polaris / psr15

v0.1.0 2026-09-10 08:10 UTC

Requires

• php: >=8.3
• polaris/core: ^0.1
• psr/clock: ^1.0
• psr/http-factory: ^1.0
• psr/http-message: ^1.1 || ^2.0
• psr/http-server-handler: ^1.0
• psr/http-server-middleware: ^1.0

MIT

Published on Packagist.org on 2026-09-10 18:23 UTC

README

The PSR-15 face of Polaris for PHP: a router over the endpoint manifest, the ordered middleware stack (client context, rate limits, bearer and MFA-ticket authentication, step-up, denylist, authorization) and the request handler that runs the endpoints. It works with any PSR-15 host: Slim, Mezzio, or a framework through its PSR-7 bridge.

Install

composer require polaris/psr15

This brings polaris/core; you also need a PSR-17 response factory (nyholm/psr7, laminas/laminas-diactoros, slim/psr7, ...).

Use

use Polaris\Psr15\Pipeline;

$pipeline = new Pipeline($polaris->graph(), $responseFactory, pathPrefix: '/');

$pipeline->middleware();      // list<MiddlewareInterface>, in execution order
$pipeline->handler();         // RequestHandlerInterface serving every route of the manifest
$pipeline->handle($request);  // or run the whole stack yourself

On Slim, for instance (the full demo is examples/slim):

foreach (array_reverse($pipeline->middleware()) as $middleware) {   // Slim runs the last-added first
    $app->add($middleware);
}
$app->any('/{path:.*}', fn($request) => $pipeline->handler()->handle($request));

The middleware reads each route's policy (auth, rate_limit, step_up, required permissions) from the manifest, so nothing is configured per route. Your own middleware can read the request attributes named in Polaris\Http\Attributes: TOKEN (the verified token), IP_ADDRESS, USER_AGENT.

License

MIT. Polaris for PHP is created and maintained by 2am.tech.