Symfony
Table of Contents
Classes
- AxiamAccessAttributeListener
- Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an
`EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension
point Symfony's own `#[IsGranted]` attribute is enforced from
(`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
- AxiamAuthSubscriber
- Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to
`kernel.request`, extracts the bearer/cookie token, verifies it via
{@see AxiamClient::verifyLocally()} — the no-fallback seam mandated by §10.1 rule 8
— and populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles`
on success. Short-circuits the request with a standardized 401 JSON error body on any
failure (missing token, invalid signature, expired token). Never duplicates
JWKS-verify logic itself (D-02 prohibition) — every security-critical decision is
made by {@see AxiamClient}.
- AxiamBundle
- The Symfony bundle bootstrap. This class intentionally carries no container
extension of its own — `AxiamAuthSubscriber` (`kernel.event_subscriber`),
`AxiamVoter` (`security.voter`), and `AxiamAccessAttributeListener`
(`kernel.event_subscriber`, CONTRACT.md §11 declarative authorization helpers)
are all wired via the consuming application's OWN `config/services.yaml` (manual
registration, Pitfall 5), exactly like the `config/bundles.php` entry that
registers this bundle itself. Registering this class is what tells Symfony's
kernel the AXIAM SDK bundle is present; it performs no additional auto-wiring
beyond that on its own.
- AxiamVoter
- Symfony authorization voter (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative
decision-maker. This class never caches a decision beyond the token's own TTL and
never implements a client-side deny-override (project RBAC constraint,
CLAUDE.md).
- OidcCallbackController
- Step 2 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_exchange`): validates the
IdP callback, consumes the single-use stored state, exchanges the authorization
code, and redirects (or replies `200 JSON`) on success. See
{@see OidcLoginFlow::complete()} for the full 400/401/503 failure mapping.
- OidcLoginController
- Step 1 of "Login with AXIAM" (CONTRACT.md §12.1 `oidc_begin`): builds the
authorization request, parks its `state`/`nonce`/`code_verifier` in the
configured {@see \Axiam\Sdk\Oidc\OidcStateStoreInterface}, and redirects the
browser to the IdP. All security-critical logic lives in {@see OidcLoginFlow} —
this class only translates its {@see OidcLoginOutcome} into an HTTP response.