Cakephp3 Tiny Auth Allow Auth fail - authentication

Question

I am using the TinyAuth plugin with my Cakephp3. I have a controller with the following namespace:
namespace App\Controller\Api\Datatables;
The controller is Listings and my function is Filter
I have the following route setup:
Router::scope('/datatables', ['prefix' => 'api/datatables'], function (RouteBuilder $routes) {
$routes->extensions(['json', 'xml', 'ajax']);
$routes->fallbacks(DashedRoute::class);
});
This allows me to call the following url:
/datatables/listings/filter.json
I want to allow the filter function:
datatables/Listings = filter
When I call my URL I am re-directed to login. If I login the url works, so the allow_auth works.
I have also tried the following:
api/datatables/Listings = filter
api/Datatables/Listings = filter
Api/Datatables/Listings = filter
api/datatables/Listings = filter
datatables/Listings = filter
Datatables/Listings = filter
api/Listings = filter
No matter what the path is not allowed. If I move the controller to the default location then in allow_auth:
Listings = filter
the filter function is accessible without authorisation. This suggests that there is a problem with the plugin when using a router scope.
Here is the plugin's composer.json
{
"name": "ypnos-web/cakephp-datatables",
"description": "jQuery DataTables for CakePHP 3",
"homepage": "https://github.com/ypnos-web/cakephp-datatables",
"type": "cakephp-plugin",
"keywords": ["cakephp", "datatables"],
"license": "MIT",
"authors": [
{
"name": "Frank Heider",
"homepage": "https://github.com/fheider",
"role": "Author"
},
{
"name": "Johannes Jordan",
"homepage": "https://github.com/ypnos-web",
"role": "Author"
}
],
"require": {
"php": ">=7.0",
"cakephp/cakephp": "^3.6"
},
"autoload": {
"psr-4": {
"DataTables\\": "src"
}
},
"autoload-dev": {
"psr-4": {
"DataTables\\Test\\": "tests",
"Cake\\Test\\": "./vendor/cakephp/cakephp/tests"
}
}
}
Am I correct in stating that the slashed routes do work for the acl.ini - they seem to as far as I can see.
I am using the slashed routes to better organise my functions.
My request params are as follows when I call /datatables/listings/filter.json?
'controller' => 'Listings',
'action' => 'filter',
'pass' => [],
'prefix' => 'api/datatables',
'plugin' => null,
'_ext' => 'json',
'_matchedRoute' => '/datatables/:controller/:action/*',
'?' => [
'string' => 'seat'
]
If I call /api/datatables/listings/filter.json:
Controller class Datatables could not be found.

Answer 1

I'm not overly familiar with the plugin, but api/datatables/Listings seems to be the correct format, however looking at the plugin's source, it seems that nested prefixes aren't supported:
if (strpos($key, '/') !== false) {
list($res['prefix'], $key) = explode('/', $key);
}
https://github.com/dereuromark/cakephp-tinyauth/blob/1.11.0/src/Utility/Utility.php#L23-L25
That code would parse api as the prefix, and datatables as the controller.
You may want to open an issue, or add support for it yourself if you can.