zfcampus/zf-mvc-auth — pull request #36 by weierophinney (2014-07-16 20:09:04+00:00)
Title: deny_by_default inverts permission rules

When I set `deny_by_default` to true, zf-mvc-auth seems to invert the meaning of my permission rules:

`module.config.php`:
```php
'zf-mvc-auth' => array(
'authorization' => array(
'deny_by_default' => true,
'Api\\V1\\Rest\\User\\Controller' => array(
'entity' => array(
'GET' => true, // Don't need authorization?
'POST' => false,
'PATCH' => false,
'PUT' => false,
'DELETE' => false,
),
),
```

According to the documentation, the boolean value of GET determines whether or not authorization is required. However, when `deny_by_default` is `true`, suddenly the booleans are interpreted to mean that authorization is *not* required.

The documentation says that `deny_by_default` only changes behavior for actions for which no permission was defined, but in fact it inverts the existing permissions.

https://apigility.org/documentation/modules/zf-mvc-auth