Skip to content

Allow Closure for requireAuthorizationCheck config option#322

Merged
dereuromark merged 1 commit into3.nextfrom
feature/callable-require-authorization-check
Mar 29, 2026
Merged

Allow Closure for requireAuthorizationCheck config option#322
dereuromark merged 1 commit into3.nextfrom
feature/callable-require-authorization-check

Conversation

@dereuromark
Copy link
Copy Markdown
Member

Summary

This PR adds support for a callable in the requireAuthorizationCheck middleware configuration option. Currently, this option only accepts a boolean value, but applications often need to conditionally skip authorization checks based on the request path or other request attributes.

Use Case

When integrating third-party plugins that provide their own admin panels (e.g., queue management dashboards), these plugins may manage authorization independently. The host application needs a way to skip the middleware's authorization check for these specific routes without disabling it globally.

Before this PR, applications had to wrap the middleware in a custom closure:

$middlewareQueue->add(function ($request, $handler) use ($app) {
    $path = $request->getUri()->getPath();
    $skipAuthCheck = str_contains($path, '/admin/queue');

    $middleware = new AuthorizationMiddleware($app, [
        'requireAuthorizationCheck' => !$skipAuthCheck,
    ]);

    return $middleware->process($request, $handler);
});

After this PR, the same can be achieved cleanly:

$middlewareQueue->add(new AuthorizationMiddleware($this, [
    'requireAuthorizationCheck' => function ($request) {
        $path = $request->getUri()->getPath();
        if (str_contains($path, '/admin/queue')) {
            return false;
        }
        return true;
    }
]));

Changes

  • Modified AuthorizationMiddleware::process() to check if requireAuthorizationCheck is callable and invoke it with the request
  • Updated docblock to document the callable signature
  • Added 3 test cases covering:
    • Callable returning true (requires authorization check)
    • Callable returning false (skips authorization check)
    • Route-based logic example
  • Updated English documentation with example usage

Backwards Compatibility

This change is fully backwards compatible. The existing boolean behavior is preserved - the callable is only invoked if the config value is callable.

@dereuromark dereuromark requested review from ADmad and LordSimal March 29, 2026 14:34
@dereuromark dereuromark added this to the 3.x milestone Mar 29, 2026
@LordSimal
Copy link
Copy Markdown
Contributor

As this is a new feature shouldn't this be added to 3.next?

@dereuromark dereuromark changed the base branch from 3.x to 3.next March 29, 2026 15:49
@dereuromark
Copy link
Copy Markdown
Member Author

For these small satellite repos its sometimes overkill, since this would be a simple minor release without all the branch switching/merging.
But I did it now cleanly.

@dereuromark dereuromark force-pushed the feature/callable-require-authorization-check branch 2 times, most recently from feea565 to 2cc9135 Compare March 29, 2026 15:54
@dereuromark dereuromark changed the title Allow callable for requireAuthorizationCheck config option Allow Closure for requireAuthorizationCheck config option Mar 29, 2026
@dereuromark dereuromark force-pushed the feature/callable-require-authorization-check branch from 2cc9135 to fbcd4dd Compare March 29, 2026 15:56
@dereuromark dereuromark merged commit 799f14b into 3.next Mar 29, 2026
8 checks passed
@dereuromark dereuromark deleted the feature/callable-require-authorization-check branch March 29, 2026 16:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants