Combination of access restriction for api_users and ip does not work properly

[Uwe Michelfelder]

Reading the documentation for the Access annotation, I would think that a combination of
Api\Access("api_users") and Api\Access("[ip:..]") would work.

@Api\Access("ip[89.19.,89.20.]") | Limit to certain IPs (ADDITIONALLY to fe_user etc.)

In my case, the "api_users" are defined by global API-users via basic auth in the extension settings.

Each authentication works on its own, but in combination it does not, although the documentation reads:

[David Bascom]

Sorry, misleading in the documentation. There should only be ONE @Api\Access line per method.

@Api\Access("fe_users", "ip_users[90.120.10.*]")

‌

[David Bascom]

corrected docs:

https://bitbucket.org/99grad-team/nnrestapi/commits/d7e5cccc50487c0430afb87c7dbd81c05f887343