Load extensions by normalized name and cast RBAC role to string

composer.json

@@ -69,6 +69,13 @@
     },
     "config": {
         "sort-packages": true,
+        "policy": {
+            "advisories": {
+                "ignore": [
+                    "league/flysystem"
+                ]
+            }
+        },
         "allow-plugins": {
             "cweagans/composer-patches": true,
             "dealerdirect/phpcodesniffer-composer-installer": true

src/Rbac/ApiRbac.php

@@ -119,7 +119,10 @@ public function checkPermissions(array|ArrayAccess $user, ServerRequestInterface
     {
         $roleField = $this->getConfig('role_field');
         $defaultRole = $this->getConfig('default_role');
-        $role = Hash::get($user, $roleField, $defaultRole);
+        // The role is matched against the permission 'role' key and passed to the rules,
+        // whose signature (CakeDC\Auth\Rbac\Rules\Rule) types it as string. Apps commonly
+        // store the role as an integer group id, so cast it here to avoid a TypeError.
+        $role = (string)Hash::get($user, $roleField, $defaultRole);
 
         if ($this->permissions === null) {
             return false;

src/Service/Action/Action.php

@@ -38,12 +38,12 @@
  * @package CakeDC\Api\Service\Action
  * @implements \Cake\Event\EventDispatcherInterface<\CakeDC\Api\Service\Action\Action>
  */
 abstract class Action implements EventListenerInterface, EventDispatcherInterface
 {
     /**
      * @use \Cake\Event\EventDispatcherTrait<\CakeDC\Api\Service\Action\Action>
      */
     use EventDispatcherTrait;
     use InstanceConfigTrait;
     use MergeVariablesTrait;
     use ValidatorAwareTrait;
@@ -394,7 +394,7 @@
 
         $extensions = $registry->normalizeArray($this->extensions);
         foreach ($extensions as $name => $properties) {
-            $instance = $registry->load($properties['className'], $properties);
+            $instance = $registry->load($name, $properties);
             $this->_eventManager->on($instance);
             if ($instance->attachable()) {
                 [, $prop] = pluginSplit($name);

src/Service/Service.php

@@ -921,8 +921,8 @@ protected function _loadExtensions(): void
         }
         $registry = $this->getExtensions();
         $extensions = $registry->normalizeArray($this->extensions);
-        foreach ($extensions as $properties) {
-            $instance = $registry->load($properties['class'], $properties['config']);
+        foreach ($extensions as $name => $config) {
+            $instance = $registry->load($name, $config);
             $this->_eventManager->on($instance);
         }
     }

tests/TestCase/Rbac/ApiRbacTest.php

@@ -0,0 +1,88 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ *
+ * Licensed under The MIT License
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ * @license MIT License (http://www.opensource.org/licenses/mit-license.php)
+ */
+
+namespace CakeDC\Api\Test\TestCase\Rbac;
+
+use CakeDC\Api\Rbac\ApiRbac;
+use CakeDC\Api\Service\ServiceRegistry;
+use CakeDC\Api\Test\ConfigTrait;
+use CakeDC\Api\TestSuite\TestCase;
+
+/**
+ * Unit tests for the RBAC permission matching logic.
+ */
+class ApiRbacTest extends TestCase
+{
+    use ConfigTrait;
+
+    /**
+     * tearDown
+     *
+     * @return void
+     */
+    public function tearDown(): void
+    {
+        ServiceRegistry::getServiceLocator()->clear();
+        parent::tearDown();
+    }
+
+    /**
+     * Build a service with a resolved action and attach it to the request.
+     *
+     * @param array $permissions RBAC permissions.
+     * @param array $user User data.
+     * @return array{rbac: \CakeDC\Api\Rbac\ApiRbac, request: \Cake\Http\ServerRequest, user: array}
+     */
+    protected function buildRequest(array $permissions, array $user = ['role' => 1, 'id' => 1]): array
+    {
+        ServiceRegistry::getServiceLocator()->clear();
+        $this->_initializeRequest([
+            'params' => ['service' => 'articles'],
+        ], 'GET');
+        $service = ServiceRegistry::getServiceLocator()->get('articles', [
+            'version' => null,
+            'service' => 'articles',
+            'request' => $this->request,
+            'response' => $this->response,
+            'baseUrl' => '/articles',
+        ]);
+        $service->dispatchPrepareAction();
+
+        $this->request = $this->request->withAttribute('service', $service);
+
+        $rbac = new ApiRbac([
+            'api_permissions' => $permissions,
+            'role_field' => 'role',
+            'default_role' => 'user',
+        ]);
+
+        return [$rbac, $this->request, $user];
+    }
+
+    /**
+     * Apps commonly store the role as an integer group id. The role is passed to
+     * the rules (typed `string`), so an integer role must be cast to string and
+     * must not raise a TypeError.
+     */
+    public function testIntegerRoleIsPassedAsStringToRules(): void
+    {
+        $rule = new RoleCapturingRule();
+        [$rbac, $request, $user] = $this->buildRequest([
+            ['role' => 1, 'service' => 'articles', 'action' => 'index', 'rule' => $rule],
+        ]);
+
+        $this->assertTrue($rbac->checkPermissions($user, $request));
+        $this->assertTrue($rule->called);
+        $this->assertSame('1', $rule->receivedRole);
+    }
+}

