How enejkr/certificatedemo works
CertificateDemo is a PHP demo of certificate-based login followed by bearer-token API access. The main flow is client mTLS login, server certificate verification and token issuance, then access-token API calls; expired access tokens are refreshed and saved by the client. README also documents certificate provisioning, JWT signing/verification, HTTPS/mTLS boundary, and rate limiting. The graph follows shown endpoint calls and README-described capabilities; unsampled normal API internals and certificate setup are represented only at their supported directory paths.
Main entry points: login.php mTLS login · refresh.php Refresh endpoint · Client.php HTTPS client · bootstrap.php API bootstrap
Components 18
PHP client
- Client workflow
client/index.php - HTTPS client
client/classes/Client.php - Token cookies
client/functions/token_helper.php
Authentication
- mTLS login
server/api/mtls/v1/login.php - Certificate check
server/classes/Certificate.php - JWT service
server/classes/Jwt.php - Refresh tokens
server/classes/RefreshToken.php
Token API
- Refresh endpoint
server/api/normal/v1/refresh.php - Bearer API
server/api/normal/v1/api.php
Server internals
- Rate limiting
server/classes/RateLimiter.php - MySQL database
server/classes/Database.php - API bootstrap
server/bootstrap.php - Response helpers
server/functions/apiHelper.php - API errors
server/classes/ApiException.php - Server logging
server/Logger.php
Certificate setup
- Certificate provisioning
certs/setup - HTTPS and mTLS
Other components
- Client user
Connections 32
- Client user → Client workflow: starts login
client/index.php - Client workflow → HTTPS client: requests login
client/index.php - Client workflow → Token cookies: saves tokens
client/index.php - Client workflow → HTTPS client: requests API
client/index.php - Client workflow → Token cookies: refreshes tokens
client/index.php - Token cookies → HTTPS client: calls refresh
client/functions/token_helper.php - HTTPS client → mTLS login: posts certificate
- HTTPS client → Refresh endpoint: sends refresh token
- HTTPS client → Bearer API: sends access token
- mTLS login → API bootstrap: loads bootstrap
server/api/mtls/v1/login.php - mTLS login → MySQL database: opens database
server/api/mtls/v1/login.php - mTLS login → Certificate check: verifies certificate
server/api/mtls/v1/login.php - mTLS login → Rate limiting: checks limit
server/api/mtls/v1/login.php - mTLS login → JWT service: creates access token
server/api/mtls/v1/login.php - mTLS login → Refresh tokens: creates refresh token
server/api/mtls/v1/login.php - mTLS login → Response helpers: returns token response
server/api/mtls/v1/login.php - Refresh endpoint → API bootstrap: loads bootstrap
server/api/normal/v1/refresh.php - Refresh endpoint → MySQL database: opens database
server/api/normal/v1/refresh.php - Refresh endpoint → Refresh tokens: verifies token
server/api/normal/v1/refresh.php - Refresh endpoint → Rate limiting: checks limit
server/api/normal/v1/refresh.php - Refresh endpoint → JWT service: creates access token
server/api/normal/v1/refresh.php - Refresh endpoint → Refresh tokens: rotates token
server/api/normal/v1/refresh.php - Refresh endpoint → Response helpers: returns token response
server/api/normal/v1/refresh.php - Bearer API → API bootstrap: loads bootstrap
server/api/normal/v1/api.php - Bearer API → MySQL database: opens database
server/api/normal/v1/api.php - Bearer API → Rate limiting: checks limit
server/api/normal/v1/api.php - API bootstrap → Response helpers: uses responses
server/bootstrap.php - API bootstrap → Server logging: logs failures
server/bootstrap.php - API bootstrap → API errors: handles exceptions
server/bootstrap.php - Certificate provisioning → MySQL database: registers fingerprint
README.md - HTTPS and mTLS → mTLS login: requires mTLS
README.md - HTTPS and mTLS → Bearer API: serves HTTPS
README.md