V4 skip authorization

composer.json

@@ -32,7 +32,8 @@
     },
     "require-dev": {
         "cakephp/cakephp-codesniffer": "^4.0",
-        "phpunit/phpunit": "^8.0"
+        "phpunit/phpunit": "^8.0",
+        "cakephp/authorization": "^2.0"
     },
     "autoload": {
         "psr-4": {

src/Controller/ComposerController.php

@@ -15,10 +15,6 @@
  */
 namespace DebugKit\Controller;
 
-use Cake\Controller\Controller;
-use Cake\Core\Configure;
-use Cake\Event\EventInterface;
-use Cake\Http\Exception\NotFoundException;
 use Cake\View\JsonView;
 use Composer\Console\Application;
 use Symfony\Component\Console\Input\ArrayInput;
@@ -27,7 +23,7 @@
 /**
  * Provides utility features need by the toolbar.
  */
-class ComposerController extends Controller
+class ComposerController extends DebugKitController
 {
     /**
      * {@inheritDoc}
@@ -39,20 +35,6 @@ public function initialize(): void
         $this->viewBuilder()->setClassName(JsonView::class);
     }
 
-    /**
-     * Before filter handler.
-     *
-     * @param \Cake\Event\EventInterface $event The event.
-     * @return void
-     * @throws \Cake\Http\Exception\NotFoundException
-     */
-    public function beforeFilter(EventInterface $event)
-    {
-        if (!Configure::read('debug')) {
-            throw new NotFoundException();
-        }
-    }
-
     /**
      * Check outdated composer dependencies
      *

src/Controller/DashboardController.php

@@ -14,17 +14,14 @@
  */
 namespace DebugKit\Controller;
 
-use Cake\Controller\Controller;
-use Cake\Core\Configure;
 use Cake\Event\EventInterface;
-use Cake\Http\Exception\NotFoundException;
 
 /**
  * Dashboard and common DebugKit backend.
  *
  * @property \DebugKit\Model\Table\RequestsTable $Requests
  */
-class DashboardController extends Controller
+class DashboardController extends DebugKitController
 {
     /**
      * Before filter handler.
@@ -35,10 +32,7 @@ class DashboardController extends Controller
      */
     public function beforeFilter(EventInterface $event)
     {
-        // TODO add config override.
-        if (!Configure::read('debug')) {
-            throw new NotFoundException('Not available without debug mode on.');
-        }
+        parent::beforeFilter($event);
 
         $this->viewBuilder()->setLayout('dashboard');
     }

src/Controller/DebugKitController.php

@@ -0,0 +1,47 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
+ * Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
+ *
+ * Licensed under The MIT License
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
+ * @link          http://cakephp.org CakePHP(tm) Project
+ * @license       http://www.opensource.org/licenses/mit-license.php MIT License
+ */
+namespace DebugKit\Controller;
+
+use Cake\Controller\Controller;
+use Cake\Core\Configure;
+use Cake\Event\EventInterface;
+use Cake\Http\Exception\NotFoundException;
+
+/**
+ * DebugKit Controller.
+ */
+class DebugKitController extends Controller
+{
+    /**
+     * Before filter handler.
+     *
+     * @param \Cake\Event\EventInterface $event The event.
+     * @return void
+     * @throws \Cake\Http\Exception\NotFoundException
+     */
+    public function beforeFilter(EventInterface $event)
+    {
+        // TODO add config override.
+        if (!Configure::read('debug')) {
+            throw new NotFoundException('Not available without debug mode on.');
+        }
+
+        // Skip authorization for DebuKit requests
+        $authorizationService = $this->getRequest()->getAttribute('authorization');
+        if ($authorizationService instanceof \Authorization\AuthorizationService) {
+            $authorizationService->skipAuthorization();
+        }
+    }
+}

src/Controller/MailPreviewController.php

@@ -15,9 +15,7 @@
  */
 namespace DebugKit\Controller;
 
-use Cake\Controller\Controller;
 use Cake\Core\App;
-use Cake\Core\Configure;
 use Cake\Core\Plugin as CorePlugin;
 use Cake\Event\EventInterface;
 use Cake\Http\Exception\NotFoundException;
@@ -32,22 +30,8 @@
  *
  * @property \DebugKit\Model\Table\PanelsTable $Panels
  */
-class MailPreviewController extends Controller
+class MailPreviewController extends DebugKitController
 {
-    /**
-     * Before filter callback.
-     *
-     * @param \Cake\Event\EventInterface $event The beforeFilter event.
-     * @return void
-     * @throws \Cake\Http\Exception\NotFoundException
-     */
-    public function beforeFilter(EventInterface $event)
-    {
-        if (!Configure::read('debug')) {
-            throw new NotFoundException();
-        }
-    }
-
     /**
      * Before render handler.
      *

src/Controller/PanelsController.php

@@ -14,8 +14,6 @@
  */
 namespace DebugKit\Controller;
 
-use Cake\Controller\Controller;
-use Cake\Core\Configure;
 use Cake\Event\EventInterface;
 use Cake\Http\Exception\NotFoundException;
 
