OOPhoto: Implementing Security In An Object Oriented Application - Round I

<cffunction
	name="GetUser"
	access="public"
	returntype="any"
	output="false"
	hint="I return a new user (either by creating a totally new one or building one based on existing data).">
 
	<!--- Define the local scope. --->
	<cfset var LOCAL = {} />
 
	<!---
		The user ID is just stored as a regular ID in the cookie.
		Let's param the value to make sure we can refer to it.
	--->
	<cfparam name="COOKIE.ID" type="numeric" default="0" />
 
	<!---
		Now that we have the cookie paramed, let's try to
		authenticate the user based on the COOKIE as well as
		environmental variables.
	--->
	<cfset LOCAL.ID = THIS.Authenticate(
		COOKIE.ID,
		CGI.http_user_agent,
		CGI.remote_addr
		) />
 
	<!---
		Now that we have a user ID, let's load the user object.
		We need to wrap this in a Try/Catch block since the
		Load() method will raise an exception if the ID we
		authenticated is zero.
	--->
	<cftry>
		<cfset LOCAL.User = VARIABLES.UserService.Load( LOCAL.ID ) />
 
		<!--- Catch load error. --->
		<cfcatch>
 
			<!---
				The load did not work, so let's just create a
				new user.
			--->
			<cfset LOCAL.User = VARIABLES.UserService.New() />
 
			<!---
				Since we created a new user, we need to store
				some information manually as well as set the ID
				in the COOKIE so we can refer to it later.
			--->
			<cfset LOCAL.User
				.SetUserAgent( CGI.http_user_agent )
				.SetIPAddress( CGI.remote_addr )
				.SetDateCreated( NOW() )
				/>
 
			<!---
				Now that we have populated the user, let's store
				it. This will persist the data for the next
				session and give us a new ID that we can be put
				into the cookies.
			--->
			<cfset LOCAL.User.Save() />
 
			<!---
				Now that we have saved the user, store the new ID
				in the cookie.
			--->
			<cfcookie
				name="ID"
				value="#LOCAL.User.GetID()#"
				expires="never"
				/>
 
		</cfcatch>
	</cftry>
 
 
	<!---
		At this point, we have created are user object.
		Now, let's authorize the user object to participte in
		our application.
	--->
	<cfset THIS.Authorize( LOCAL.User ) />
 
	<!--- Return the initialized, authorized user. --->
	<cfreturn LOCAL.User />
</cffunction>

For Cut-and-Paste