallback,$this->username, $this); } $this->status = AUTH_WRONG_LOGIN; } } else { $login_ok = false; $this->status = AUTH_WRONG_LOGIN; } if (!$login_ok && ($this->showLogin)) { $this->drawLogin($this->storage->activeUser); } return; } ====================