Mitgliederverwaltung/.plans/open/issue-211-authorization-middleware-refactor.md

Issue #211: Authorization Middleware Maintenance Burden

Problem

The AuthorizationMiddleware requires manual maintenance for each new controller and method:

1. When adding a new admin-only controller, it must be added to the beforeController chain:

   if ($controller instanceof ImportController
       || $controller instanceof PermissionController
       || $controller instanceof AuditController
       || $controller instanceof DsgvoController
       || $controller instanceof BackupController
       // NEW: Must add here
   ) { ... }
   

2. When adding an admin-only method, it must be added to a constant:

   private const ADMIN_METHODS_MEMBER = ['revealAllergies', 'archive'];
   // NEW: Must add here
   

3. When adding a read-only method, it must be added to:

   private const READ_METHODS = [
       'index', 'show', 'search', 'preview', ...
       // NEW: Must add here
   ];
   

Impact

• Easy to forget to add a new controller/method to the right list
• Growing maintenance burden as the app expands
• Potential security issues if a write method is accidentally omitted
• Violates Open/Closed Principle

Solution

Use PHP 8 attributes to declare permissions directly on controller methods:

#[Attribute]
class RequirePermission {
    public function __construct(string $level) { ... }
}

class MemberController {
    #[RequirePermission('read')]
    public function index(): JSONResponse { ... }
    
    #[RequirePermission('write')]
    public function create(): JSONResponse { ... }
    
    #[RequirePermission('admin')]
    public function revealAllergies(): JSONResponse { ... }
}

Middleware then reads attributes via reflection.

Tasks

• Create RequirePermission attribute class
• Add #[RequirePermission] attributes to all controller methods
• Refactor AuthorizationMiddleware::beforeController() to use reflection
• Remove hardcoded controller and method lists
• Add tests to verify permission enforcement
• Document the new attribute-based approach

Labels

• refactoring
• backend
• security
• priority:medium
• architecture