| 1: | <?php |
| 2: | |
| 3: | declare(strict_types=1); |
| 4: | |
| 5: | /** |
| 6: | * This file is part of the Nexus MCP SDK package. |
| 7: | * |
| 8: | * (c) 2026 John Paul E. Balandan, CPA <paulbalandan@gmail.com> |
| 9: | * |
| 10: | * For the full copyright and license information, please view |
| 11: | * the LICENSE file that was distributed with this source code. |
| 12: | */ |
| 13: | |
| 14: | namespace Nexus\Mcp\Core\Auth; |
| 15: | |
| 16: | use Nexus\Assert\Assert; |
| 17: | |
| 18: | /** |
| 19: | * What a validated bearer token grants, as reported by the host's token validator. |
| 20: | * |
| 21: | * @see https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-13#section-5.2 |
| 22: | */ |
| 23: | final readonly class VerifiedAccessToken |
| 24: | { |
| 25: | /** |
| 26: | * PSR-7 request attribute a validated token travels on. |
| 27: | */ |
| 28: | public const string REQUEST_ATTRIBUTE = 'nexus.mcp.access_token'; |
| 29: | |
| 30: | /** |
| 31: | * @param list<string> $audience Resources the token was issued for, at least one of which must be this server |
| 32: | * @param int<1, max> $expiresAt Unix timestamp the token expires at |
| 33: | * @param list<non-empty-string> $scopes Scopes the token was granted |
| 34: | * @param null|non-empty-string $subject Principal the token acts for, absent when it carries no non-empty `sub` claim |
| 35: | * @param null|non-empty-string $clientId OAuth client the token was issued to, absent when it names none |
| 36: | */ |
| 37: | public function __construct( |
| 38: | public array $audience, |
| 39: | public int $expiresAt, |
| 40: | public array $scopes = [], |
| 41: | public ?string $subject = null, |
| 42: | public ?string $clientId = null, |
| 43: | ) { |
| 44: | Assert::that($expiresAt)->isPositiveInt('Verified access token expiry must be a positive Unix timestamp, {value} given.'); |
| 45: | } |
| 46: | } |
| 47: |