AuthMiddleware
in package
`HandlerStack` middleware: injects `Authorization` (current access token) and `X-Tenant-ID` on EVERY outgoing request, and `X-CSRF-Token` (captured from a prior response, {@see Session::csrfToken()}) on state-changing requests (CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
Registered on the HandlerStack closer to the base handler than
RefreshMiddleware, so a retried request (after a single-flight refresh) is
re-decorated with the FRESH access token / CSRF value picked up from the shared
Session — never the stale headers from the original 401'd attempt.
CONTRACT.md §12.1 note 3 / §12.3 rule 2: a request to /oauth2/* never gets the
Authorization header, regardless of whether Session::accessToken() is
currently returning a cookie-sourced session token or a
login_client_credentials-adopted one (§12.1's opt-in credential-adoption MAY) —
those endpoints authenticate the CLIENT through the form body
(client_secret_post, never Authorization: Basic or Bearer).
Table of Contents
Constants
- CREDENTIAL_OVERRIDE_OPTION : mixed = 'axiam_credential_override'
- Per-request Guzzle option naming a bearer credential that is **not** the session's (CONTRACT.md §20.2 rule 1: the UMA Protection API carries a PAT).
Methods
- __construct() : mixed
- __invoke() : callable
- Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
Constants
CREDENTIAL_OVERRIDE_OPTION
Per-request Guzzle option naming a bearer credential that is **not** the session's (CONTRACT.md §20.2 rule 1: the UMA Protection API carries a PAT).
public
mixed
CREDENTIAL_OVERRIDE_OPTION
= 'axiam_credential_override'
It exists because this middleware overwrites Authorization unconditionally — it
has to, so a request retried after a single-flight refresh is re-decorated with the
fresh token rather than the stale one it already carries. A caller therefore cannot
express "use this credential" by setting the header; it would be silently
replaced by the session token, which is exactly the fallback §20.2 rule 1 forbids.
When this option is present the session token is never consulted.
Methods
__construct()
public
__construct(Session $session) : mixed
Parameters
- $session : Session
-
Session supplying the tenant, bearer token and CSRF token.
__invoke()
Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
public
__invoke(callable $handler) : callable
Cross-host requests (and cross-host redirects) are deliberately left undecorated so the credentials never leak to a third-party URL.
Parameters
- $handler : callable
-
Next handler in the Guzzle stack.
Return values
callable —Decorated handler.