TokenValidation
in package
uses
TokenBindingSupport
The result of `AxiamClient::validateToken()` — every field of the wire `ValidateTokenResponse` (CONTRACT.md §1.1.1 rule 3, contract 1.51).
$valid is not permission to proceed. Call self::status(), or
self::verifyPossession(); see TokenStatus's own doc for why.
Table of Contents
Properties
- $cnf : array<string|int, mixed>|null
- $exp : int
- $orgId : string
- $subjectId : string
- $tenantId : string
- $tokenType : string
- $valid : bool
Methods
- __construct() : mixed
- fromWire() : self
- Decodes the wire {@see ValidateTokenResponse} into this typed value.
- status() : TokenStatus
- Which of the §10.1 rule 9 cases this is, decided from `$valid` and `$cnf` — never from `$tokenType`.
- verifyPossession() : void
- Whether the PRESENTER may use this token: `$valid`, and every sender constraint `$cnf` names satisfied by `$proofs` (§10.1 rule 9, §10.3 rule 2).
Properties
$cnf read-only
public
array<string|int, mixed>|null
$cnf
$exp read-only
public
int
$exp
$orgId read-only
public
string
$orgId
$subjectId read-only
public
string
$subjectId
$tenantId read-only
public
string
$tenantId
$tokenType read-only
public
string
$tokenType
$valid read-only
public
bool
$valid
Methods
__construct()
public
__construct(bool $valid, string $subjectId, string $tenantId, string $orgId, int $exp, array{'x5t#S256': ?string, jkt: ?string}|null $cnf, string $tokenType) : mixed
Parameters
- $valid : bool
-
The server's verdict on signature, expiry and tenant — and nothing more.
falsefor a token of another tenant, with every other field empty (§1.1.1 rule 6). - $subjectId : string
-
Subject UUID; empty when not valid.
- $tenantId : string
-
Tenant UUID; empty when not valid.
- $orgId : string
-
Organization UUID; empty when not valid.
- $exp : int
-
Expiry, seconds since the epoch;
0when not valid. - $cnf : array{'x5t#S256': ?string, jkt: ?string}|null
-
The RFC 7800 confirmation.
nullmeans unbound; a present array with both membersnullis an empty confirmation, refused rather than read as unbound (§10.3 rule 3). Always carried, whether or not the caller looks at it — the field is the reason this method exists. - $tokenType : string
-
"Bearer"or"DPoP". Does not say whether the token is bound*: a certificate-bound token is"Bearer"(§1.1.1 rule 5). Use self::status().
fromWire()
Decodes the wire {@see ValidateTokenResponse} into this typed value.
public
static fromWire(ValidateTokenResponse $wire) : self
Parameters
- $wire : ValidateTokenResponse
Return values
selfstatus()
Which of the §10.1 rule 9 cases this is, decided from `$valid` and `$cnf` — never from `$tokenType`.
public
status() : TokenStatus
Return values
TokenStatusverifyPossession()
Whether the PRESENTER may use this token: `$valid`, and every sender constraint `$cnf` names satisfied by `$proofs` (§10.1 rule 9, §10.3 rule 2).
public
verifyPossession(PresentedProofs $proofs) : void
Parameters
- $proofs : PresentedProofs