Laravel
Table of Contents
Classes
- AxiamAccessMiddleware
- Laravel CONTRACT.md §11 declarative-authorization enforcement middleware, registered
under the `axiam.access` alias (D-02). Supports BOTH developer-experience styles the
plan calls for, from the SAME class, delegating every actual decision to the shared
{@see AccessEnforcer} (never re-implementing resource resolution, subject
propagation, or the error-mapping table itself):
- AxiamGate
- Laravel authorization gate (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker.
- AxiamMiddleware
- Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie
token, verifies it via {@see AxiamClient::verifyLocally()} — the no-fallback seam
mandated by §10.1 rule 8 — and populates the `axiam_user` request attribute with
`user_id`/`tenant_id`/`roles` on success. Returns a standardized 401 JSON error body on
any failure (missing token, invalid signature, expired token). Never duplicates
JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is made
by {@see AxiamClient}.
- AxiamServiceProvider
- Auto-discovered Laravel bridge entry point (D-01): listed under `composer.json`
`extra.laravel.providers`, so a Laravel consumer gets this provider registered
with ZERO manual wiring beyond `composer require axiam/axiam-sdk` (true
zero-config auto-discovery, unlike the Symfony bridge which has no equivalent
mechanism without a published Flex recipe).
- OidcCallbackController
- Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): an invokable
controller that validates the IdP callback, consumes the single-use stored
state, exchanges the authorization code, and redirects (or replies `200 JSON`)
on success. All security-critical logic lives in {@see OidcLoginFlow} — see
{@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
- OidcLoginController
- Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): an invokable
controller that builds the authorization request, parks its
`state`/`nonce`/`code_verifier` in the configured
{@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the browser to the
IdP. All security-critical logic lives in {@see OidcLoginFlow} — this class only
translates its {@see OidcLoginOutcome} into an HTTP response, exactly as
{@see AxiamMiddleware} never duplicates {@see \Axiam\Sdk\AxiamClient}'s own
verification logic.