AXIAM PHP SDK

TokenGrpcClient extends BaseStub
in package

FinalYes

gRPC token-validation transport (CONTRACT.md §1.1.1/§10.3, contract 1.51) — wraps `axiam.v1.TokenService/ValidateToken` and `/IntrospectToken`, the RPCs §10.3 obliges a gRPC-validating SDK to read `cnf` from and no method in this SDK's public surface wrapped before 1.51.

The hand-written service-client sibling of AuthzGrpcClient and UserInfoGrpcClient: same channel/metadata/status-mapping machinery, differing only in the two RPCs it exposes.

PITFALL 4 / T-22-16 (extension_loaded('grpc') guard, high severity): this class extends \Grpc\BaseStub, exactly like its two siblings. The invariant is the same one they document: nothing outside AuthzDispatcher's extension_loaded('grpc')-guarded branches may ever reference this class name — AuthzDispatcher is the only call site.

Two tokens, kept apart (§1.1.1 rule 1). Every call here carries TWO credentials. The CALLER's own access token authenticates the RPC itself, exactly as for every other call this SDK makes — it travels in authorization metadata via $tokenAccessor, enforced by the server's interceptor like any other, including its own cnf. The INSPECTED token — the one being asked about — is a required Sensitive argument and travels in the request MESSAGE. It has no default and can never fall back to the caller's own token.

Table of Contents

Methods

__construct()  : mixed
introspectToken()  : TokenIntrospection
`IntrospectToken` (CONTRACT.md §1.1.1) — the RFC 7662 set, plus the confirmation.
validateToken()  : TokenValidation
`ValidateToken` (CONTRACT.md §1.1.1) — signature + expiry, plus the confirmation §10.3 exists for.

Methods

__construct()

public __construct(string $hostname, callable(): Array $tokenAccessor, string $tenantId[, string|null $customCaPem = null ][, string|null $clientCertPem = null ][, Sensitive|null $clientKey = null ][, array<string, mixed> $options = [] ]) : mixed
Parameters
$hostname : string

gRPC target, e.g. "api.axiam.example:9443".

$tokenAccessor : callable(): Array

Reads the CALLER'S current access token live — never the inspected token, which is a separate parameter on each call below.

$tenantId : string

Injected as the x-tenant-id metadata key on every RPC (§5).

$customCaPem : string|null = null

PEM-encoded custom CA bundle (§6's ONLY escape hatch); omit to use the system trust roots.

$clientCertPem : string|null = null

§6.1 (mTLS): PEM client-certificate chain this channel presents for mutual TLS; omit for bearer-token-only auth.

$clientKey : Sensitive|null = null

§6.1/§7 (mTLS): the matching private key.

$options : array<string, mixed> = []

Additional \Grpc\BaseStub constructor options; credentials is always set by this constructor.

validateToken()

`ValidateToken` (CONTRACT.md §1.1.1) — signature + expiry, plus the confirmation §10.3 exists for.

public validateToken(Sensitive|string $inspectedAccessToken) : TokenValidation
Parameters
$inspectedAccessToken : Sensitive|string

The token being asked about. Secret material (§1.1.1 rule 2) — hold it behind Sensitive where the caller can.

Return values
TokenValidation
On this page

Search results