Add AuthorizationComponent::skipAuthorizationActions()

The `skipAuthorization` config key already marks controller actions as
public, but unlike `authorizeModel()` and `mapAction()` it has no fluent
setter, so it can only be set through `loadComponent()` options or
`setConfig()`.

Add a variadic setter that merges into the existing config, matching the
`authorizeModel(string ...$actions)` signature. `authorizeAction()` runs on
`Controller.startup`, which dispatches after `Controller.initialize`, so
registering actions from `beforeFilter()` takes effect.

Author: dereuromark

docs/en/component.md

@@ -34,6 +34,12 @@ $this->loadComponent('Authorization.Authorization', [
 ]);
 ```
 
+The same can be done at runtime, for example in `beforeFilter()`:
+
+```php
+$this->Authorization->skipAuthorizationActions('login', 'logout');
+```
+
 By default, every action requires authorization when authorization checking is
 enabled.
 

src/Controller/Component/AuthorizationComponent.php

@@ -178,6 +178,22 @@ public function skipAuthorization()
         return $this;
     }
 
+    /**
+     * Adds actions that should skip the automatic authorization check.
+     *
+     * Actions registered here are marked as authorized in `authorizeAction()`,
+     * which runs on the configured `authorizationEvent`.
+     *
+     * @param string ...$actions Controller actions to skip authorization for.
+     * @return $this
+     */
+    public function skipAuthorizationActions(string ...$actions)
+    {
+        $this->_config['skipAuthorization'] = array_merge($this->_config['skipAuthorization'], $actions);
+
+        return $this;
+    }
+
     /**
      * Allows to map controller action to another authorization policy action.
      *

tests/TestCase/Controller/Component/AuthorizationComponentTest.php

@@ -550,6 +550,24 @@ public function testAuthorizeModel(): void
         $this->assertEquals(['foo', 'bar', 'baz'], $this->Auth->getConfig('authorizeModel'));
     }
 
+    public function testSkipAuthorizationActions(): void
+    {
+        $this->Auth->skipAuthorizationActions('foo', 'bar');
+        $this->assertEquals(['foo', 'bar'], $this->Auth->getConfig('skipAuthorization'));
+
+        $this->Auth->skipAuthorizationActions('baz');
+        $this->assertEquals(['foo', 'bar', 'baz'], $this->Auth->getConfig('skipAuthorization'));
+    }
+
+    public function testSkipAuthorizationActionsAppliedOnAuthorizeAction(): void
+    {
+        $service = $this->Controller->getRequest()->getAttribute('authorization');
+
+        $this->Auth->skipAuthorizationActions('edit');
+        $this->Auth->authorizeAction();
+        $this->assertTrue($service->authorizationChecked());
+    }
+
     public function testMapAction(): void
     {
         $this->Auth->mapAction('foo', 'bar');