feat: Settings - Decouple from shield by najdanovicivan · Pull Request #1220 · codeigniter4/shield

najdanovicivan · 2024-11-04T21:45:16Z

Description
Decouple settings library so it is not required.
Related to #1215

Checklist:

Securely signed commits
Component(s) with PHPDoc blocks, only if necessary or adds value
Unit testing, with >80% coverage
User guide updated
Conforms to style guide

najdanovicivan · 2024-11-04T21:56:52Z

src/Helpers/auth_helper.php

+
+if (! function_exists('shieldSetting')) {
+    /**
+     * Provides a wrapper function for settings module.
+     *
+     * @param mixed $value
+     *
+     * @return array|bool|float|int|object|string|void|null
+     * @phpstan-return ($value is null ? array|bool|float|int|object|string|null : void)
+     */
+    function shieldSetting(?string $key = null, $value = null)
+    {
+        /** @var AuthConfig $config */
+        $config = config('Auth');
+        if($config->useSettings) {
+            return setting($key, $value);
+        }
+
+        // Getting the value?
+        if (!empty($key) && count(func_get_args()) === 1) {
+            $parts = explode('.', $key);
+            if (count($parts) === 1) {
+                throw new InvalidArgumentException('$key must contain both the class and field name, i.e. Foo.bar');
+            }
+            return config($parts[0])?->{$parts[1]} ?? null;
+        }
+
+        throw new InvalidArgumentException('Settings library is not being used for shield');
+    }
+}


This is the important part. With the proposed change call to setting() method will only occur here.

TwistedAndy · 2025-06-19T07:01:25Z

Yes, it would be great to decouple Shield and Settings packages. Personally, I don't see a lot of sense of having the Settings dependency here, because CodeIgniter already has BaseConfig to handle settings.

najdanovicivan · 2025-10-01T06:55:58Z

@datamweb What else is needed for this one to be merged ?

datamweb · 2025-10-03T15:57:21Z

@najdanovicivan I'm currently on mobile and need to review this PR on my PC. I'll get back to it soon.

paulbalandan · 2025-10-03T18:41:52Z

docs/addons/jwt.md


        // Get the credentials for login
-        $credentials             = $this->request->getJsonVar(setting('Auth.validFields'));
+        $credentials             = $this->request->getJsonVar(shieldSetting('Auth.validFields'));


I believe this should be in snake case per our coding standards: shield_setting

paulbalandan · 2025-10-03T18:44:01Z

src/Helpers/auth_helper.php

+     * @return array|bool|float|int|object|string|void|null
+     * @phpstan-return ($value is null ? array|bool|float|int|object|string|null : void)


paulbalandan · 2025-10-03T18:45:16Z

src/Helpers/auth_helper.php

+     * @return array|bool|float|int|object|string|void|null
+     * @phpstan-return ($value is null ? array|bool|float|int|object|string|null : void)
+     */
+    function shieldSetting(?string $key = null, $value = null)


Suggested change

function shieldSetting(?string $key = null, $value = null)

function shield_setting(?string $key = null, mixed $value = null): mixed

paulbalandan · 2025-10-03T18:46:05Z

src/Helpers/auth_helper.php

+    {
+        /** @var AuthConfig $config */
+        $config = config('Auth');
+        if($config->useSettings) {


Please add a function_exists check

paulbalandan · 2025-10-03T18:48:06Z

src/Helpers/auth_helper.php

+        }
+
+        // Getting the value?
+        if (!empty($key) && count(func_get_args()) === 1) {


What's the use case for having null key? Would it be better to just require a string key?

Good question!

paulbalandan · 2025-10-03T18:49:04Z

src/Helpers/auth_helper.php

+            if (count($parts) === 1) {
+                throw new InvalidArgumentException('$key must contain both the class and field name, i.e. Foo.bar');
+            }
+            return config($parts[0])?->{$parts[1]} ?? null;


The ?-> would return null if config($parts[0]) is not an object so the ?? null is useless.

paulbalandan · 2025-10-03T18:55:16Z

src/Helpers/auth_helper.php

+            return config($parts[0])?->{$parts[1]} ?? null;
+        }
+
+        throw new InvalidArgumentException('Settings library is not being used for shield');


This capturing exception feels off. This would be reached if:

Auth::$useSettings is true but settings is not installed.

$useSettings is false but $key is null or empty string.

