PolicyGate final readonly class

Minn\Rest\PolicyGate · public/minn/src/Minn/Rest/PolicyGate.php · 167 lines

Judges a route's policy against the caller, with the reference's refusals: a caller who is not signed in gets the policy's sign-in code at 401, a bad nonce is always 403 rest_cookie_invalid_nonce, and a signed-in caller who lacks a capability gets the refusal code at 403. A subject the policy names is looked up first and answers its 404 before any of those. The edit-context policy is judged as well when the request asks for it.

Uses 13

Auth\TypeCapabilities Http\Access Http\Policy Http\Request Http\RouteMiss RestError Caller Context RuntimeRoutes Subjects TermObject TermsController Types

Used by 1

Api

Constants and properties

private	`readonly Minn\Rest\Caller $caller`	Promoted from the constructor.
private	`readonly Minn\Rest\Subjects $subjects`	Promoted from the constructor.
private	`readonly Minn\Rest\Types $types`	Promoted from the constructor.

Public

new __construct(Minn\Rest\Caller $caller, Minn\Rest\Subjects $subjects, Minn\Rest\Types $types)#

method

closure(): Closure#

The judge as the router takes it.

method

judge(Minn\Http\Policy $policy, Minn\Http\Request $request, array $captures): void#

Throws the refusal the policy names, or returns.

$captures array<string, string>

Internals 6

Private and protected methods: how the class does its work. Not a contract; they change whenever the code is tidied.

private

subject(Minn\Http\Policy $policy, array $captures): void#

The record's 404 when it does not exist. "me" names the caller, who must then be signed in; the reference answers that with its plain sign-in refusal whatever the route's own code is.

$captures array<string, string>

private

type(Minn\Http\Policy $policy, array $captures): void#

A {base} that names no declared type declines the route, so the next one may take it. A write is judged with the type's own capabilities (probe rest-plugin-caps): a missing post first (404), then the caller (401 signed out, 403 refused).

$captures array<string, string>

private

taxonomy(Minn\Http\Policy $policy, array $captures): void#

A {base} that names no registered taxonomy declines the route. A write is judged with the taxonomy's own capabilities (probe rest-plugin-caps): a missing term first (404), then the caller.

$captures array<string, string>

private

opened(array $opener, Minn\Http\Request $request): bool#

Whether a policy's opener lets any caller through: the filter it names, handed false, the request, and a controller of the class the reference passes (built with the argument given).

$opener array{0: string, 1: class-string, 2?: string}

private capabilities(Minn\Http\Policy $policy): void#

private

own(Minn\Http\Policy $policy, array $captures): void#

$captures array<string, string>