AXIAM PHP SDK

McpGuardOptions
in package

FinalYes

Validates a §10 guard's CONTRACT.md §28.5 configuration and precomputes the challenge values it will emit, at guard-CONSTRUCTION time so that an invalid one is a startup failure rather than a surprise on the 401 path — the same discipline {@see \Axiam\Sdk\AxiamClient}'s own constructor applies to every other CONDITIONAL option.

Built by AxiamMiddleware and AxiamAuthSubscriber — the two §10 guards — so the §28.5 option can never drift between the two framework bridges.

Table of Contents

Properties

$invalidTokenChallenge  : string
$metadataPath  : string
$noCredentialChallenge  : string
$resourceMetadataUrl  : string

Methods

build()  : self
challengeFor401()  : string
Picks between CONTRACT.md §28.4's first two vectors for a `401`: `invalidToken` when the request carried a credential, `noCredential` when it carried none. RFC 6750 §3 says a resource server SHOULD NOT name an error code when the request carried no authentication information at all — no credential is not a bad credential, and a client has to be able to tell the two apart.
insufficientScopeChallenge()  : string|null
CONTRACT.md §28.5 rule 5: the one class of `403` that carries a challenge, and only it. A `no_grant` denial on a route that named a scope means *ask for more*, which is exactly what a challenge invites a client to do; every other reason code — `denied_by_rule`, absent, or unrecognised — leaves the outcome alone (§11.2 rule 9), which is a header-free 403.
isMetadataDocumentRequest()  : bool
Is this request the unauthenticated `GET`/`HEAD` of the metadata document (CONTRACT.md §28.3 rule 2)? A document that 401s cannot start the handshake it exists to start — the client would be holding a 401 and being told to go read a page that answers 401.

Properties

$invalidTokenChallenge read-only

public string $invalidTokenChallenge

$noCredentialChallenge read-only

public string $noCredentialChallenge

Methods

build()

public static build(string $operation, string $resourceMetadataUrl, string|null $expectedAudience) : self
Parameters
$operation : string

The guard class's own name, so a refusal says which guard refused (e.g. AxiamMiddleware, AxiamAuthSubscriber).

$resourceMetadataUrl : string

CONTRACT.md §28.5's option — the document's URL. Setting it on a guard is what turns §28 on for that guard.

$expectedAudience : string|null

The SAME §10.1 row 6 expectedAudience the AxiamClient this guard was built from was constructed with — read via AxiamClient::expectedAudience(). §28 adds no second audience option.

Tags
throws
ValidationError

When $expectedAudience is null/empty (CONTRACT.md §28.5 rule 2), or $resourceMetadataUrl is outside §28.4's syntax for resource_metadata.

Return values
self

challengeFor401()

Picks between CONTRACT.md §28.4's first two vectors for a `401`: `invalidToken` when the request carried a credential, `noCredential` when it carried none. RFC 6750 §3 says a resource server SHOULD NOT name an error code when the request carried no authentication information at all — no credential is not a bad credential, and a client has to be able to tell the two apart.

public challengeFor401(bool $credentialPresented) : string
Parameters
$credentialPresented : bool
Return values
string

insufficientScopeChallenge()

CONTRACT.md §28.5 rule 5: the one class of `403` that carries a challenge, and only it. A `no_grant` denial on a route that named a scope means *ask for more*, which is exactly what a challenge invites a client to do; every other reason code — `denied_by_rule`, absent, or unrecognised — leaves the outcome alone (§11.2 rule 9), which is a header-free 403.

public insufficientScopeChallenge(string $reasonCode, string $scope) : string|null
Parameters
$reasonCode : string
$scope : string

The scope the route asked for, verbatim (never synthesised, never derived, never substituted — CONTRACT.md §28.5 rule 6).

Return values
string|null

isMetadataDocumentRequest()

Is this request the unauthenticated `GET`/`HEAD` of the metadata document (CONTRACT.md §28.3 rule 2)? A document that 401s cannot start the handshake it exists to start — the client would be holding a 401 and being told to go read a page that answers 401.

public isMetadataDocumentRequest(string $method, string $path) : bool
Parameters
$method : string
$path : string
Return values
bool
On this page

Search results