From db78708ffe48356d70301360c6c5df4e7b03ca51 Mon Sep 17 00:00:00 2001
From: Lonnie Ezell <lonnieje@gmail.com>
Date: Mon, 2 May 2022 23:13:14 -0500
Subject: [PATCH] Ensure 'except' routes are not in routes at all. Fixes #72

---
 src/Auth.php                  |  2 +-
 tests/Unit/AuthRoutesTest.php | 43 +++++++++++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 tests/Unit/AuthRoutesTest.php

diff --git a/src/Auth.php b/src/Auth.php
index 3ca4add58..b70ae034e 100644
--- a/src/Auth.php
+++ b/src/Auth.php
@@ -100,7 +100,7 @@ public function routes(RouteCollection &$routes, array $config = [])
 
         $routes->group('/', ['namespace' => 'CodeIgniter\Shield\Controllers'], static function ($routes) use ($authRoutes, $config) {
             foreach ($authRoutes as $name => $row) {
-                if (! isset($config['except']) || (isset($config['except']) && ! array_key_exists($name, $config['except']))) {
+                if (! isset($config['except']) || (isset($config['except']) && ! in_array($name, $config['except'], true))) {
                     foreach ($row as $params) {
                         $options = isset($params[3])
                             ? ['as' => $params[3]]
diff --git a/tests/Unit/AuthRoutesTest.php b/tests/Unit/AuthRoutesTest.php
new file mode 100644
index 000000000..1f4743318
--- /dev/null
+++ b/tests/Unit/AuthRoutesTest.php
@@ -0,0 +1,43 @@
+<?php
+
+namespace Tests\Unit;
+
+use Tests\Support\TestCase;
+
+/**
+ * @internal
+ */
+final class AuthRoutesTest extends TestCase
+{
+    public function testRoutes()
+    {
+        $collection = single_service('routes');
+        $auth       = service('auth');
+
+        $auth->routes($collection);
+
+        $routes = $collection->getRoutes('get');
+
+        $this->assertArrayHasKey('register', $routes);
+        $this->assertArrayHasKey('login', $routes);
+        $this->assertArrayHasKey('login/magic-link', $routes);
+        $this->assertArrayHasKey('logout', $routes);
+        $this->assertArrayHasKey('auth/a/show', $routes);
+    }
+
+    public function testRoutesExcept()
+    {
+        $collection = single_service('routes');
+        $auth       = service('auth');
+
+        $auth->routes($collection, ['except' => ['login']]);
+
+        $routes = $collection->getRoutes('get');
+
+        $this->assertArrayNotHasKey('login', $routes);
+        $this->assertArrayHasKey('register', $routes);
+        $this->assertArrayHasKey('login/magic-link', $routes);
+        $this->assertArrayHasKey('logout', $routes);
+        $this->assertArrayHasKey('auth/a/show', $routes);
+    }
+}