DerManoMann / openapi-introspector / 39892285185

98%

push

github

Add a 403 for Laravel routes behind authorization middleware (#18)

A Laravel route behind authorization middleware now gets a `403`
response.

- Authorization middleware is the `can` alias (`can:update,post`), the
`Authorize` middleware or a subclass, and Sanctum's token ability
middleware, by its `abilities` and `ability` aliases or by class.
- It is read from the same middleware as the `401`: the route's and its
controller's, less what the route excludes. A route behind both gets the
`401` and the `403`.
- A project with middleware of its own lists it in the adapter's new
`authorization` option, which replaces the default names. The
`Authorize` class always counts.
- A form request's `authorize()` adds no `403`. Telling a real check
from `return true` would mean calling it outside a request, with no
user.
- A `403` the attributes declare wins.

14 of 14 new or added lines in 2 files covered. (100.0%)

584 of 597 relevant lines covered (97.82%)

20.22 hits per line