Support param conditions in allowExceptIn and allowExceptInMethods#414
Conversation
There was a problem hiding this comment.
Pull request overview
Extends parameter-condition handling so allowParamsInAllowed / allowExceptParamsInAllowed are honored when combined with the “except” allow directives (allowExceptIn*), preventing silently-ignored configuration and aligning behavior across path-, call-, and instanceOf-based scopes.
Changes:
- Update
Allowed::isAllowed()to apply parameter conditions when the current scope matchesallowExceptInCalls/allowExceptIn(paths), with “disallowed-by-default in this scope” semantics. - Add PHPUnit coverage for
allowExceptIn+ params (paths) andallowExceptInMethods+ params (calls). - Update docs to explain
allowIn-style vsallowExceptIn-style parameter-condition semantics and cross-reference parameter docs from path docs.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
src/Allowed/Allowed.php |
Applies param-condition overrides within allowExceptInCalls and allowExceptIn matched scopes. |
tests/Calls/FunctionCallsTest.php |
Adds config + a test case covering allowExceptIn (paths) with both param-condition variants. |
tests/Calls/FunctionCallsAllowExceptInMethodsWithParamsTest.php |
New test covering allowExceptInMethods with both param-condition variants. |
tests/src/disallowed-allow/functionCallsExceptWithParams.php |
New fixture for path-based except-scope param behavior. |
tests/src/RoyaleExceptWithParams.php |
New fixture for method-based except-scope param behavior. |
docs/allow-with-parameters.md |
Documents semantics and provides an example configuration. |
docs/allow-in-paths.md |
Adds a cross-reference to parameter-condition documentation. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
spaze
force-pushed
the
spaze/allowexcept-params-in-allowed
branch
from
70807e2 to
18f006c
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
…rectives `allow-in-paths.md` and `allow-in-methods.md` covered their their respective directives without mentioning that they can be further narrowed by parameter conditions via `allowParamsInAllowed` or `allowExceptParamsInAllowed` (also known as `disallowParamsInAllowed`).
`allowParamsInAllowed` and `allowExceptParamsInAllowed` were silently ignored when combined with `allowExceptIn` or `allowExceptInMethods`. The config looked valid, produced no schema error, and had no effect. `allowExceptInInstanceOf` already supported param conditions; this extends the same behaviour to the path-based (`allowExceptIn`) and call-based (`allowExceptInMethods`, `allowExceptInFunctions`) directives. In the matched location, `allowParamsInAllowed` can allow a call when params match, and `allowExceptParamsInAllowed` can allow a call when params don't match the forbidden values.
spaze
force-pushed
the
spaze/allowexcept-params-in-allowed
branch
from
18f006c to
d9ad222
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated no new comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
When
allowParamsInAllowedorallowExceptParamsInAllowedwas combined withallowExceptInorallowExceptInMethods, the param condition was silently ignored - the config looked valid, produced no error, and had no effect.allowExceptInInstanceOfalready supported param conditions; this extends the same behaviour to the path-based (allowExceptIn) and call-based (allowExceptInMethods,allowExceptInFunctions) directives. In the matched (disallowed) location,allowParamsInAllowedcan allow a call when params match, andallowExceptParamsInAllowedcan allow a call when params don't match the forbidden values.The documentation in
allow-with-parameters.mdis updated to explain the difference betweenallowIn-style andallowExceptIn-style semantics and includes a concrete config example.allow-in-paths.mdgains a cross-reference to the params documentation.Close #406