# Method to extract an access token from a request.
def extract_access_token(request)
  # The value of Authorization header.
  header = request.env["HTTP_AUTHORIZATION"]

  # If the value is in the format of 'Bearer access-token'.
  if /^Bearer[ ]+(.+)/i =~ header
    # Return the value extracted from Authorization header.
    return $1
  end

  # Return the value of 'access_token' request parameter.
  return request["access_token"]
end

# Entry point for GET method.
get '/hello' do
  # Extract an access token from the request.
  access_token = extract_access_token(request)
end

# Entry point for POST method.
post '/hello' do
  # Extract an access token from the request.
  access_token = extract_access_token(request)
end

/**
 * Function to extract an access token from a request.
 */
function extract_access_token()
{
    // The value of Authorization header.
    $header = $_SERVER['HTTP_AUTHORIZATION'];

    // If the value is in the format of 'Bearer access-token'.
    if ($header != null && preg_match('/^Bearer[ ]+(.+)/i', $header, $captured))
    {
        // Return the value extracted from Authorization header.
        return $captured;
    }

    if ($_SERVER['REQUEST_METHOD'] == 'GET')
    {
        // Return the value of 'access_token' query parameter.
        return $_GET['access_token'];
    }
    else
    {
        // Return the value of 'access_token' form parameter.
        return $_POST['access_token'];
    }
}

#--------------------------------------------------
# Call Authlete's /api/auth/introspection API.
# A response from the API is returned when the
# access token is valid. Otherwise, a WebException
# is raised.
#--------------------------------------------------
def do_introspection(token, scopes, subject)
  # Call Authlete's /api/auth/introspection API.
  response = call_introspection_api(token, scopes, subject)

  # The value of 'WWW-Authenticate' header on error.
  content = response["responseContent"]

  # "action" denotes the next action.
  case response["action"]
  when "INTERNAL_SERVER_ERROR"
    # 500 Internal Server Error
    #   The API request from this implementation was wrong
    #   or an error occurred in Authlete.
    raise WebResponse.new(500).wwwAuthenticate(content).to_exception

  when "BAD_REQUEST"
    # 400 Bad Request
    #   The request from the client application does not
    #   contain an access token.
    raise WebResponse.new(400).wwwAuthenticate(content).to_exception

  when "UNAUTHORIZED"
    # 401 Unauthorized
    #   The presented access token does not exist or has expired.
    raise WebResponse.new(401).wwwAuthenticate(content).to_exception

  when "FORBIDDEN"
    # 403 Forbidden
    #   The access token does not cover the required scopes
    #   or the subject associated with the access token is
    #   different.
    raise WebResponse.new(403).wwwAuthenticate(content).to_exception

  when "OK"
    # The access token is valid (= exists and has not expired).
    return response

  else
    # This never happens.
    raise WebResponse.new(500, "Unknown action").plain.to_exception
  end
end

/**
 * Call Authlete's /api/auth/introspection API.
 * A response from the API is returned when the
 * access token is valid. Otherwise, a WebException
 * is raised.
 */
function do_introspection($token, $scopes, $subject)
{
    // Call Authlete's /api/auth/introspection API.
    $response = call_introspection_api($token, $scopes, $subject);

    // he value of 'WWW-Authenticate' header on error.
    $content = $response['responseContent'];

    // "action" denotes the next action.
    switch ($response['action'])
    {
        case 'INTERNAL_SERVER_ERROR':
            // 500 Internal Server Error
            //   The API request from this implementation was wrong
            //   or an error occurred in Authlete.
            (new WebResponse(500))->wwwAuthenticate($content)->finish();
            return null; // Not reach here.

        case 'BAD_REQUEST':
            // 400 Bad Request
            //   The request from the client application does not
            //   contain an access token.
            (new WebResponse(400))->wwwAuthenticate($content)->finish();
            return null; // Not reach here.

        case 'UNAUTHORIZED':
            // 401 Unauthorized
            //   The presented access token does not exist or has expired.
            (new WebResponse(401))->wwwAuthenticate($content)->finish();
            return null; // Not reach here.

        case 'FORBIDDEN':
            // 403 Forbidden
            //   The access token does not cover the required scopes
            //   or the subject associated with the access token is
            //   different.
            (new WebResponse(403))->wwwAuthenticate($content)->finish();
            return null; // Not reach here.

        case 'OK':
            // The access token is valid (= exists and has not expired).
            return $response;

        default:
            // This never happens.
            (new WebResponse(500, "Unknown action"))->plain()->finish();
            return null; // Not reach here.
    }
}

get '/hello' do
  # Extract an access token from the request.
  token = extract_access_token(request)

  begin
    # Introspect and validate the access token.
    response = do_introspection(token, ["read", "write"], nil)
  rescue WebException => e
    # The access token is invalid.
    return e.to_response
  end

  # The access token is valid. Write the main code after here.
  ......
end

<?php
require('../include/introspection-functions.php');

// Extract an access token from the request.
$token = extract_access_token();

// Introspect and validate the access token.
$response = do_introspection($token, ['read', 'write'], null);

// The access token is valid. Write the main code after here.
......
?>