[amasiye]

Summary

• complete global, controller, and handler exception-filter registration
• resolve filter class names through dependency injection while preserving configured filter instances
• enforce handler → controller → global precedence and terminal first-match handling
• prevent duplicate response emission
• run filters before the request session closes
• add the opt-in, configurable LoginRedirectFilter
• load application-controlled authentication and session policy from config/auth.php
• retain safe intended targets only and prevent login redirect loops
• reject backslash, CR/LF, external, and scheme-relative redirect targets
• add nested session defaults, removal, and one-time Session::pull() access
• preserve normal API 401 behavior when the redirect filter is absent
• reserve 0.10.0 for the authentication/filter milestone and reconcile the deferred database-sync roadmap
• align first-party Core dependencies and lock data with the published 0.10 release line

No authentication interceptor is introduced or required.

Validation

• focused exception-filter lane passed: 10 tests, 42 assertions
• focused configuration lane passed: 11 tests, 37 assertions, 2 skipped
• full suite passed: 216 tests, 742 assertions, 5 skipped, 1 incomplete
• PHPStan level 8 passed across 221 files with no errors
• composer validate --strict passed
• composer.lock resolves Collections, Common, Forms, Util, and Validation at 0.10.0

No tags or package releases are included in this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8ec0f2bf19

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

💡 Codex Review

core/src/Exceptions/Filters/LoginRedirectFilterOptions.php

Lines 37 to 40 in c7f2cbc

	if (
	$loginUrlParts === false ||
	str_starts_with($this->loginUrl, '//') ||
	(is_string($scheme) && !in_array(strtolower($scheme), ['http', 'https'], true))

Reject pathless login redirect references

When authentication.loginRedirect.url is a pathless relative reference such as ?login=1 or #login, this validation accepts it, but effectiveExcludedPaths() cannot add a login path. A request to a protected /members route is therefore redirected back to /members?login=1 (or the same URL with a fragment), where the filter runs again indefinitely. Require a root-relative path for non-absolute URLs, or resolve the reference to its effective path before loop exclusion.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".