deny_by_default inverts permission rules

[weierophinney]

When I set deny_by_default to true, zf-mvc-auth seems to invert the meaning of my permission rules:

module.config.php:

    'zf-mvc-auth' => array(
        'authorization' => array(
            'deny_by_default' => true,
            'Api\\V1\\Rest\\User\\Controller' => array(
                'entity' => array(
                    'GET' => true, // Don't need authorization?
                    'POST' => false,
                    'PATCH' => false,
                    'PUT' => false,
                    'DELETE' => false,
                ),
            ),

According to the documentation, the boolean value of GET determines whether or not authorization is required. However, when deny_by_default is true, suddenly the booleans are interpreted to mean that authorization is not required.

The documentation says that deny_by_default only changes behavior for actions for which no permission was defined, but in fact it inverts the existing permissions.

https://apigility.org/documentation/modules/zf-mvc-auth