ClientRegistration
in package
implements
JsonSerializable
An RFC 7591 §3.2.1 / RFC 7592 §3 client information response — what {@see \Axiam\Sdk\AxiamClient::readClientRegistration()} and {@see \Axiam\Sdk\AxiamClient::updateClientRegistration()} return (CONTRACT.md §28.12.1).
registrationAccessToken and clientSecret are Sensitive (§28.12.4), so
print_r(), var_dump(), var_export(), json_encode() and string casts of this object
never show either.
Every member the server sent that this type does not name is kept, verbatim, in
self::$extra: RFC 7591 §3.2.1 lets a server add members (AXIAM's CIBA backchannel_*
members are some), and because an update is a full replacement a member a read returned
and an update left out is a member the server deletes. Passing a read's result straight to
updateClientRegistration() therefore sends it back intact, jwks / jwks_uri included.
The properties are deliberately mutable: the intended update is "read, change a field,
update", and that is $registration->clientName = 'v2'; on the value the read returned.
Table of Contents
Interfaces
- JsonSerializable
Constants
- SERVER_STATED_MEMBERS : mixed = ['registration_access_token', 'registration_cli...
- The members `updateClientRegistration()` never sends (§28.12.2 rule 4). The first four the server refuses with `400 invalid_request` when present; `client_secret` it never accepts back.
Properties
- $clientId : string
- $clientIdIssuedAt : int|null
- $clientName : string|null
- $clientSecret : Sensitive|null
- $clientSecretExpiresAt : int|null
- $extra : array<string|int, mixed>
- $grantTypes : array<string|int, mixed>|null
- $jwks : array<string|int, mixed>|null
- $jwksUri : string|null
- $redirectUris : array<string|int, mixed>|null
- $registrationAccessToken : Sensitive|null
- $registrationClientUri : string|null
- $responseTypes : array<string|int, mixed>|null
- $scope : string|null
- $tokenEndpointAuthMethod : string|null
Methods
- __construct() : mixed
- fromArray() : self
- Decode a client information response, tolerating members this type does not name.
- jsonSerialize() : array<string, mixed>
- Renders this registration for `json_encode()` — a log line, never the wire. The token and the secret stay wrapped and print `[SENSITIVE]`.
- updateBody() : array<string, mixed>
- The RFC 7592 §2.2 replacement body `updateClientRegistration()` sends (§28.12.2 rule 4): every member — the unknown ones in `$extra` included — except the five {@see self::SERVER_STATED_MEMBERS}, with `client_id` set to this registration's own.
Constants
SERVER_STATED_MEMBERS
The members `updateClientRegistration()` never sends (§28.12.2 rule 4). The first four the server refuses with `400 invalid_request` when present; `client_secret` it never accepts back.
public
mixed
SERVER_STATED_MEMBERS
= ['registration_access_token', 'registration_client_uri', 'client_secret_expires_at', 'client_id_issued_at', 'client_secret']
Properties
$clientId
public
string
$clientId
$clientIdIssuedAt
public
int|null
$clientIdIssuedAt
= null
$clientName
public
string|null
$clientName
= null
$clientSecret
public
Sensitive|null
$clientSecret
= null
$clientSecretExpiresAt
public
int|null
$clientSecretExpiresAt
= null
$extra
public
array<string|int, mixed>
$extra
= []
$grantTypes
public
array<string|int, mixed>|null
$grantTypes
= null
$jwks
public
array<string|int, mixed>|null
$jwks
= null
$jwksUri
public
string|null
$jwksUri
= null
$redirectUris
public
array<string|int, mixed>|null
$redirectUris
= null
$registrationAccessToken
public
Sensitive|null
$registrationAccessToken
= null
$registrationClientUri
public
string|null
$registrationClientUri
= null
$responseTypes
public
array<string|int, mixed>|null
$responseTypes
= null
$scope
public
string|null
$scope
= null
$tokenEndpointAuthMethod
public
string|null
$tokenEndpointAuthMethod
= null
Methods
__construct()
public
__construct(string $clientId[, int|null $clientIdIssuedAt = null ][, string|null $clientName = null ][, array<int, string>|null $redirectUris = null ][, array<int, string>|null $grantTypes = null ][, array<int, string>|null $responseTypes = null ][, string|null $tokenEndpointAuthMethod = null ][, string|null $scope = null ][, string|null $registrationClientUri = null ][, int|null $clientSecretExpiresAt = null ][, array<string, mixed>|null $jwks = null ][, string|null $jwksUri = null ][, Sensitive|null $clientSecret = null ][, Sensitive|null $registrationAccessToken = null ][, array<string, mixed> $extra = [] ]) : mixed
Parameters
- $clientId : string
-
The client's
client_id. - $clientIdIssuedAt : int|null = null
-
When the id was issued (seconds since the epoch). Never sent on an update.
- $clientName : string|null = null
-
The registered display name.
- $redirectUris : array<int, string>|null = null
-
The registered redirect URIs;
nullwhen the response did not carry them. - $grantTypes : array<int, string>|null = null
-
The registered grant types;
nullwhen the response did not carry them. - $responseTypes : array<int, string>|null = null
-
The registered response types;
nullwhen the response did not carry them. - $tokenEndpointAuthMethod : string|null = null
-
How the client authenticates at the token endpoint. The server refuses an update that changes it.
- $scope : string|null = null
-
The registered scope, space-separated.
- $registrationClientUri : string|null = null
-
Where this registration is read, replaced and deleted. Never sent on an update.
- $clientSecretExpiresAt : int|null = null
-
When the client secret expires (
0= never). Never sent on an update. - $jwks : array<string, mixed>|null = null
-
The client's JWK Set, for a
private_key_jwtclient. - $jwksUri : string|null = null
-
Where the client's JWK Set is published.
- $clientSecret : Sensitive|null = null
-
Present only on the registration response itself; never on a read or an update, and never sent back.
- $registrationAccessToken : Sensitive|null = null
-
Present on the registration response and, rotated, on every update response; absent on a read. Never sent in a body.
- $extra : array<string, mixed> = []
-
Every other member of the response, verbatim.
fromArray()
Decode a client information response, tolerating members this type does not name.
public
static fromArray(array<string|int, mixed> $wire) : self
A modelled member whose value has an unexpected type is kept in $extra rather than
dropped: a replacement must not lose what the server holds.
Parameters
- $wire : array<string|int, mixed>
-
The decoded JSON object.
Tags
Return values
selfjsonSerialize()
Renders this registration for `json_encode()` — a log line, never the wire. The token and the secret stay wrapped and print `[SENSITIVE]`.
public
jsonSerialize() : array<string, mixed>
Return values
array<string, mixed>updateBody()
The RFC 7592 §2.2 replacement body `updateClientRegistration()` sends (§28.12.2 rule 4): every member — the unknown ones in `$extra` included — except the five {@see self::SERVER_STATED_MEMBERS}, with `client_id` set to this registration's own.
public
updateBody() : array<string, mixed>
It is built from what the read carried (§34.2 P12.4): a member that is null — one the
read did not carry — is not sent, so no list becomes [] because the read lacked it,
and a member of an unexpected shape goes back exactly as read.
Holds no secret: the token and the client secret are exactly what it leaves out.