[4.x] Fix BaseAuthorze and BaseRenderless not triggered using event

[ghabriel25]

Scenario

When user wants to contribute to this repo and preparing some browser / unit test related to #[Authorize] and #[Renderless] attribute, they might be not aware that using #[BaseAuthorize] or #[BaseRenderless] wont be triggered if action called as event listener.

I'm aware that all Base* attribute should be strictly for internal use as stated here #10346 (comment).

Problem

Inside SupportEvents::call, both renderless and authorize attribute checked using is_subclass_of

$this->component->getAttributes()
    ->filter(fn ($i) => is_subclass_of($i, BaseAuthorize::class) // here
    ->filter(fn ($i) => $i->getName() === $method)
    ->filter(fn ($i) => $i->getLevel() === AttributeLevel::METHOD)
    ->each(fn ($i) => $i->call($params));

I think the intent here is a good one that prevent using Base** attribute as public API. But, this will cause some unsual issue when running tests. Therefore, I still think this need to be fixed.

Solution

Change is_subclass_of to instanceof

$this->component->getAttributes()
    ->filter(fn ($i) => $i instanceof BaseAuthorize)
    ->filter(fn ($i) => $i->getName() === $method)
    ->filter(fn ($i) => $i->getLevel() === AttributeLevel::METHOD)
    ->each(fn ($i) => $i->call($params));

I have added regression test for both authorize unit test and renderless browser test.

Files Changed

• src/Features/SupportEvents/SupportEvents.php
• src/Features/SupportAuthorization/UnitTest.php
• src/Features/SupportRenderless/BrowserTest.php

Fix: #10383

[calebporzio]

Hey @ghabriel25 — thanks for this one, and for the clear writeup on the issue. The fix is right: the direct-call path runs these attributes for anything matching at the method level, so the event path filtering with is_subclass_of (which excludes the base class itself) was just an inconsistency. instanceof is the correct check.

Here's what I ran to verify:

• Renderless browser test: fails on main's SupportEvents.php, passes with your fix. Solid regression test.
• Authorize unit test: I noticed your new test passes on main too — it dispatches as an authorized user and asserts Ok, which is the same outcome whether the authorize check runs or gets skipped, so it wasn't actually guarding the fix. I pushed a small commit to your branch adding a variant that dispatches as an unauthorized user and asserts Forbidden — verified it fails on main and passes here. Hope you don't mind the direct push!
• Full unit suite: green on this branch.

Happy with this — good to merge from my side.

[ghabriel25]

@calebporzio Thanks for the review.