Laravel
Table of Contents
Classes
- AxiamAccessMiddleware
- Laravel CONTRACT.md §11 declarative-authorization enforcement middleware, registered
under the `axiam.access` alias (D-02). Supports BOTH developer-experience styles the
plan calls for, from the SAME class, delegating every actual decision to the shared
{@see AccessEnforcer} (never re-implementing resource resolution, subject
propagation, or the error-mapping table itself):
- AxiamGate
- Laravel authorization gate (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker.
- AxiamMiddleware
- Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie
token, verifies it via {@see AxiamClient::verifyLocallyOrFallback()} — local JWKS
verification first, falling back to the shared single-flight refresh (§9, D-06) — and
populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on
success. Returns a standardized 401 JSON error body on any failure (missing token,
invalid signature, expired-and-unrefreshable token). Never duplicates JWKS-verify or
refresh logic itself (D-02 prohibition) — every security-critical decision is made by
{@see AxiamClient}.
- AxiamServiceProvider
- Auto-discovered Laravel bridge entry point (D-01): listed under `composer.json`
`extra.laravel.providers`, so a Laravel consumer gets this provider registered
with ZERO manual wiring beyond `composer require axiam/axiam-sdk` (true
zero-config auto-discovery, unlike the Symfony bridge which has no equivalent
mechanism without a published Flex recipe).