Make implicit TRUE permissions check explicit in API 4 Explorer for PHP

[larssandergreen]

Overview

It feels like we end up with quite a few bugs because of the implicit TRUE permissions checks in API 4. I think it might make life a little easier if we make the implicit TRUE explicit in the API 4 Explorer, so if we're copying and pasting we're more likely to stop and think if we should be checking permissions or not.

This only changes the PHP.

The downside is possibly a few more lines of code in core when using traditional style PHP, but that seems well worth it if we avoid a few bugs.

[civibot]

(Standard links)

• If you are reviewing this pull-request, you may wish to consult the test sites and the Review Standards (long template, short template).

[colemanw]

In hindsight, I think the OOP pattern of Civi\Api4\Foo::get(FALSE | TRUE)->execute() is not so great. I wish I had designed it to be more explicit & readable. Maybe like this:

Civi\Api4\Foo::get()
  ->addWhere(...)
  ->executeWithPermissions() // or ->executeWithoutPermissions()

[larssandergreen]

@colemanw Yes, that would have been more readable.

[colemanw]

@larssandergreen it's kinda not too late to add those 2 functions as wrappers to execute()... but it would kinda be a breaking change because any code using those new functions would be incompatible with earlier versions of civi where they don't exist.
Also, then we'd have 3 ways to do the same thing (there's also the setCheckPermissions(TRUE|FALSE) method). Which feels like adding entropy rather than cleaning anything up.

[larssandergreen]

@colemanw We could just use setCheckPermissions(TRUE|FALSE) in the API Explorer instead, definitely more readable, though it's an extra line. What if we showed it as ->setCheckPermissions(TRUE|FALSE)->execute(); (which is kind of the same as you're suggesting).

[colemanw]

Ugh, the whole reason I added the shorter syntax was because people complained about the wordiness of ->setCheckPermissions(TRUE|FALSE)->execute();.
Can't win 🤷‍♂️

[larssandergreen]

I say let 'em complain. If they don't like the output of the API Explorer, they are welcome to use the shorter syntax or the implicit TRUE.

[larssandergreen]

But we can also merge this as is, that's fine with me too.

[colemanw]

Fine with me too :)