| Methods |
public
|
__construct(
string $secret,
string $algorithm = 'sha256',
int<1, max> $ttlSeconds = self::DEFAULT_TTL_SECONDS,
Clock $clock = new SystemClock(),
string $binding = '',
null|(Closure(JsonRpcRequest<non-empty-string>, ReceiveContext): string) $policy = null,
)
Parameters
| $ttlSeconds |
How long a minted state verifies
|
| $binding |
The binding applied when sign() and verify() are given none
|
| $policy |
Derives the binding for a request in bindFor(), the authenticated subject, method and target when null
|
|
#
|
public
static
|
generate(int<1, max> $ttlSeconds = self::DEFAULT_TTL_SECONDS): self
A signing key drawn from the system's random source, for a server that mints no state
beyond the lifetime of its own process.
A signing key drawn from the system's random source, for a server that mints no state
beyond the lifetime of its own process.
|
#
|
public
static
|
deriveBinding(JsonRpcRequest<non-empty-string> $request, ReceiveContext $receiveContext): string
The binding for a request under the default policy: the authenticated subject, the method, the tool
name, prompt name or resource URI it targets, and a digest of its arguments.
The binding for a request under the default policy: the authenticated subject, the method, the tool
name, prompt name or resource URI it targets, and a digest of its arguments.
|
#
|
public
|
sign(string $payload, string $binding = ''): string
Mints a state, bound to $binding when one is given and to this signer's own binding otherwise. Pass whatever identifies the caller entitled to resume: an unbound state is replayable by any caller.
Mints a state, bound to $binding when one is given and to this signer's own binding otherwise. Pass whatever identifies the caller entitled to resume: an unbound state is replayable by any caller.
|
#
|
public
|
verify(string $state, string $binding = ''): ?string
The payload carried by a state, or null when it has expired or its signature does not hold, meaning
this server did not mint it or minted it for a different $binding.
The payload carried by a state, or null when it has expired or its signature does not hold, meaning
this server did not mint it or minted it for a different $binding.
|
#
|
public
|
bindTo(string $binding): self
A signer whose sign() and verify() default to $binding.
A signer whose sign() and verify() default to $binding.
|
#
|
public
|
bindBy(Closure(JsonRpcRequest<non-empty-string>, ReceiveContext): string $policy): self
A signer deriving the binding for a request through $policy instead of the default one.
A signer deriving the binding for a request through $policy instead of the default one.
|
#
|
public
|
bindFor(JsonRpcRequest<non-empty-string> $request, ReceiveContext $receiveContext): self
A signer bound to $request under the policy, so a state it mints resumes that request alone.
A signer bound to $request under the policy, so a state it mints resumes that request alone.
|
#
|