New method skipAuthorizationActions

composer.json

@@ -73,7 +73,7 @@
         "stan": "@phpstan",
         "stan-baseline": "tools/phpstan --generate-baseline",
         "stan-setup": "phive install",
-        "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector:\"~2.3.1\" && mv composer.backup composer.json",
+        "rector-setup": "cp composer.json composer.backup && composer require --dev rector/rector --with-dependencies && mv composer.backup composer.json",
         "rector-check": "vendor/bin/rector process --dry-run",
         "rector-fix": "vendor/bin/rector process",
         "test": "phpunit",

docs/en/component.md

@@ -34,6 +34,12 @@ $this->loadComponent('Authorization.Authorization', [
 ]);
 ```
 
+The same can be done at runtime, for example in `beforeFilter()`:
+
+```php
+$this->Authorization->skipAuthorizationActions('login', 'logout');
+```
+
 By default, every action requires authorization when authorization checking is
 enabled.
 

src/Controller/Component/AuthorizationComponent.php

@@ -19,6 +19,7 @@
 use Authorization\AuthorizationServiceInterface;
 use Authorization\Exception\ForbiddenException;
 use Authorization\IdentityInterface;
+use Authorization\Policy\Result;
 use Authorization\Policy\ResultInterface;
 use Cake\Controller\Component;
 use Cake\Http\ServerRequest;
@@ -130,6 +131,16 @@
             $action = $this->getDefaultAction($request);
         }
 
+        $skipAuthorization = $this->checkAction($action, 'skipAuthorization');
+        if ($skipAuthorization) {
+            $this->skipAuthorization();
+
+            return match ($method) {
+                'can' => true,
+                'canResult' => new Result(true),
+            };
+        }
+
         $identity = $this->getIdentity($request);
         if (!$identity instanceof IdentityInterface) {
             return $this->getService($request)->{$method}(null, $action, $resource);
@@ -178,6 +189,22 @@
         return $this;
     }
 
+    /**
+     * Adds actions that should skip the automatic authorization check.
+     *
+     * Actions registered here are marked as authorized in `authorizeAction()`,
+     * which runs on the configured `authorizationEvent`.
+     *
+     * @param string ...$actions Controller actions to skip authorization for.
+     * @return $this
+     */
+    public function skipAuthorizationActions(string ...$actions)
+    {
+        $this->_config['skipAuthorization'] = array_merge($this->_config['skipAuthorization'], $actions);
+
+        return $this;
+    }
+
     /**
      * Allows to map controller action to another authorization policy action.
      *

tests/TestCase/Controller/Component/AuthorizationComponentTest.php

@@ -550,6 +550,24 @@ public function testAuthorizeModel(): void
         $this->assertEquals(['foo', 'bar', 'baz'], $this->Auth->getConfig('authorizeModel'));
     }
 
+    public function testSkipAuthorizationActions(): void
+    {
+        $this->Auth->skipAuthorizationActions('foo', 'bar');
+        $this->assertEquals(['foo', 'bar'], $this->Auth->getConfig('skipAuthorization'));
+
+        $this->Auth->skipAuthorizationActions('baz');
+        $this->assertEquals(['foo', 'bar', 'baz'], $this->Auth->getConfig('skipAuthorization'));
+    }
+
+    public function testSkipAuthorizationActionsAppliedOnAuthorizeAction(): void
+    {
+        $service = $this->Controller->getRequest()->getAttribute('authorization');
+
+        $this->Auth->skipAuthorizationActions('edit');
+        $this->Auth->authorizeAction();
+        $this->assertTrue($service->authorizationChecked());
+    }
+
     public function testMapAction(): void
     {
         $this->Auth->mapAction('foo', 'bar');