Decouple Shield from the Settings Library

[najdanovicivan]

Currently Shield requires using of settings library. I'd like to make it possible to use Shield without the need to use settings library.

What I'm proposing is to make another helper method shieldSetting() and change all the setting() calls to shieldSetting() then we can introduce new config parameter $useSettings.

When useSettings true shieldSetting() will just forward the call to the settings method and when useSettings is false shieldSetting() will get the value directly from config files. Additionally this allows user to override the shieldSetting() method for more complex scenarios.

Then we can make the composer.json only suggest the "codeigniter4/settings" instead of requiring it.

[warcooft]

When useSettings true shieldSetting() will just forward the call to the settings method and when useSettings is false shieldSetting() will get the value directly from config files.

I didn't find anything different, what you proposed is the basic behavior of the settings package. If you have a special scenario you can customize Shield and then create additional helpers in your app.

[najdanovicivan]

The issue here is that shield requires setting to be installed and settings table needs to exist in the database. Currently it is not possible to completely disable the use of setting in the shield. The changes I'm proposing will make it possible to use the Shield library without installing settings package.

[warcooft]

If your suggestion is implemented, i think it still need a setting package to handle all potential scenarios.

[najdanovicivan]

You'll still be able to use the settings library as is if you want to. This only gives option not to use it when its not needed.

[lonnieezell]

If an option to ignore the settings library is available you then have to define how the permissions work. IIRC, the setting() check is responsible for checking both the config file and the database, so at that point there's nothing to define the interaction of the roles and permissions, etc. You would have to solve for using only config and never being able to change it in the database if you don't want to use settings.

[najdanovicivan]

@lonnieezell I've made a draft PR #1220 to better demonstrate my idea.

I'm migrating from MythAuth to Shield and things I don't like with having groups and permissions inside config file is that it is impossible to have proper constraints in the database. I'm not using wildcard permissions in any group. The groups are fully configurable with forms so the groups can be added/removed to tailor the permissions levels as needed. Without having proper keys with CASCADE actions there are a lot of issues with data integrity when groups are renamed or removed.

In order to use my custom tables I've added override to the constructor in AuthGroups config where groups and permissions are fetched from database/cache. Having all these custom tables and loading logic makes it no sense to use the settings library for anything so I just need a way to disable it.

[vbmark]

I would like the option to disable the query to the settings table. I am not using this feature and it is a wasted hit to the database.

[najdanovicivan]

@lonnieezell any thoughts, suggestions on this and #1220 ?

[warcooft]

If you really don't want to use setting, you could extends the function so that it only returns the Config values and never hit the database. See https://codeigniter4.github.io/CodeIgniter4/general/helpers.html#extending-helpers

[najdanovicivan]

@warcooft What if I don't want to use settings for shield only but still have the settings for other things

Also shield will install settings automatically via composer which is something i don't like and should only be used for packages which are absolutely necessary.

Shield can work without settings installed so it only make sense to have it as suggested package instead of it being a requirement.