User menu

The avatar in the topbar opens the user menu: the name and e-mail of the user, the profile (if the panel has the profile page), your own entries and logout.

use Anvil\Panel\Navigation\UserMenuItem;

public function userMenuItems(): array
{
    return [
        UserMenuItem::page('settings'),                       // a page of the panel
        UserMenuItem::make('API tokens')->url($this->url('tokens'))->icon('key')->group('Account'),
        UserMenuItem::make('Audit log')->url($this->url('audit'))->icon('journal-text')
            ->group('Administration')->permission('audit.view'),
        UserMenuItem::make('Help')->url('https://help.example.com')->icon('question-circle')->group('Support'),
    ];
}

Options

Option	Effect
`UserMenuItem::page('slug')`	label, URL, icon and permission of a page of the panel; hidden when the user may not open the page; `label()` and `icon()` override
`UserMenuItem::make('Label')`	an entry with its own URL
`url('…')`	a path of the application (`/…`) or an `http(s)://` URL; other schemes (`javascript:`, `data:`) throw an exception
`label('…')`	text of the entry
`icon('key')`	Bootstrap icon
`group('Account')`	group with a divider and its label
`sort(10)`	order within the menu (default 0, then the order of the list)
`permission('audit.view')`	only users with the permission see the entry

Order

Name and e-mail of the user.
Profile.
Entries without a group.
Groups, in the order of their first entry, each with a divider and its label.
Logout.

Pages that belong to the user rather than to the work (settings, tokens, preferences) fit better into the user menu than into the sidebar. Take them out of the sidebar:

final class SettingsPage extends Page
{
    public function title(): string { return 'My settings'; }

    public function navigationIcon(): string { return 'sliders'; }

    public function shouldRegisterNavigation(): bool { return false; }

    public function permission(): ?string { return null; }   // every user of the panel
}

UserMenuItem::page('settings') uses its title and icon.

External links

URLs starting with http:// or https:// open in a new tab with rel="noopener noreferrer" and show an arrow icon.

Permissions

permission() only hides the entry. The target must check the permission as well – pages do this with permission(); for other URLs it is your route’s job.

Logout

With password login, logout is a link to Shield’s logout. With single sign-on it is a form (POST with CSRF token) to /sso/logout, which also ends the session at the identity provider where supported.