AXIAM PHP SDK

MemoryOidcStateStore
in package
implements OidcStateStoreInterface

FinalYes

In-memory reference implementation of {@see OidcStateStoreInterface} (CONTRACT.md §12.3 rule 1).

Per-instance (never process/static-global), single-use, 10-minute TTL. Expired entries are dropped lazily on self::consume() and swept opportunistically on self::save() — never a background timer/thread, since a library must not keep a long-running worker (Swoole/RoadRunner) process alive on its own.

Suitable for a single-process app and for tests. A multi-instance deployment needs a shared store (Redis, database) — implement OidcStateStoreInterface yourself for that; nothing in this SDK assumes this class.

Tags
example 
$store = new MemoryOidcStateStore();
$store->save(new OidcStateEntry($state, $nonce, $codeVerifier, $redirectUri));
$entry = $store->consume($state);   // returns the entry
$again = $store->consume($state);   // null — single-use

Table of Contents

Interfaces

OidcStateStoreInterface
Optional server-side store for in-flight `oidcBegin` state (CONTRACT.md §12.3 rule 1).

Constants

TTL_SECONDS  : mixed = 600
The contract-mandated TTL for stored login state: 10 minutes, matching the server's `federation_login_state` row lifetime (§12.3 rule 1).

Methods

__construct()  : mixed
consume()  : OidcStateEntry|null
Atomically return and delete the entry for `$state`. Deletion happens before the expiry check, so even an expired hit is removed rather than left to accumulate, and a second call can never return the same entry twice — PHP's single-threaded, non-preemptive request model makes this get-then-delete pair genuinely atomic; a store backed by real concurrency (e.g. Redis) must use an atomic primitive such as `GETDEL`.
save()  : void
Persist `$entry` under its own `state`, expiring `$ttlSeconds` from now.
size()  : int
Number of unexpired entries currently held. Intended for tests and metrics.

Constants

TTL_SECONDS

The contract-mandated TTL for stored login state: 10 minutes, matching the server's `federation_login_state` row lifetime (§12.3 rule 1).

public mixed TTL_SECONDS = 600

Methods

__construct()

public __construct([int $ttlSeconds = self::TTL_SECONDS ]) : mixed
Parameters
$ttlSeconds : int = self::TTL_SECONDS

Entry lifetime in seconds. Defaults to self::TTL_SECONDS (10 minutes) and is clamped to it: a shorter TTL is honoured (useful in tests), a longer one is reduced, because §12.3 rule 1 fixes 10 minutes as the maximum.

consume()

Atomically return and delete the entry for `$state`. Deletion happens before the expiry check, so even an expired hit is removed rather than left to accumulate, and a second call can never return the same entry twice — PHP's single-threaded, non-preemptive request model makes this get-then-delete pair genuinely atomic; a store backed by real concurrency (e.g. Redis) must use an atomic primitive such as `GETDEL`.

public consume(string $state) : OidcStateEntry|null
Parameters
$state : string
Return values
OidcStateEntry|null

size()

Number of unexpired entries currently held. Intended for tests and metrics.

public size() : int
Return values
int
On this page

Search results