Application
Table of Contents
Classes
- AccessEnforcer
- The single CONTRACT.md §11 ("Declarative Authorization Helpers") enforcement
implementation, shared by BOTH framework bridges
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener} and
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) so the `#[RequireAuth]` /
`#[RequireAccess]` / `#[RequireRole]` semantics can never drift between the two
integrations. Neither bridge re-implements resource resolution, subject propagation,
or the error-mapping table below — both call into this class exclusively.
- AmqpDropMessage
- Poison-message sentinel. Application handlers throw this to signal that a
message is unprocessable and must NOT be requeued (e.g. a permanently
malformed or unsupported event) — distinct from a transient failure, which
should be requeued for retry.
- Consumer
- php-amqplib blocking consume loop with HMAC verify-before-handler
(CONTRACT.md §8, D-04).
- Hmac
- HMAC-SHA256 verify-before-handler primitive for inbound AMQP messages
(CONTRACT.md §8).
- ReplayGuard
- NEW-4 (CONTRACT.md §8 "v2 — Replay Protection", hard cutover) validation
gates, checked ONLY AFTER a delivery's HMAC signature has already
verified (see Hmac::verify / Consumer::verifyAndDispatch).
- RequireAccess
- Declarative per-endpoint authorization requirement (CONTRACT.md §11, canonical
`require_access(action, resource[, scope])`). Placing this attribute on a controller
method or class does not itself perform any check — it is metadata read by the
framework-specific enforcement listener
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which resolves the target resource
and delegates the actual authorization decision to
{@see \Axiam\Sdk\AccessEnforcer::enforceAccess()}.
- RequireAuth
- Declarative "endpoint requires an authenticated AXIAM identity" marker (CONTRACT.md
§11, canonical `require_auth`). Pure sugar over the CONTRACT.md §10 authentication
guard for frameworks (Laravel, Symfony) where that guard is applied per-route rather
than globally: placing this attribute on a controller method or class does not itself
perform any verification — it is read by the framework-specific enforcement listener
({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}) which delegates the actual check to
{@see \Axiam\Sdk\AccessEnforcer::enforceAuth()}.
- RequireRole
- Declarative local role check (CONTRACT.md §11, canonical `require_role(role...)`,
MAY-level helper). Placing this attribute on a controller method or class does not
itself perform any check — it is metadata read by the framework-specific enforcement
listener ({@see \Axiam\Sdk\Symfony\AxiamAccessAttributeListener},
{@see \Axiam\Sdk\Laravel\AxiamAccessMiddleware}), which delegates to
{@see \Axiam\Sdk\AccessEnforcer::enforceRole()}.
- JwksVerifier
- Local EdDSA/Ed25519 JWKS verification (CONTRACT.md D-08).
- LoginResult
- Result of `AxiamClient::login()` (CONTRACT.md §1, D-09).
- RefreshGuard
- Shared-promise clear-on-both-paths helper (CONTRACT.md §9, D-06).
- UserInfo
- Result of `AxiamClient::getUserInfo()` (CONTRACT.md §1.1, contract 1.3).
- AuthzDispatcher
- Transparent REST/gRPC authz transport selection (CONTRACT.md §1, D-03, SC#3).
- AxiamClient
- The AXIAM PHP SDK's public REST entry point (CONTRACT.md §1–§9, SC#1).
- AuthError
- Authentication failure: wrong credentials, expired session, MFA failure, or a 401
on refresh (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so REST and
gRPC transports cannot drift on the error taxonomy.
- AuthzError
- Authorization failure: the caller is authenticated but lacks permission for the
requested operation (CONTRACT.md §2). Always constructed via {@see ErrorMapper} so
REST and gRPC transports cannot drift on the error taxonomy.
- AxiamException
- Base exception for all AXIAM SDK errors (CONTRACT.md §2, D-10).
- ErrorMapper
- Central status→error mapper (CONTRACT.md §2, D-10). {@see self::fromStatus()} is the
single translation point from an HTTP status code to a typed {@see AxiamException}
subtype — no other class in the SDK is permitted to hand-roll this branching:
401 → {@see AuthError}; 403/409 → {@see AuthzError}; everything else
(400/408/429/5xx/transport) → {@see NetworkError}.
- NetworkError
- Transport-level failure: connection refused, timeout, TLS error, DNS failure, or a
server-side 5xx (CONTRACT.md §2).
- Sensitive
- Wraps a token-carrying value so it can never be accidentally exposed via
`__toString()`, `var_export()`/`print_r()`, or JSON serialization
(CONTRACT.md §7, D-11).
- AuthzGrpcClient
- gRPC authorization transport (CONTRACT.md §1/§6/§9, D-03/D-06/D-12).
- UserInfoGrpcClient
- gRPC userinfo transport (CONTRACT.md §1.1/§5/§6/§9, contract 1.3) — the low-latency
gRPC counterpart of the server's REST `GET /oauth2/userinfo` endpoint. This is the
hand-written service-client sibling of {@see AuthzGrpcClient}: it mirrors that class's
channel/metadata/status-mapping machinery exactly, differing only in the single RPC it
exposes (`GetUserInfo` instead of `CheckAccess`/`BatchCheckAccess`).
