AuthMiddleware
in package
`HandlerStack` middleware: injects `Authorization` (current access token) and `X-Tenant-ID` on EVERY outgoing request, `X-Axiam-Tenant` (CONTRACT.md §5.2 rule 1, contract 1.51) on every request while an acting tenant is set, and `X-CSRF-Token` (captured from a prior response, {@see Session::csrfToken()}) on state-changing requests (CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
Pushed on the HandlerStack AFTER RefreshMiddleware (AxiamClient builds
$authzStack that way). HandlerStack runs the first pushed middleware first on a request,
so Guzzle's own middleware (cookies included) run first, then RefreshMiddleware, then this
one, then the base handler. The replay RefreshMiddleware issues after a single-flight
refresh goes through the handler it wraps, which is this middleware, so a retried request is
re-decorated with the FRESH access token / CSRF value picked up from the shared
Session — never the stale headers from the original 401'd attempt
(tests/Contract164/RetriedRequestHeadersTest.php).
CONTRACT.md §12.1 note 3 / §12.3 rule 2: a request to /oauth2/* never gets the
Authorization header, regardless of whether Session::accessToken() is
currently returning a cookie-sourced session token or a
login_client_credentials-adopted one (§12.1's opt-in credential-adoption MAY) —
those endpoints authenticate the CLIENT through the form body
(client_secret_post, never Authorization: Basic or Bearer).
Table of Contents
Constants
- CREDENTIAL_OVERRIDE_OPTION : mixed = 'axiam_credential_override'
- Per-request Guzzle option naming a bearer credential that is **not** the session's (CONTRACT.md §20.2 rule 1: the UMA Protection API carries a PAT).
- NO_SESSION_CREDENTIALS_OPTION : mixed = 'axiam_no_session_credentials'
- Per-request Guzzle option (bool) that suppresses `Authorization` and `X-CSRF-Token` entirely, regardless of what {@see Session::accessToken()}/{@see Session::csrfToken()} currently hold. Set by {@see \Axiam\Sdk\AxiamClient::postWithoutSessionCredentials()}, which the §24.1 `setup/register/*` pair uses (CONTRACT.md §24.1/§25.2, contract 1.45): a setup token travels in the body as the ONLY credential those two calls accept, and an SDK MUST NOT attach the session's on top of it — even when one happens to be configured.
Methods
- __construct() : mixed
- __invoke() : callable
- Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
Constants
CREDENTIAL_OVERRIDE_OPTION
Per-request Guzzle option naming a bearer credential that is **not** the session's (CONTRACT.md §20.2 rule 1: the UMA Protection API carries a PAT).
public
mixed
CREDENTIAL_OVERRIDE_OPTION
= 'axiam_credential_override'
It exists because this middleware overwrites Authorization unconditionally — it
has to, so a request retried after a single-flight refresh is re-decorated with the
fresh token rather than the stale one it already carries. A caller therefore cannot
express "use this credential" by setting the header; it would be silently
replaced by the session token, which is exactly the fallback §20.2 rule 1 forbids.
When this option is present the session token is never consulted.
NO_SESSION_CREDENTIALS_OPTION
Per-request Guzzle option (bool) that suppresses `Authorization` and `X-CSRF-Token` entirely, regardless of what {@see Session::accessToken()}/{@see Session::csrfToken()} currently hold. Set by {@see \Axiam\Sdk\AxiamClient::postWithoutSessionCredentials()}, which the §24.1 `setup/register/*` pair uses (CONTRACT.md §24.1/§25.2, contract 1.45): a setup token travels in the body as the ONLY credential those two calls accept, and an SDK MUST NOT attach the session's on top of it — even when one happens to be configured.
public
mixed
NO_SESSION_CREDENTIALS_OPTION
= 'axiam_no_session_credentials'
X-Tenant-ID is unaffected — it is routing context, not a credential (§5 rule 2), and
a request carrying this option still carries it.
Methods
__construct()
public
__construct(Session $session) : mixed
Parameters
- $session : Session
-
Session supplying the tenant, bearer token and CSRF token.
__invoke()
Wraps the next Guzzle handler, decorating same-origin requests with the tenant header, bearer token and — on state-changing methods (§3) — the `X-CSRF-Token` header.
public
__invoke(callable $handler) : callable
Cross-host requests (and cross-host redirects) are deliberately left undecorated so the credentials never leak to a third-party URL.
Parameters
- $handler : callable
-
Next handler in the Guzzle stack.
Return values
callable —Decorated handler.