RequireAccess
in package
Declarative per-endpoint authorization requirement (CONTRACT.md §11, canonical `require_access(action, resource[, scope])`). Placing this attribute on a controller method or class does not itself perform any check — it is metadata read by the framework-specific enforcement listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener}, {@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which resolves the target resource and delegates the actual authorization decision to {@see \Axiam\Sdk\AccessEnforcer::enforceAccess()}.
Zero framework dependency — this class has no runtime dependency beyond the built-in
Attribute class, so it is safe to reference regardless of which (if any) web
framework is installed.
Resource resolution follows CONTRACT.md §11.2.3, in order of precedence:
- self::$resourceId — a static UUID literal, for singleton resources;
- self::$resourceParam — the name of a route/path parameter carrying the
resource UUID (defaults to
'id'); - a resolver callback supplied by the caller of the enforcement service for anything else (body fields, headers, composite lookups) — this attribute itself carries no resolver callable (attribute arguments must be compile-time constant expressions in PHP), so a resolver-based check is wired at the framework-integration call site instead of via this attribute.
A missing or unparseable resource value is a 400 invalid_request response — never a
silent allow, never a nil-UUID fallback (CONTRACT.md §11.2.3).
Attributes
- #[Attribute]
- \Attribute::TARGET_METHOD | \Attribute::TARGET_CLASS
Table of Contents
Properties
- $action : string
- $resourceId : string|null
- $resourceParam : string|null
- $scope : string|null
Methods
- __construct() : mixed
Properties
$action read-only
public
string
$action
$resourceId read-only
public
string|null
$resourceId
= null
$resourceParam read-only
public
string|null
$resourceParam
= 'id'
$scope read-only
public
string|null
$scope
= null
Methods
__construct()
public
__construct(string $action[, string|null $resourceId = null ][, string|null $resourceParam = 'id' ][, string|null $scope = null ]) : mixed
Parameters
- $action : string
-
The AXIAM action being checked (e.g.
read). - $resourceId : string|null = null
-
A static UUID literal identifying the resource, for endpoints that always target one singleton resource. Mutually exclusive in effect with self::$resourceParam — when both are set, this literal takes precedence (CONTRACT.md §11.2.3a).
- $resourceParam : string|null = 'id'
-
The name of the route/path parameter whose value is the resource UUID. Defaults to
'id'; ignored when self::$resourceId is set. - $scope : string|null = null
-
Optional sub-resource scope, passed through to
checkAccessverbatim (CONTRACT.md §11.2.4).