Restrict API endpoints

[danmartuszewski]

Restrict API endpoints

[skie]

One of options use permissions defined in config/api_permissions.php

Another define custom AppFallbackService class like this

namespace App\Service;

use CakeDC\Api\Routing\ApiRouter;
use CakeDC\Api\Service\FallbackService;
use Cake\Routing\RouteBuilder;

class AppFallbackService extends FallbackService
{
    protected $_allowed = [
        'people',
        'projects',
    ];

    public function loadRoutes()
    {
        if (in_array($this->name(), $this->_allowed)) {
            return parent::loadRoutes();
        }
        $defaultOptions = $this->routerDefaultOptions();
        ApiRouter::scope('/', $defaultOptions, function (RouteBuilder $routes) {});
    }
}