AuthzError
extends AxiamException
in package
Authorization failure: the caller is authenticated but lacks permission for the requested operation (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so REST and gRPC transports cannot drift on the error taxonomy.
self::getAction() and self::getResourceId() are populated when the
server's authorization_denied body reports them: action is present when known;
resourceId is present only for a resource-scoped denial. Both may be null when
the server did not report them (or for a non-authz-shaped error).
Not final, so CONTRACT.md §27.4 rule 7 can classify a 404 as
NotFoundError and a 409 as
ConflictError inside this type rather than beside
it. A catch (AuthzError $e) written before §27 existed still catches both, which is
exactly the property that rule asks for: the §2 taxonomy stays three top-level types,
and these are sub-types of one of them rather than a fourth peer.
Table of Contents
Methods
- __construct() : mixed
- getAction() : string|null
- Action the caller was denied (e.g. `users:delete`).
- getResourceId() : string|null
- Resource the denial applies to.
Methods
__construct()
public
__construct(string $message[, string|null $action = null ][, string|null $resourceId = null ]) : mixed
Parameters
- $message : string
-
Human-readable denial reason from the server.
- $action : string|null = null
-
Action that was denied (e.g.
users:delete), when the server reported it. - $resourceId : string|null = null
-
Resource the denial applies to;
nullfor a denial that is not resource-scoped.
getAction()
Action the caller was denied (e.g. `users:delete`).
public
getAction() : string|null
Return values
string|null —null when the server did not report an action.
getResourceId()
Resource the denial applies to.
public
getResourceId() : string|null
Return values
string|null —null for a global (non-resource-scoped) denial, or when the
server did not report a resource.