ResourceGuard

Guards routes with OAuth bearer token authorization (RFC 6750).

class ResourceGuard implements \Hazaar\Middleware\Interface\Middleware

Implements: Hazaar\Middleware\Interface\Middleware

Extracts the bearer token from the Authorization header, verifies it via the configured Hazaar\OAuth\ResourceServer, and — on success — sets the resolved Hazaar\OAuth\AccessTokenClaims as the oauth request attribute (readable from a controller via $this->request->getAttribute('oauth')) before continuing.

On failure it returns the response directly rather than continuing the chain:

• 401 Unauthorized with a WWW-Authenticate: Bearer ... challenge when the token is missing, malformed, expired, or otherwise invalid.
• 403 Forbidden with WWW-Authenticate: Bearer error="insufficient_scope", ... when the token is valid but lacks a required scope.

This is constructed directly, not registered by alias, since it needs a Hazaar\OAuth\ResourceServer instance:

Router::post('/mcp', [Tools::class, 'handle'])
    ->middleware(new ResourceGuard($resourceServer, ['mcp']));

Properties

resourceServer

private ResourceServer $resourceServer

Type: Hazaar\OAuth\ResourceServer

requiredScope

private array $requiredScope

Type: array

Methods

__construct

public __construct(ResourceServer $resourceServer, array $requiredScope): void

Parameters

Parameter	Type	Description
$resourceServer	Hazaar\OAuth\ResourceServer
$requiredScope	array	scopes every request through this guard must carry

handle

public handle(Request $request, callable $next, mixed $args): Response

Returns: Hazaar\Controller\Response

Parameters

Parameter	Type	Description
$request	Hazaar\Application\Request
$next	callable
$args	mixed

extractBearerToken

private extractBearerToken(Request $request): ?string

Returns: string

Parameters

Parameter	Type	Description
$request	Hazaar\Application\Request

challenge

private challenge(int $status, string $error, string $description, array $scope): Response

Returns: Hazaar\Controller\Response

Parameters

Parameter	Type	Description
$status	int
$error	string
$description	string
$scope	array

---

Generated by Hazaar API Doc Generator on Sun, 23 Aug 2026 10:49:43 +0000