$useSettings is false, $key is non-empty-string, and $value is provided

These different scenarios should be tackled separately within each conditional above.

paulbalandan · 2025-10-03T18:55:51Z

composer.json

        "ext-curl": "Required to use the password validation rule via PwnedValidator class.",
-        "ext-openssl": "Required to use the JWT Authenticator."
+        "ext-openssl": "Required to use the JWT Authenticator.",
+        "codeigniter4/settings": "Required to store groups and permissions in database"


Add this also to require-dev

paulbalandan · 2025-10-03T18:56:37Z

src/Helpers/auth_helper.php

    }
 }
+
+if (! function_exists('shieldSetting')) {


Please add a test for this new function.

datamweb

We reference the settings package directly in several parts of the documentation.
If this PR is going to be merged, these sections of the docs should be updated and clarified accordingly.
https://shield.codeigniter.com/getting_started/concepts/?h=settings#settings
https://shield.codeigniter.com/getting_started/concepts/?h=settings#repository-state
https://shield.codeigniter.com/?h=settings#important-features

Please pay attention to @paulbalandan’s review.
Also, part of the GitHub Action failures is related to the removal of the settings package.
Please try to ensure that the actions pass successfully.

datamweb · 2025-10-08T18:46:29Z

composer.json

    },
    "require": {
-        "php": "^8.1",
-        "codeigniter4/settings": "^2.1"


The current software relies on the codeigniter4/settings package for data storage.
After installing or updating to the new version of Shield, this package(codeigniter4/settings) will be automatically removed, which could lead to a breaking change, unless it remains required by another package.

I’m deeply concerned about this, and at the very least, this change should be clearly, explicitly, and transparently documented in the docs and UPGRADING.

datamweb · 2025-10-08T18:57:08Z

src/Config/Auth.php

+     * Use Settings
+     * --------------------------------------------------------------------
+     */
+    public bool $useSettings = true;


You previously removed "codeigniter4/settings": "^2.1" from the require section:

If the settings package isn’t installed, doesn’t this make it essentially useless?
In any case, it will cause failures for any software that relies on the settings package.

datamweb · 2025-10-08T18:57:54Z

src/Helpers/auth_helper.php

+        }
+
+        // Getting the value?
+        if (!empty($key) && count(func_get_args()) === 1) {


Good question!

datamweb · 2025-10-08T19:00:40Z

src/Helpers/auth_helper.php

+        // Getting the value?
+        if (!empty($key) && count(func_get_args()) === 1) {
+            $parts = explode('.', $key);
+            if (count($parts) === 1) {


Suggested change

if (count($parts) === 1) {

if (count($parts) !== 2) {

How about keeping it this way?

najdanovicivan commented Nov 4, 2024

View reviewed changes

najdanovicivan changed the title ~~WIP: Settings - Decouple from shield~~ WIP feat: Settings - Decouple from shield Nov 4, 2024

kenjis added the enhancement New feature or request label Nov 8, 2024

datamweb added the GPG-Signing needed Pull requests that need GPG-Signing label Nov 30, 2024

datamweb changed the title ~~WIP feat: Settings - Decouple from shield~~ feat: Settings - Decouple from shield Nov 30, 2024

Settings - Decouple from shield

6453789

najdanovicivan force-pushed the decouple-settings branch from 0326f5d to 6453789 Compare October 1, 2025 06:39

paulbalandan reviewed Oct 3, 2025

View reviewed changes

paulbalandan added tests needed Pull requests that need tests docs needed Pull requests needing documentation write-ups and/or revisions. and removed GPG-Signing needed Pull requests that need GPG-Signing labels Oct 3, 2025

datamweb added the breaking change Pull requests that may break existing functionalities label Oct 8, 2025

datamweb reviewed Oct 8, 2025

View reviewed changes

		* @return array\|bool\|float\|int\|object\|string\|void\|null
		* @phpstan-return ($value is null ? array\|bool\|float\|int\|object\|string\|null : void)

	* @return array\|bool\|float\|int\|object\|string\|void\|null
	* @phpstan-return ($value is null ? array\|bool\|float\|int\|object\|string\|null : void)
	* @return mixed

	function shieldSetting(?string $key = null, $value = null)
	function shield_setting(?string $key = null, mixed $value = null): mixed

Conversation

najdanovicivan commented Nov 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

najdanovicivan Nov 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

TwistedAndy commented Jun 19, 2025

Uh oh!

najdanovicivan commented Oct 1, 2025

Uh oh!

datamweb commented Oct 3, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

datamweb left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

najdanovicivan commented Nov 4, 2024 •

edited

Loading

najdanovicivan Nov 4, 2024 •

edited

Loading