Rest
Table of Contents
Classes
- AuthMiddleware
- `HandlerStack` middleware: injects `Authorization` (current access token) and
`X-Tenant-ID` on EVERY outgoing request, and `X-CSRF-Token` (captured from a prior
response, {@see Session::csrfToken()}) on state-changing requests
(CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
- AuthzRestClient
- REST authorization transport (FND-04, CONTRACT.md §1): `checkAccess()`/`can()`/
`batchCheck()` over `POST /api/v1/authz/check[/batch]` — the ALWAYS-available authz
path (D-03). Reuses the caller-supplied Guzzle client (the same instance
{@see \Axiam\Sdk\Session} wires with {@see AuthMiddleware}/{@see RefreshMiddleware} on
its `HandlerStack`), so `Authorization`/`X-Tenant-ID`/`X-CSRF-Token` header injection
and the single-flight refresh-on-401 behavior (D-06) apply to authz calls exactly as
they do to every other REST call — this class never re-implements any of that.
- RefreshMiddleware
- `HandlerStack` middleware: on a `401` response, triggers the session's single-flight
refresh (CONTRACT.md §9, D-06, SC#2) and retries the ORIGINAL request exactly once
via the inner `$handler` — never a loop. All concurrent 401-triggering requests on
one {@see Session} share the SAME refresh `PromiseInterface`
({@see Session::refreshIfNeeded()}), so N concurrent expired-token requests still
result in exactly one `/api/v1/auth/refresh` call.