@@ -24,7 +22,7 @@
  *
  * @property \DebugKit\Model\Table\PanelsTable $Panels
  */
-class PanelsController extends Controller
+class PanelsController extends DebugKitController
 {
     /**
      * Initialize controller
@@ -36,21 +34,6 @@ public function initialize(): void
         $this->loadComponent('RequestHandler');
     }
 
-    /**
-     * Before filter handler.
-     *
-     * @param \Cake\Event\EventInterface $event The event.
-     * @return void
-     * @throws \Cake\Http\Exception\NotFoundException
-     */
-    public function beforeFilter(EventInterface $event)
-    {
-        // TODO add config override.
-        if (!Configure::read('debug')) {
-            throw new NotFoundException();
-        }
-    }
-
     /**
      * Before render handler.
      *

src/Controller/RequestsController.php

@@ -14,17 +14,14 @@
  */
 namespace DebugKit\Controller;
 
-use Cake\Controller\Controller;
-use Cake\Core\Configure;
 use Cake\Event\EventInterface;
-use Cake\Http\Exception\NotFoundException;
 
 /**
  * Provides access to panel data.
  *
  * @property \DebugKit\Model\Table\RequestsTable $Requests
  */
-class RequestsController extends Controller
+class RequestsController extends DebugKitController
 {
     /**
      * Before filter handler.
@@ -35,10 +32,7 @@ class RequestsController extends Controller
      */
     public function beforeFilter(EventInterface $event)
     {
-        // TODO add config override
-        if (!Configure::read('debug')) {
-            throw new NotFoundException();
-        }
+        parent::beforeFilter($event);
 
         $this->response = $this->response->withHeader('Content-Security-Policy', '');
     }

src/Controller/ToolbarController.php

@@ -15,15 +15,12 @@
 namespace DebugKit\Controller;
 
 use Cake\Cache\Cache;
-use Cake\Controller\Controller;
-use Cake\Core\Configure;
-use Cake\Event\EventInterface;
 use Cake\Http\Exception\NotFoundException;
 
 /**
  * Provides utility features need by the toolbar.
  */
-class ToolbarController extends Controller
+class ToolbarController extends DebugKitController
 {
     /**
      * View class
@@ -42,21 +39,6 @@ public function initialize(): void
         $this->loadComponent('RequestHandler');
     }
 
-    /**
-     * Before filter handler.
-     *
-     * @param \Cake\Event\EventInterface $event The event.
-     * @return void
-     * @throws \Cake\Http\Exception\NotFoundException
-     */
-    public function beforeFilter(EventInterface $event)
-    {
-        // TODO add config override.
-        if (!Configure::read('debug')) {
-            throw new NotFoundException();
-        }
-    }
-
     /**
      * Clear a named cache.
      *

tests/TestCase/Controller/DebugKitControllerTest.php

@@ -0,0 +1,80 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * CakePHP(tm) : Rapid Development Framework (http://cakephp.org)
+ * Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
+ *
+ * Licensed under The MIT License
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright     Copyright (c) Cake Software Foundation, Inc. (http://cakefoundation.org)
+ * @link          http://cakephp.org CakePHP(tm) Project
+ * @license       http://www.opensource.org/licenses/mit-license.php MIT License
+ */
+namespace DebugKit\Test\TestCase\Controller;
+
+use Authorization\AuthorizationService;
+use Authorization\Policy\OrmResolver;
+use Cake\Core\Configure;
+use Cake\Event\Event;
+use Cake\Http\Response;
+use Cake\Http\ServerRequest;
+use Cake\TestSuite\IntegrationTestCase;
+use DebugKit\Controller\DebugKitController;
+use Exception;
+
+/**
+ * Composer controller test.
+ */
+class DebugKitControllerTest extends IntegrationTestCase
+{
+    /**
+     * tests `debug` is disabled
+     *
+     * @return void
+     */
+    public function testDebugDisabled()
+    {
+        $oldStatus = Configure::read('debug');
+        Configure::write('debug', false);
+
+        $request = new ServerRequest(['url' => '/debug-kit/']);
+        $controller = new DebugKitController($request, new Response());
+        $event = new Event('testing');
+
+        // try/catch/finally instead of expectExcetion
+        // to restore `debug` configuration
+        try {
+            $controller->beforeFilter($event);
+        } catch (Exception $e) {
+            $this->assertInstanceOf('Cake\Http\Exception\NotFoundException', $e);
+            $this->assertSame('Not available without debug mode on.', $e->getMessage());
+        } finally {
+            Configure::write('debug', $oldStatus);
+        }
+    }
+
+    /**
+     * tests authorization is checked to avoid
+     * AuthorizationRequiredException throwned
+     *
+     * @return void
+     */
+    public function testSkipAuthorization()
+    {
+        $request = new ServerRequest(['url' => '/debug-kit/']);
+
+        $resolver = new OrmResolver();
+        $authorization = new AuthorizationService($resolver);
+
+        $request = $request->withAttribute('authorization', $authorization);
+
+        $controller = new DebugKitController($request, new Response());
+        $event = new Event('testing');
+
+        $controller->beforeFilter($event);
+
+        $this->assertTrue($controller->getRequest()->getAttribute('authorization')->authorizationChecked());
+    }
+}