Skip to content

Settings: "Active for" as a checkbox per part, with the Web Services API - #33

Merged
codeling merged 2 commits into
mainfrom
ccr-f557f83f-uk6a4f
Nov 8, 2026
Merged

codeling merged 2 commits into
mainfrom
ccr-f557f83f-uk6a4f

Conversation

@codeling

@codeling codeling commented Nov 7, 2026 •

Copy link
Copy Markdown
Owner

This is the component half of protecting logins through Joomla's Web Services API (api/index.php). The plugin half is codeling/bfstop#265 (branch of the same name), which also holds the tests and the language strings.

Changes

  • "Active for" has a checkbox per part: Frontend, Backend and Web Services API, all ticked by default. It replaces a list of every combination. At least one part has to be ticked (required, values checked against the options).
  • Storage stays the bitmask the plugin reads and 1.x stored: 1 frontend, 2 backend, 4 API, so 7 for all three. SettingsModel converts it to the list of ticked boxes when loading the form (paramsForForm()) and back when saving (paramsForStorage()). The plugin, the update migration and settings saved earlier need no change for that.
  • Never "active for nothing": a browser posts nothing for unticked boxes, which required rejects. If a crafted request still arrives with no valid part, the setting is left out of what is saved. The plugin's default then applies, which is all parts, not none.
  • Failed login list: failed logins made through the API show "API" as their origin. Before, anything that wasn't frontend showed as "Backend".

Testing

Run locally against Joomla 5.4.10 on PostgreSQL 16, with both branches deployed:

  • Plugin suite, unit + integration: 405 tests OK, 3 skipped for environment reasons.
  • The new ComponentTest::testActiveForIsStoredAsABitmask checks the conversion in both directions and that the default applies when nothing was saved. It also checks that the form ticks the boxes of a stored bitmask (rendered with Joomla's checkboxes layout), and that a save of Backend + API stores 6.
  • The validation test now also covers no part ticked and an invalid value. testUnsavedSettingsAreWhatTheSettingsPageShows compares the checkboxes' default 1,2,4 against the plugin default 7.
  • check-language, check-zip, php -l and xmllint all pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL

"Active for" offers every combination of frontend, backend and the Web
Services API (bit 4, see the plugin branch of the same name), default
all three; the failed login list shows "API" as the origin of failed
logins there.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL
Instead of a list of every combination of frontend, backend and Web
Services API, the setting has a checkbox for each part; at least one
has to be ticked. It is still stored as the bitmask the plugin reads
(and 1.x stored): SettingsModel converts between the two, and a request
without any valid part leaves the setting out, so the plugin's default
(all parts) applies rather than none.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AFJFMPv7CSqgJJ93QJvYfL
@codeling codeling changed the title Settings: add the Web Services API to "Active for" Settings: "Active for" as a checkbox per part, with the Web Services API Nov 8, 2026
@codeling
codeling merged commit a569fcf into main Nov 8, 2026
15 checks passed
@codeling
codeling deleted the ccr-f557f83f-uk6a4f branch November 8, 2026 10:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants