ilpanich / axiam-php-sdk / 29638216150

89%

Build Type

push

github

Committed by web-flow

Commit Message

feat(tls): add client-certificate mTLS support (CONTRACT §6.1) (#7)

Add optional mutual-TLS client identity to AxiamClient via two new PEM-string
constructor params, clientCert and clientKey, applied to BOTH transports:

- REST: written to short-lived 0600 temp files and set as Guzzle cert/ssl_key
  on both the plain and authz clients, alongside (never replacing) verify —
  server verification is untouched (§6.1.2).
- gRPC: threaded through AuthzDispatcher to AuthzGrpcClient, passed to
  \Grpc\ChannelCredentials::createSsl(rootCerts, privateKey, certChain) behind
  the existing extension_loaded('grpc') guard.

The two params are all-or-nothing and PEM-only (§6.1.1): supplying exactly one,
or a non-PEM value, throws InvalidArgumentException at construction. The private
key is secret material (§7) — held behind Sensitive, never logged/exposed, and
its temp file is chmod 0600 and removed in __destruct. Adds a debugClientCertOptions()
test seam mirroring debugVerifyOption(), a ClientCertificateMtlsTest (runtime-generated
throwaway PKI, nothing committed), README mTLS section, CHANGELOG entry, and updates
the grpc stub's createSsl arity for PHPStan level 6.


Claude-Session: https://claude.ai/code/session_01FM1xTLBaGvfUv8X3bPw6oj

Co-authored-by: Claude <noreply@anthropic.com>

Coverage Stats

43 of 48 new or added lines in 3 files covered. (89.58%)

1 existing line in 1 file now uncovered.

1066 of 1183 relevant lines covered (90.11%)

12.62 hits per line