Skip to content

docs: record the current state, verified against the source - #21

Merged
tyrsson merged 3 commits into
1.0.xfrom
docs/correct-acl-api-references
Oct 5, 2026
Merged

tyrsson merged 3 commits into
1.0.xfrom
docs/correct-acl-api-references

Conversation

@tyrsson

@tyrsson tyrsson commented Oct 5, 2026 •

Copy link
Copy Markdown
Member

Every claim in the docs was checked against src/ and corrected where it did not match. Nothing is written as history, as intent, or as a plan.

Corrected

Claim Was Is
NavigationFilterIterator 3rd parameter array $roles UserInterface $user
ACL call isAllowedByRouteName($routeName, $roles) isAllowed(role: $user, resource: $route->getName())
Navigation helper state methods setRoles(string[]) setUser(?UserInterface), setAcl(AclInterface)
NavigationMiddleware location Webware\Navigation\Middleware, src/Middleware/ Webware\Navigation\Http\Middleware, src/Http/Middleware/
AclInterface namespace Webware\Acl\AclInterface Webware\Core\AclInterface
UserInterface namespace Webware\UserManager\UserInterface Webware\Core\UserInterface
menu() sidebar class nav flex-column nav flex-column gap-1
Package layout src/webware-navigation/, middleware under Middleware/ src/, middleware under Http/Middleware/
Mutation badge / install constraint 0.1.x 1.0.x

array $roles on the iterator is what put [guest] into the docs/testing.md examples; those now build a UserInterface stub, and alwaysAllowAcl() stubs isAllowed.

Removed rather than described

  • docs/webware-tools-alignment.md — an audit of an alignment exercise. Its findings are resolved, its paths predate the standalone repositories (src/webware-usermanager/src/Middleware/...), and it planned a class_alias for an interface that does not exist.
  • The RendererPluginManager sections in docs/extending.md and docs/architecture.md. There is no such class in this package; NavigationFactory passes null for all three renderers and the inline fallbacks run. Documented as "planned" is not current state.

architecture.md Decision 8 now describes the actual check, including that Acl::isAllowed() is fail-closed, loads lazily from acl_rule, and applies ancestor rules.

Verified but not changed

Pipeline position is correct as documented: RouteMiddleware → UrlHelperMiddleware → NavigationMiddleware → AclMiddleware in webware/config/pipeline.php. That means AclInterface::class is not yet on the request when NavigationMiddleware runs, so setAcl() is never reached in the shipped pipeline and the helper keeps the ACL from NavigationFactory — now stated in component-reference.md.

Not touched

Docblocks in src/ still name a planned RendererPluginManager: RendererInterface.php:12, Navigation.php:33,45, NavigationFactory.php:24-25, NavigationContainer.php:29. Code, not docs — separate change if wanted.

The docs described an API that no longer exists and named the wrong
namespaces, so a reader following them would look for a method that is not
there and an interface that lives in another package.

- `Webware\Acl\AclInterface` -> `Webware\Core\AclInterface` (the contract moved
  to webware-core; the implementation stays in webware-acl as
  `Webware\Acl\Acl`).
- `Webware\UserManager\UserInterface`, which does not exist, ->
  `Webware\Core\UserInterface`.
- `isAllowedByRouteName()` -> the inherited Laminas `isAllowed()` that
  `NavigationFilterIterator` actually calls, passing the route name as the
  resource. `isAllowedByRouteName()` was removed because it duplicated
  `isAllowedRoute()` in all but name.

`build: align tooling with webware-tools` (61e3192) made the code change and the
docs were never brought along.

architecture.md's Decision 8 is marked SUPERSEDED rather than rewritten — it
records why the method was introduced, and the route-mapping subsystem it
describes was removed with it. The webware-tools alignment audit keeps its
point-in-time findings and gains a note saying so.

Signed-off-by: Joey Smith <jsmith@webinertia.net>
architecture.md's Decision 8 documented a method that no longer exists, a
routeMappings lookup that was removed with it, and an "unmapped routes are
allowed" default that is the opposite of the current fail-closed check. It is
replaced with a section describing what the iterator actually does.

The point-in-time note on the alignment audit is reverted: that document is
untouched in this branch and needs its own decision, not a caveat.

Signed-off-by: Joey Smith <jsmith@webinertia.net>
Every claim in these documents was checked against src/ and corrected where it
did not match. Nothing is written as history, as intent, or as a plan.

- NavigationFilterIterator takes (routes, navId, UserInterface, AclInterface).
  component-reference.md documented the third parameter as `array $roles`, which
  is what put ['guest'] into the testing examples.
- NavigationMiddleware is Webware\Navigation\Http\Middleware in
  src/Http/Middleware/. It calls setUser(), setAcl() and setActiveRouteName();
  setRoles() does not exist on the helper.
- NavigationFactory passes null for all three renderers, so the inline fallbacks
  run. There is no RendererPluginManager in this package, and the sections
  describing one are removed rather than described as planned.
- overview.md's package layout showed a monorepo path and the middleware in a
  namespace it no longer occupies.
- README.md pointed at a document that no longer exists, and at the 0.1.x line
  for the mutation badge and the install constraint.

Removes docs/webware-tools-alignment.md: an audit of an alignment exercise whose
findings are resolved and whose paths predate the standalone repositories.

Not touched: docblocks in src/ still name a planned RendererPluginManager
(RendererInterface.php, Navigation.php, NavigationFactory.php,
NavigationContainer.php).

Signed-off-by: Joey Smith <jsmith@webinertia.net>
@tyrsson tyrsson changed the title docs: correct the ACL API references docs: record the current state, verified against the source Oct 5, 2026
@tyrsson
tyrsson merged commit 8984110 into 1.0.x Oct 5, 2026
11 checks passed
@tyrsson
tyrsson deleted the docs/correct-acl-api-references branch October 5, 2026 06:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant