README

A small bridge library on top of the Slim Framework, providing a common set of building blocks (actions, JWT-based authorization, CORS handling and error/shutdown handlers) shared across ACAT PHP services.

Requirements

PHP >= 8.4
slim/slim ^4.14
slim/psr7 ^1.7
acat/jwt for token decoding/authorization

Installation

composer require acat/acat-slim

What's included

ACAT\Slim\Actions — Action / AbstractAction base classes for Slim route handlers, plus ActionPayload / ActionError for a consistent JSON response envelope ({"statusCode": ..., "data": ...} or {"statusCode": ..., "error": ...}).
ACAT\Slim\Middleware\Authorize — PSR-15 middleware that validates a bearer JWT (from the Authorization header or a cookie) against an allowed issuer/client/role and either injects the decoded token via a TokenInjectorInterface or attaches it as a request attribute.
ACAT\Slim\Middleware\CORS — PSR-15 middleware that checks the Origin header against an allowlist, rejects disallowed origins with 403 in strict mode, and answers OPTIONS preflight requests.
ACAT\Slim\Handlers\HttpErrorHandler / ShutdownHandler — Slim error/shutdown handlers that log unexpected errors and turn them into a JSON error response instead of leaking a raw PHP error to the client.
ACAT\Slim\ResponseEmitter\ResponseEmitter — thin wrapper around Slim's response emitter that adds cache-control headers and clears stray output buffers before emitting the response.
ACAT\Slim\Exception\AuthorizeException / RecordNotFoundException — exceptions used by the middleware/actions above to signal authorization failures and missing records.

CORS headers are only ever set by the CORS middleware, which checks the configured allowlist — ResponseEmitter intentionally does not add any Access-Control-* headers itself.

Testing

composer install
bin/phpunit

License

MIT, see LICENSE.

acat / acat-slim

Maintainers

Package info

Statistics

Security