winglet/authclient

Client package for the Winglet Auth microservice.

v0.5.1 2026-07-05 18:57 UTC

Requires

• php: >=8.1
• ext-curl: *
• winglet/client: ^0.6

Requires (Dev)

• phpstan/phpstan: ^2.2
• phpunit/phpunit: ^10.5 || ^11.0

proprietary

Published on Packagist.org on 2026-07-05 18:59 UTC

README

Packagist client package for the Winglet Auth microservice.

The package is intentionally light: request/response payloads are arrays so the client remains compatible with older PHP application code while still covering the current Auth API surface.

Install

composer require winglet/authclient

Usage

AuthClient is intentionally built on top of winglet/client. Authentication is configured once in the shared client layer, and AuthClient only contains Auth domain endpoint methods.

use Winglet\AuthClient\AuthClient;

$auth = AuthClient::fromConfig([
    'base_url' => 'http://auth-service',
    'auth' => [
        'mode' => 'service_token',
        'token_url' => 'http://identity-service/auth/service-token',
        'client_id' => 'my-service',
        'client_secret' => '...',
    ],
]);

$effective = $auth->getEffectiveAuthorization(identityId: 123, tenantId: null);
$selfEffective = $auth->getSelfEffectiveAuthorization();
$check = $auth->checkAuthorization(123, 'templify.admin');

AuthClient::fromConfig() uses winglet/client internally. Service-token fetching, token caching and Authorization: Bearer ... headers are handled by the shared Winglet client layer. AuthClient does not implement a separate bearer-token or cURL authentication path.

For tests or advanced bootstrapping, an already configured Winglet\Client\Core\Http\ServiceClient can be injected with AuthClient::fromServiceClient().

Included endpoints

Authorization

• getEffectiveAuthorization(int $identityId, ?int $tenantId = null) → GET /authorization/effective
• getSelfEffectiveAuthorization() → GET /self/authorization/effective
• checkAuthorization(int $identityId, string $permissionCode, ?int $tenantId = null) → POST /authorization/check
• getGlobalAuthorizationRevision(int $identityId) → GET /authorization/revisions/global/{identityId}
• getTenantAuthorizationRevision(int $identityId, int $tenantId) → GET /authorization/revisions/tenant/{identityId}/{tenantId}

Roles

• listRoles(?string $scope = null, ?bool $includeDeprecated = null)
• createRole(array $data)
• getRole(int $id)
• updateRole(int $id, array $data)
• deleteRole(int $id)
• addPermissionToRole(int $roleId, int $permissionId)
• removePermissionFromRole(int $roleId, int $permissionId)

Permissions

• listPermissions(?string $scope = null, ?bool $includeDeprecated = null)
• createPermission(array $data)
• getPermission(int $id)
• updatePermission(int $id, array $data)
• deletePermission(int $id)

Global assignments and grants

• listGlobalRoleAssignments(?int $identityId = null, ?int $roleId = null, ?string $status = null)
• createGlobalRoleAssignment(array $data)
• getGlobalRoleAssignment(int $id)
• updateGlobalRoleAssignment(int $id, array $data)
• revokeGlobalRoleAssignment(int $id, ?string $reason = null)
• listGlobalPermissionGrants(?int $identityId = null, ?int $permissionId = null, ?string $status = null)
• createGlobalPermissionGrant(array $data)
• getGlobalPermissionGrant(int $id)
• updateGlobalPermissionGrant(int $id, array $data)
• revokeGlobalPermissionGrant(int $id, ?string $reason = null)

Tenants and tenant-scoped assignments

• listTenants(?string $code = null)
• getTenant(int $id)
• upsertTenant(int $id, array $data)
• listTenantMemberships(?int $identityId = null, ?int $tenantId = null, ?string $status = null)
• createTenantMembership(array $data)
• getTenantMembership(int $id)
• updateTenantMembership(int $id, array $data)
• revokeTenantMembership(int $id, ?string $reason = null)
• listTenantRoleAssignments(?int $tenantMembershipId = null, ?int $roleId = null, ?string $status = null)
• createTenantRoleAssignment(array $data)
• getTenantRoleAssignment(int $id)
• updateTenantRoleAssignment(int $id, array $data)
• revokeTenantRoleAssignment(int $id, ?string $reason = null)
• listTenantPermissionGrants(?int $tenantMembershipId = null, ?int $permissionId = null, ?string $status = null)
• createTenantPermissionGrant(array $data)
• getTenantPermissionGrant(int $id)
• updateTenantPermissionGrant(int $id, array $data)
• revokeTenantPermissionGrant(int $id, ?string $reason = null)

Bootstrap

• initializeBootstrap(int $rootIdentityId, ?string $reason = null)

Tests

composer install
composer test

The test suite uses a fake transport and does not require a running Auth service.

Payload examples

$auth->createPermission([
    'code' => 'templify.admin',
    'name' => 'Templify admin',
    'scope' => 'global',
]);

$auth->createRole([
    'code' => 'admin',
    'name' => 'Administrator',
    'scope' => 'global',
    'permissionIds' => [1, 2, 3],
]);

$auth->createGlobalRoleAssignment([
    'identityId' => 123,
    'roleId' => 1,
    'status' => 'active',
]);