tests/TestCase/Rbac/RoleCapturingRule.php

@@ -0,0 +1,45 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ *
+ * Licensed under The MIT License
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ * @license MIT License (http://www.opensource.org/licenses/mit-license.php)
+ */
+
+namespace CakeDC\Api\Test\TestCase\Rbac;
+
+use ArrayAccess;
+use CakeDC\Auth\Rbac\Rules\AbstractRule;
+use Psr\Http\Message\ServerRequestInterface;
+
+/**
+ * Rule that records the role it receives, to assert the role is passed as a string.
+ */
+class RoleCapturingRule extends AbstractRule
+{
+    /**
+     * @var bool Whether the rule was invoked.
+     */
+    public bool $called = false;
+
+    /**
+     * @var string|null The role received by the rule.
+     */
+    public ?string $receivedRole = null;
+
+    /**
+     * @inheritDoc
+     */
+    public function allowed(array|ArrayAccess $user, string $role, ServerRequestInterface $request): bool
+    {
+        $this->called = true;
+        $this->receivedRole = $role;
+
+        return true;
+    }
+}

tests/TestCase/Service/ExtensionLoadingTest.php

@@ -0,0 +1,72 @@
+<?php
+declare(strict_types=1);
+
+/**
+ * Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ *
+ * Licensed under The MIT License
+ * Redistributions of files must retain the above copyright notice.
+ *
+ * @copyright Copyright 2016 - 2026, Cake Development Corporation (http://cakedc.com)
+ * @license MIT License (http://www.opensource.org/licenses/mit-license.php)
+ */
+
+namespace CakeDC\Api\Test\TestCase\Service;
+
+use Cake\Http\Response;
+use Cake\Http\ServerRequest;
+use CakeDC\Api\Service\Action\CrudIndexAction;
+use CakeDC\Api\Service\FallbackService;
+use CakeDC\Api\TestSuite\TestCase;
+
+/**
+ * Regression tests for the extension loading logic.
+ *
+ * CakePHP 5 ObjectRegistry::normalizeArray() returns a `name => config` map (the
+ * old CakePHP 4 `class`/`config` shape is gone), so extensions must be loaded by
+ * their normalized name. A plugin-prefixed extension (e.g. `CakeDC/Api.Log`) only
+ * carries a `className` key, and an app extension without a plugin prefix carries
+ * neither `class` nor `className`.
+ */
+class ExtensionLoadingTest extends TestCase
+{
+    /**
+     * A service configured with extensions must load them without a TypeError.
+     *
+     * @return void
+     */
+    public function testServiceLoadsConfiguredExtension(): void
+    {
+        $service = new FallbackService([
+            'request' => new ServerRequest(),
+            'response' => new Response(),
+            'Extension' => ['CakeDC/Api.Log'],
+        ]);
+
+        $this->assertTrue($service->getExtensions()->has('Log'));
+    }
+
+    /**
+     * An action configured with an app extension (no plugin prefix) must load it.
+     *
+     * @return void
+     */
+    public function testActionLoadsAppExtensionWithoutPluginPrefix(): void
+    {
+        $request = new ServerRequest();
+        $response = new Response();
+        $service = new FallbackService([
+            'request' => $request,
+            'response' => $response,
+        ]);
+        $action = new CrudIndexAction([
+            'service' => $service,
+            'request' => $request,
+            'response' => $response,
+            'Extension' => ['Sort'],
+        ]);
+
+        $this->assertNotNull($action->getExtensions());
+        $this->assertTrue($action->getExtensions()->has('Sort'));
+    }
+}