AxiamAuthSubscriber.php
Table of Contents
Classes
- AxiamAuthSubscriber
- Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to
`kernel.request`, extracts the bearer/cookie token, verifies it via
{@see AxiamClient::verifyLocally()} — the no-fallback seam mandated by §10.1 rule 8
— and populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles`
on success. Short-circuits the request with a standardized 401 JSON error body on any
failure (missing token, invalid signature, expired token). Never duplicates
JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is
made by {@see AxiamClient}.