fix: route options are not merged (outer filter is merged with inner filter)

[kenjis]

Description
Supersedes #7981
Fixes #7963

If routes are grouped, the outer filter should be applied to all routes within.
If there is a filter that should be excluded on an inner route, that route should not be defined within the group.

• merge outer group() options with inner group() options
• outer group filter is merged with inner group filter. See https://github.com/codeigniter4/CodeIgniter4/pull/8033/files#diff-9e755caf334ca07345b43d4fdc3986ac1f9bb9594c6f78ebdec59bc780699b73R344-R368

Checklist:

• Securely signed commits
• Component(s) with PHPDoc blocks, only if necessary or adds value
• Unit testing, with >80% coverage
• User guide updated
• Conforms to style guide

[kenjis]

In this case, there is no change.

$routes->group('', ['filter' => 'csrf'], function ($routes) {
    $routes->get('dashboard', function (){
        echo "CSRF is working";
    });

    $routes->group('profile', function($routes){
        $routes->get('/', function (){
            echo "CSRF is working";
        });
    });
});

Before:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    | csrf           | csrf toolbar  |
+--------+-----------+------+------------------------------+----------------+---------------+

After:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    | csrf           | csrf toolbar  |
+--------+-----------+------+------------------------------+----------------+---------------+

[kenjis]

In this case, the outer filter will be applied to the inner route.

$routes->group('', ['filter' => 'csrf'], function ($routes) {
    $routes->get('dashboard', function (){
        echo "CSRF is working";
    });

    $routes->group('profile', ['namespace' => 'Foo\Controller'], function($routes){
        $routes->get('/', function (){
            echo "CSRF is working";
        });
    });
});

Before:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    |                | toolbar       |
+--------+-----------+------+------------------------------+----------------+---------------+

After:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    | csrf           | csrf toolbar  |
+--------+-----------+------+------------------------------+----------------+---------------+

[kenjis]

In this case, the outer filter will be merged with the inner filter.

$routes->group('', ['filter' => 'csrf'], function ($routes) {
    $routes->get('dashboard', function (){
        echo "CSRF is working";
    });

    $routes->group('profile', ['filter' => 'honeypot'], function($routes){
        $routes->get('/', function (){
            echo "CSRF is working";
        });
    });
});

Before:

+--------+-----------+------+------------------------------+----------------+------------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters    |
+--------+-----------+------+------------------------------+----------------+------------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar          |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar     |
| GET    | profile   | »    | (Closure)                    | honeypot       | honeypot toolbar |
+--------+-----------+------+------------------------------+----------------+------------------+

After:

+--------+-----------+------+------------------------------+----------------+-----------------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters         |
+--------+-----------+------+------------------------------+----------------+-----------------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar               |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar          |
| GET    | profile   | »    | (Closure)                    | csrf honeypot  | honeypot csrf toolbar |
+--------+-----------+------+------------------------------+----------------+-----------------------+

[MGatner]

I was leaning towards the "none" approach but this is probably more logical for people who don't want to dig.

[neznaika0]

In this case, the outer filter will be applied to the inner route.

$routes->group('', ['filter' => 'csrf'], function ($routes) {
    $routes->get('dashboard', function (){
        echo "CSRF is working";
    });

    $routes->group('profile', ['namespace' => 'Foo\Controller'], function($routes){
        $routes->get('/', function (){
            echo "CSRF is working";
        });
    });
});

Before:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    |                | toolbar       |
+--------+-----------+------+------------------------------+----------------+---------------+

After:

+--------+-----------+------+------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                      | Before Filters | After Filters |
+--------+-----------+------+------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index |                | toolbar       |
| GET    | dashboard | »    | (Closure)                    | csrf           | csrf toolbar  |
| GET    | profile   | »    | (Closure)                    | csrf           | csrf toolbar  |
+--------+-----------+------+------------------------------+----------------+---------------+

Namespace for inner groups ignored. You merged full $options. It good?

[kenjis]

@neznaika0 What do you mean by "Namespace for inner groups ignored"?

$routes->group('', ['filter' => 'csrf'], function ($routes) {
    $routes->get('dashboard', 'Outer::index');

    $routes->group('profile', ['namespace' => 'Foo\Controller'], function($routes) {
        $routes->get('/', 'Inner::index');
    });
});

+--------+-----------+------+-------------------------------+----------------+---------------+
| Method | Route     | Name | Handler                       | Before Filters | After Filters |
+--------+-----------+------+-------------------------------+----------------+---------------+
| GET    | /         | »    | \App\Controllers\Home::index  |                | toolbar       |
| GET    | dashboard | »    | \App\Controllers\Outer::index | csrf           | csrf toolbar  |
| GET    | profile   | »    | \Foo\Controller\Inner::index  | csrf           | csrf toolbar  |
+--------+-----------+------+-------------------------------+----------------+---------------+

[neznaika0]

I didn't see Foo\Controller in the example, so I thought it wouldn't overwrite the external $options. Everything seems to be fine now. Thanks!

[michalsn]

It seems more logical than the alternative or current behavior. Thank you.

[kenjis]

Yes, this is logical, understandable, and less of a surprise to developers.