Search all guides
Documentation / Operator Integration
Authenticate the customer independently
An account identifier supplied by the browser is a claim, not authority.
CustomerAccess
current(session, server) returns an authenticated opaque CustomerIdentity or null. requireMutation enforces current identity, request method, CSRF and operator policy before a mutation adapter runs. A PBX activation token cannot log a customer into number management or emergency registration.
SelectionCatalog
Resolve an opaque cart or subscription selector to an existing, owned, eligible resource. Check current entitlement and attachment policy authoritatively. SelectionContext binds kind, accountId, productId and resourceId; the runtime independently checks the returned account and configured product.
Identity stability
Resource IDs must remain stable across reordering and must not be reused for replacement or unrelated items. Per-item browser names and radio groups prevent accidental form collisions, but server-side ownership checks remain mandatory.
Public customer-access contract
interface CustomerAccess
{
public function current(array $session, array $server): ?CustomerIdentity;
public function requireMutation(
CustomerIdentity $customer, array $session, array $server
): void;
}A denied request must remain denied
Derive identity from trusted authentication
Resolve the opaque account from the current operator session or equivalent verified mechanism, not a posted account ID.
Resolve the owned resource
Map the selector through SelectionCatalog and check current account, product, resource status and eligibility.
Authorise the mutation
Run method, CSRF and policy checks before mutation adapters. Keep fulfilment authority independently protected for non-browser operations.
Propagate failure
Do not swallow an adapter exception and continue checkout. Test that the actual platform rejects the update or fulfilment stage.