ProtectedResourceMetadataController
in package
Symfony's realization of CONTRACT.md §28.3's `serve_protected_resource_metadata`: an invokable controller that serves the RFC 9728 protected-resource metadata document, `200 application/json`, at the path {@see ProtectedResourceMetadata} derived from the `resource` it was built from.
Named …Controller rather than serveProtectedResourceMetadata — the canonical
name §28.7's naming map pins for PHP — because Symfony's routing table is
declarative configuration (routes.yaml/attributes) rather than a runtime call
this SDK can hook, unlike Laravel's Route::serveProtectedResourceMetadata()
macro. The integrator wires this controller into their own routing configuration
at $metadata->metadataPath (see this repository's README for a worked example);
this class supplies everything CONTRACT.md §28.3's response rules require once
that route is hit, so nothing about the response itself is left to the
integrator to get right.
The response is 200, Content-Type: application/json, the document body
exactly, Cache-Control: public, max-age=3600 and
Access-Control-Allow-Origin: * — identical for every caller, no
Access-Control-Allow-Credentials, and reachable with no credential of any
kind (§28.3 rules 1–6). AxiamAuthSubscriber listens on every request and
must itself exempt this exact path from authentication (see its own docblock);
this controller carries no auth logic of its own to duplicate that with.
Table of Contents
Methods
- __construct() : mixed
- __invoke() : JsonResponse
- Serves the document (CONTRACT.md §28.3).
Methods
__construct()
public
__construct(ProtectedResourceMetadata $metadata[, AxiamAuthSubscriber|null $guard = null ]) : mixed
Parameters
- $metadata : ProtectedResourceMetadata
-
The value a prior
Mcp::protectedResourceMetadata(...)call returned. Immutable, so the SAME response is served on every request (§28.3 rule 4). - $guard : AxiamAuthSubscriber|null = null
-
Optionally, the subscriber this document's guard is configured from — passing it lets this controller apply CONTRACT.md §28.5 rule 3's cross-check (refuse at construction when the subscriber's
resourceMetadataUrl/expectedAudiencedisagree with$metadata) instead of silently publishing a document the guard does not agree with. Omit it when the guard runs in a separate process, where nothing can be cross-checked.
__invoke()
Serves the document (CONTRACT.md §28.3).
public
__invoke() : JsonResponse