I had asked questions about my entire class which I'll flag for closing soon. It appeared to be a little too broad for 1 post so I chopped it up and will be asking a little more specific questions separately.In my Application Layer I have a class AuthService containing the following method with a code structure that has gotten quite complex with if statements that I'm unable to re-factor a better way.I'd appreciate anybody who could review this piece of code and give me suggestions on  improving / optimizing the design of it. Any other suggestions are welcome as well.public function findLoggedInUser(){    if (($userData = $this->httpSession->getParameter('user')) && isset($userData['id'])) {        // User found in current http session        return $this->userMapper->findById($userData['id']);    } elseif ($httpSessionData = $this->httpCookie->getParameter('usess')) {        if (isset($httpSessionData['uid'], $httpSessionData['sno'], $httpSessionData['token'])) {            if ($user = $this->userMapper->findById($httpSessionData['uid'])) {                if ($httpSession = $this->httpSessionMapper->findByUserAndSeriesNo($user, $httpSessionData['sno'])) {                    if (password_verify($httpSessionData['token'], (string) $httpSession->getTokenHash()) {                        // Generate new http session entity tokens                        $token['raw']  = new Token(CryptoCharGen::numeric(60));                        $token['hash'] = new TokenHash(password_hash((string) $token['raw'], PASSWORD_BCRYPT, ['cost' => 4]));                        // Update and persist http session entity with new token                        $httpSession->setTokenHash($token['hash']);                        $this->httpSessionMapper->update($httpSession);                        // Issue new http cookie usess with updated http session recovery data                        $this->httpCookie->setParameter('usess', [                            'uid'   => (string) $httpSession->getUser()->getId(),                            'sno'   => (string) $httpSession->getSeriesNo(),                            'token' => (string) $token['raw']                        ], 60 * 60 * 24 * 90);                        // User has been found                        return $httpSession->getUser();                    } else {                        // Token invalid, sabotage assumed                        // Invalidate all persisted http sessions of this user                        $this->httpSessionMapper->deleteAllByUser($user);                        $this->httpCookie->destroy('usess');                    }                } else {                    // Destroy invalid cookie                    $this->httpCookie->destroy('usess');                }            } else {                // Destroy invalid cookie                $this->httpCookie->destroy('usess');            }        } else {            // Destroy invalid cookie            $this->httpCookie->destroy('usess');        }    }}
Complex if statements in authentication method
php;optimization;object oriented;php5;authentication
Use Guard ExpressionsThe proper way to do this is to use Guard expressions.If you have a number of conditions that need to be true before you take an action. You don't check them all in a nested manner but instead check their negations one and one and return/break if you find any condition that is not met.ExampleInstead of having:if(a){  if(b){    if(c)      ...      return SUCCESS;    else      return FAIL;  else    return FAIL;}else  return FAIL;You can invert the checks and collapse the nesting like this:if(!a)   return FAIL;if(!b)   return FAIL;if(!c)   return FAIL...return SUCCESS;Or if the consequence of failing the checks are the same, you can collapse the ifs like this:if(!a || !b || !c)   return FAIL;...return SUCCESS;Which method to choose depends on how long the expressions a, b and c are and which one you find more readable.Your codeUse with caution! I might have missed something as my PHP is rusty.if (!isset($httpSessionData['uid'], $httpSessionData['sno'], $httpSessionData['token'])) {   $this->httpCookie->destroy('usess');   return;}$user = $this->userMapper->findById($httpSessionData['uid'])if (!$user) {    $this->httpCookie->destroy('usess');   return;}$httpSession = $this->httpSessionMapper->findByUserAndSeriesNo($user, $httpSessionData['sno'])if (!$httpSession) {    $this->httpCookie->destroy('usess');   return;}if (password_verify($httpSessionData['token'], (string) $httpSession->getTokenHash()) {    // ...    return $httpSession->getUser();} else {    // Token invalid, sabotage assumed    // Invalidate all persisted http sessions of this user    $this->httpSessionMapper->deleteAllByUser($user);    $this->httpCookie->destroy('usess');}