Symfony
Table of Contents
Classes
- AxiamAccessAttributeListener
- Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an
`EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension
point Symfony's own `#[IsGranted]` attribute is enforced from
(`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
- AxiamAuthSubscriber
- Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to
`kernel.request`, extracts the bearer/cookie token, verifies it via
{@see AxiamClient::verifyLocallyOrFallback()} — local JWKS verification first,
falling back to the shared single-flight refresh (§9, D-06) — and populates the
`axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on success.
- AxiamBundle
- The Symfony bundle bootstrap. This class intentionally carries no container
extension of its own — `AxiamAuthSubscriber` (`kernel.event_subscriber`),
`AxiamVoter` (`security.voter`), and `AxiamAccessAttributeListener`
(`kernel.event_subscriber`, CONTRACT.md §11 declarative authorization helpers)
are all wired via the consuming application's OWN `config/services.yaml` (manual
registration, Pitfall 5), exactly like the `config/bundles.php` entry that
registers this bundle itself. Registering this class is what tells Symfony's
kernel the AXIAM SDK bundle is present; it performs no additional auto-wiring
beyond that on its own.
- AxiamVoter
- Symfony authorization voter (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative
decision-maker. This class never caches a decision beyond the token's own TTL and
never implements a client-side deny-override (project RBAC constraint,
CLAUDE.md).