ilpanich / axiam-php-sdk / 29513547170

push

github

feat(attributes): add #[RequireAccess]/#[RequireAuth]/#[RequireRole] with Laravel + Symfony enforcement (CONTRACT §11) (#5)

* docs(contract): sync CONTRACT.md §11 declarative authorization helpers

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

* feat(attributes): add #[RequireAccess]/#[RequireAuth]/#[RequireRole] with Laravel + Symfony enforcement (CONTRACT §11)

Adds the CONTRACT.md §11 declarative authorization layer on top of the existing
§10 middleware/subscriber guard: three framework-agnostic PHP 8 attributes
(Axiam\Sdk\Attributes\RequireAuth/RequireAccess/RequireRole) and one shared
enforcement service (Axiam\Sdk\AccessEnforcer) implementing resource resolution,
subject propagation, and the 401/400/403/503 error-mapping table exactly once.

Both framework bridges delegate to it: Axiam\Sdk\Symfony\AxiamAccessAttributeListener
(a kernel.controller listener reflecting the resolved controller for the
attributes) and Axiam\Sdk\Laravel\AxiamAccessMiddleware (the axiam.access route
middleware, supporting both the attribute style and a string-param style).

AxiamClient::checkAccess() (and AuthzDispatcher/AuthzRestClient underneath) gained
an additive, optional subjectId parameter so the shared enforcement service can
check the REQUEST's authenticated user rather than whichever session the calling
AxiamClient instance itself holds (CONTRACT.md §11.2.2) — existing call sites are
unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01C5foj8NVCeS9qUW94kJ13g

---------

Co-authored-by: Claude <noreply@anthropic.com>

216 of 231 new or added lines in 9 files covered. (93.51%)

1026 of 1138 relevant lines covered (90.16%)

12.11 hits per line