AxiamMiddleware.php
Table of Contents
Classes
- AxiamMiddleware
- Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie
token, verifies it via {@see AxiamClient::verifyLocallyOrFallback()} — local JWKS
verification first, falling back to the shared single-flight refresh (§9, D-06) — and
populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on
success. Returns a standardized 401 JSON error body on any failure (missing token,
invalid signature, expired-and-unrefreshable token). Never duplicates JWKS-verify or
refresh logic itself (D-02 prohibition) — every security-critical decision is made by
{@see AxiamClient}.