RequirePermissionMiddleware
The PSR-15 gate that authorizes a request against a single required {@see Permission}, beside — never replacing — {@see RequireScopeMiddleware}. Fail-closed and symmetric with the scope gate: no context → 401, not authenticated → 401, permission not held → 403 {@see PermissionDeniedException}. When a {@see PermissionResolver} is injected and no set is attached yet, it resolves once (with the optional {@see PermissionContextFactory}, else {@see PermissionContext::none()}) and re-attaches the context so the handler/report sees it. Resolution precedence: attached set > injected resolver > flat-scope fallback (see {@see AuthContext::can()}).
RequirePermissionMiddleware::__construct()
public function __construct(Milpa\Auth\Permission $required, ?Milpa\Auth\Contracts\PermissionResolver $resolver = null, ?Milpa\Auth\Contracts\PermissionContextFactory $contextFactory = null):Parameters
| Name | Type | Description |
|---|---|---|
| $required | Milpa\Auth\Permission | |
| $resolver | ?Milpa\Auth\Contracts\PermissionResolver | |
| $contextFactory | ?Milpa\Auth\Contracts\PermissionContextFactory |
RequirePermissionMiddleware::process()
public function process(Psr\Http\Message\ServerRequestInterface $request, Psr\Http\Server\RequestHandlerInterface $handler): Psr\Http\Message\ResponseInterfaceAuthorizes the request against the attached {@see AuthContext}, resolving permissions once via the injected {@see PermissionResolver} when none are attached yet, or throws a typed, learnable denial ({@see AuthContextMissingException} for 401, {@see PermissionDeniedException} for 403).
Parameters
| Name | Type | Description |
|---|---|---|
| $request | Psr\Http\Message\ServerRequestInterface | |
| $handler | Psr\Http\Server\RequestHandlerInterface |