axiam::Client Class Reference

#include <client.hpp>

Classes
class	Builder

Public Member Functions
LoginResult	login (const std::string &username_or_email, const std::string &password)
LoginResult	verify_mfa (const Sensitive< std::string > &challenge_token, const std::string &totp_code)
	Complete an MFA challenge.
LoginResult	verify_mfa (const std::string &challenge_token, const std::string &totp_code)
	Overload for a challenge token obtained out of band (e.g.
TokenPair	refresh ()
void	logout ()
AccessDecision	check_access (const std::string &action, const std::string &resource_id, std::optional< std::string > scope=std::nullopt, std::optional< std::string > subject_id=std::nullopt)
AccessDecision	can (const std::string &action, const std::string &resource_id, std::optional< std::string > scope=std::nullopt, std::optional< std::string > subject_id=std::nullopt)
std::vector< AccessDecision >	batch_check (const std::vector< AccessCheck > &checks)
DeviceAuth	authenticate_device ()
	§6.1 device / service-account authentication via the configured mTLS client certificate (POST /api/v1/auth/device).
std::future< LoginResult >	login_async (std::string username_or_email, std::string password)
std::future< TokenPair >	refresh_async ()
std::future< AccessDecision >	check_access_async (std::string action, std::string resource_id, std::optional< std::string > scope=std::nullopt, std::optional< std::string > subject_id=std::nullopt)
std::future< std::vector< AccessDecision > >	batch_check_async (std::vector< AccessCheck > checks)
int	refresh_call_count () const
	Number of times a network refresh call was actually issued (§9 assertion).
void	_set_retry_test_seams (std::function< double()> jitter, std::function< void(std::chrono::milliseconds)> sleeper)
	Test seam: replace the §16 jitter source and the sleep.
std::optional< std::string >	csrf_token () const
	Currently-stored CSRF token, if any (§3).
bool	has_session () const
	Whether a session has been established (login/verify_mfa succeeded).
JwksVerifier &	jwks ()
	Shared JWKS verifier bound to this client's transport + base URL.
const std::string &	tenant_header () const
	Tenant identifier injected as X-Tenant-ID on every request (§5).
void	close ()
	Deterministic shutdown (CONTRACT.md §18).

Static Public Member Functions
static Builder	builder ()

Member Function Documentation

builder()

static Builder axiam::Client::builder ( )

static

login()

LoginResult axiam::Client::login	(	const std::string &	username_or_email,
		const std::string &	password
	)

verify_mfa() [1/2]

LoginResult axiam::Client::verify_mfa	(	const Sensitive< std::string > &	challenge_token,
		const std::string &	totp_code
	)

Complete an MFA challenge.

Takes the wrapped token straight from LoginResult::challenge_token (§7).

verify_mfa() [2/2]

LoginResult axiam::Client::verify_mfa	(	const std::string &	challenge_token,
		const std::string &	totp_code
	)

Overload for a challenge token obtained out of band (e.g.

relayed by a front end). Prefer the Sensitive overload.

refresh()

TokenPair axiam::Client::refresh

(

)

logout()

void axiam::Client::logout

(

)

check_access()

AccessDecision axiam::Client::check_access	(	const std::string &	action,
		const std::string &	resource_id,
		std::optional< std::string >	scope = std::nullopt,
		std::optional< std::string >	subject_id = std::nullopt
	)

can()

AccessDecision axiam::Client::can	(	const std::string &	action,
		const std::string &	resource_id,
		std::optional< std::string >	scope = std::nullopt,
		std::optional< std::string >	subject_id = std::nullopt
	)

batch_check()

std::vector< AccessDecision > axiam::Client::batch_check

(

const std::vector< AccessCheck > &

checks

)

authenticate_device()

DeviceAuth axiam::Client::authenticate_device

(

)

§6.1 device / service-account authentication via the configured mTLS client certificate (POST /api/v1/auth/device).

login_async()

std::future< LoginResult > axiam::Client::login_async	(	std::string	username_or_email,
		std::string	password
	)

refresh_async()

std::future< TokenPair > axiam::Client::refresh_async

(

)

check_access_async()

std::future< AccessDecision > axiam::Client::check_access_async	(	std::string	action,
		std::string	resource_id,
		std::optional< std::string >	scope = std::nullopt,
		std::optional< std::string >	subject_id = std::nullopt
	)

batch_check_async()

std::future< std::vector< AccessDecision > > axiam::Client::batch_check_async

(

std::vector< AccessCheck >

checks

)

refresh_call_count()

int axiam::Client::refresh_call_count

(

)

const

Number of times a network refresh call was actually issued (§9 assertion).

_set_retry_test_seams()

void axiam::Client::_set_retry_test_seams	(	std::function< double()>	jitter,
		std::function< void(std::chrono::milliseconds)>	sleeper
	)

Test seam: replace the §16 jitter source and the sleep.

§16.7 requires backoff and jitter to be tested with an injected clock and an injected PRNG, never by sleeping — a test that really waits 200 ms is a test nobody runs. This is the only way to reach those from outside, since the policy is otherwise sealed inside the impl. NEVER called in production; nothing in src/ writes it.

csrf_token()

std::optional< std::string > axiam::Client::csrf_token

(

)

const

Currently-stored CSRF token, if any (§3).

has_session()

bool axiam::Client::has_session

(

)

const

Whether a session has been established (login/verify_mfa succeeded).

jwks()

JwksVerifier & axiam::Client::jwks

(

)

Shared JWKS verifier bound to this client's transport + base URL.

tenant_header()

const std::string & axiam::Client::tenant_header

(

)

const

Tenant identifier injected as X-Tenant-ID on every request (§5).

close()

void axiam::Client::close

(

)

Deterministic shutdown (CONTRACT.md §18).

Releases the transport and its connection pool, and clears the cookie jar, the CSRF token and the §17 memo.

• IDEMPOTENT (§18.1 rule 2): calling it twice is a no-op the second time, never a double release. Cleanup runs from error paths, and an error path that itself throws hides the original failure.
• DOES NOT LOG OUT (§18.1 rule 5): it issues no request. The server-side session deliberately outlives the client object — that is what lets a process restart and resume — so a close() that logged out would silently end every user's session on each deploy.
• USE AFTER CLOSE IS AN ERROR, NOT UNDEFINED (§18.1 rule 4): every operation afterwards throws NetworkError naming the cause rather than silently reconnecting.

The destructor releases whatever close() has not, so a Client that goes out of scope without an explicit close() still frees its transport — §18.1 rule 1's "a destructor plus close()" for C++.

---

The documentation for this class was generated from the following file:

• include/axiam/client.hpp