- AxiamAccessMiddleware
- Laravel CONTRACT.md §11 declarative-authorization enforcement middleware, registered
under the `axiam.access` alias (D-02). Supports BOTH developer-experience styles the
plan calls for, from the SAME class, delegating every actual decision to the shared
{@see AccessEnforcer} (never re-implementing resource resolution, subject
propagation, or the error-mapping table itself):
- AxiamGate
- Laravel authorization gate (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative decision-maker.
- AxiamMiddleware
- Laravel authentication middleware (D-02, CONTRACT.md §10): extracts the bearer/cookie
token, verifies it via {@see AxiamClient::verifyLocallyOrFallback()} — local JWKS
verification first, falling back to the shared single-flight refresh (§9, D-06) — and
populates the `axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on
success. Returns a standardized 401 JSON error body on any failure (missing token,
invalid signature, expired-and-unrefreshable token). Never duplicates JWKS-verify or
refresh logic itself (D-02 prohibition) — every security-critical decision is made by
{@see AxiamClient}.
- AxiamServiceProvider
- Auto-discovered Laravel bridge entry point (D-01): listed under `composer.json`
`extra.laravel.providers`, so a Laravel consumer gets this provider registered
with ZERO manual wiring beyond `composer require axiam/axiam-sdk` (true
zero-config auto-discovery, unlike the Symfony bridge which has no equivalent
mechanism without a published Flex recipe).
- AuthMiddleware
- `HandlerStack` middleware: injects `Authorization` (current access token) and
`X-Tenant-ID` on EVERY outgoing request, and `X-CSRF-Token` (captured from a prior
response, {@see Session::csrfToken()}) on state-changing requests
(CONTRACT.md §3 non-browser CSRF, §5 tenant context contract).
- AuthzRestClient
- REST authorization transport (FND-04, CONTRACT.md §1): `checkAccess()`/`can()`/
`batchCheck()` over `POST /api/v1/authz/check[/batch]` — the ALWAYS-available authz
path (D-03). Reuses the caller-supplied Guzzle client (the same instance
{@see \Axiam\Sdk\Session} wires with {@see AuthMiddleware}/{@see RefreshMiddleware} on
its `HandlerStack`), so `Authorization`/`X-Tenant-ID`/`X-CSRF-Token` header injection
and the single-flight refresh-on-401 behavior (D-06) apply to authz calls exactly as
they do to every other REST call — this class never re-implements any of that.
- RefreshMiddleware
- `HandlerStack` middleware: on a `401` response, triggers the session's single-flight
refresh (CONTRACT.md §9, D-06, SC#2) and retries the ORIGINAL request exactly once
via the inner `$handler` — never a loop. All concurrent 401-triggering requests on
one {@see Session} share the SAME refresh `PromiseInterface`
({@see Session::refreshIfNeeded()}), so N concurrent expired-token requests still
result in exactly one `/api/v1/auth/refresh` call.
- Session
- Per-`AxiamClient` session state (CONTRACT.md §3/§4/§5/§9): owns the shared Guzzle
`CookieJar` (§4), captures/exposes the non-browser CSRF token (§3), and is the
single-flight home for the shared refresh `Promise` (§9, D-06).
- AxiamAccessAttributeListener
- Symfony CONTRACT.md §11 declarative-authorization enforcement listener: an
`EventSubscriberInterface` on `KernelEvents::CONTROLLER` — the SAME extension
point Symfony's own `#[IsGranted]` attribute is enforced from
(`Symfony\Component\Security\Http\EventListener\IsGrantedAttributeListener`).
- AxiamAuthSubscriber
- Symfony authentication subscriber (D-02, CONTRACT.md §10): listens to
`kernel.request`, extracts the bearer/cookie token, verifies it via
{@see AxiamClient::verifyLocallyOrFallback()} — local JWKS verification first,
falling back to the shared single-flight refresh (§9, D-06) — and populates the
`axiam_user` request attribute with `user_id`/`tenant_id`/`roles` on success.
- AxiamBundle
- The Symfony bundle bootstrap. This class intentionally carries no container
extension of its own — `AxiamAuthSubscriber` (`kernel.event_subscriber`),
`AxiamVoter` (`security.voter`), and `AxiamAccessAttributeListener`
(`kernel.event_subscriber`, CONTRACT.md §11 declarative authorization helpers)
are all wired via the consuming application's OWN `config/services.yaml` (manual
registration, Pitfall 5), exactly like the `config/bundles.php` entry that
registers this bundle itself. Registering this class is what tells Symfony's
kernel the AXIAM SDK bundle is present; it performs no additional auto-wiring
beyond that on its own.
- AxiamVoter
- Symfony authorization voter (D-02, CONTRACT.md §1/§10): a one-line delegation to
{@see AxiamClient::can()} — the server's additive-only RBAC engine (allow-wins,
default-deny, no explicit deny-override) is ALWAYS the authoritative
decision-maker. This class never caches a decision beyond the token's own TTL and
never implements a client-side deny-override (project RBAC constraint,
CLAUDE.md).