refactor: decouple dashboard widget filtering from webware-acl - #13
Merged
Conversation
Type-hint Laminas\Permissions\Acl\AclInterface as the ACL seam in the dashboard middleware, widget filter iterator, and their container factory so the host application can alias any ACL implementation. Widget filtering remains in webware-admin and fails closed when no role-aware user is present. - Move webware/webware-acl from require to suggest and drop its VCS repository - Remove the AclInterface service definition from ConfigProvider - Rewrite AclWidgetFilterIterator tests to use laminas' GenericRole; add fail-closed coverage - Add DashboardMiddleware unit and integration tests (real laminas Acl + mezzio-authentication-session, no database) - Add mezzio/mezzio-authentication-session as a dev dependency - Update dashboard widget documentation and add the refactor plan Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Restore getAclConfig() in webware-admin under the mezzio-authorization-acl config key, matching the structure required by mezzio's laminas-permissions-acl integration package: roles User and Administrator (child of User), resource webware.admin.dashboard.read (the admin dashboard route name), allow Administrator. webware-acl is database driven and never consumes this config; the defaults exist for hosts using laminas-permissions-acl directly. - Resource is the route name (privileges encoded in the trailing segment, e.g. .read) per the webware/mezzio convention - ConfigProviderIntegrationTest asserts the shipped defaults and the absence of an AclInterface service definition - Annotate the user attribute retrieval (mixed-assignment) and tighten the iterator docblock - Regenerate analysis-baseline.toml: 8 entries (6 stale Webware\UserManager refs) reduced to 1 stub-limitation false positive - Update dashboard widget docs and refactor plan accordingly Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Replace generic array<string, mixed> returns with named array-shape aliases (AclConfig, DefaultConfig, Dependencies, RouteProviders, Templates, ViewHelpers, ProviderConfig) declared in the class docblock, mirroring the pattern used in webware-message-bus. Mark the class @internal. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Mirror the webware-message-bus ConfigProviderTest pattern: TestAssets\ExpectedConfig holds the expected config values, and ConfigProviderIntegrationTest asserts every getter plus __invoke() with exact assertSame comparisons plus an invoke-twice determinism check. This raises the covered MSI from 62% to 100% (all 54 mutants killed; the 20 escaped ArrayItemRemoval and related array-shape mutants are now detected). - Normalize the templates path to dirname(__DIR__) . '/templates/admin' so the emitted config is identical to the expected asset - Update plan TEST-004 to document the exact-shape assertion pattern Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Move WidgetInterface and AclWidgetFilterIterator from the Widget\ sub-namespace to the Webware\Admin package root. Add a WidgetContainer (IteratorAggregate) whose typed constructor and addWidget() are the only mutation paths, so the filter is guaranteed WidgetInterface instances by construction and the instanceof guard is dropped. RegisterWidgetEvent now owns the container; DashboardMiddleware passes it directly to the filter. Update tests, docs, and the plan; regenerate the analysis baseline. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
15 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes the hard runtime dependency on webware/webware-acl by type-hinting
Laminas\Permissions\Acl\AclInterfacein the dashboard widget pipeline. The host application supplies the ACL implementation via service aliasing (in practice webware-acl'sAcl, which already implements the laminas interface).Changes
webware/webware-aclmoved fromrequiretosuggest; acl VCS repository removed;mezzio/mezzio-authentication-sessionadded torequire-devmezzio-authorization-aclconfig key, matching the structure required by mezzio's laminas-permissions-acl integration package — rolesUser+Administrator(child ofUser), resourcewebware.admin.dashboard.read(the admin dashboard route name), allowAdministrator. webware-acl is database driven and does not consume this config; the defaults exist for hosts using laminas-permissions-acl, and the config aggregator merges them with host configMezzio\Authentication\UserInterface::class, type-hints laminasAclInterface; fails closed when the user is not role-aware (zero widgets, never unfiltered)AclInterface/?RoleInterface; null user denies allAclInterfaceimportAclWidgetFilterIteratorTest(unskipped, GenericRole + fail-closed), newDashboardMiddlewareTest(4 unit tests) andDashboardMiddlewareIntegrationTest(2 integration tests using real laminas Acl + real mezzio PhpSession, no database),ConfigProviderIntegrationTestasserts the mezzio-authorization-acl defaults and that admin registers no ACL serviceConventions honored
webware.admin.dashboard.read) — same convention as webware-acl's database rulesValidation
Follow-up (separate PR in webware-acl)
suggestentry forrequire: webware/webware-admin+ admin VCS repository (it ships the management UI, so it needs admin)Laminas\Permissions\Acl\AclInterface::class => Webware\Acl\Acl::class