fix(security) : add ROLE_USER security on all read endpoints

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/Entity/Client.php

@@ -18,8 +18,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/Project.php

@@ -20,8 +20,8 @@ use Symfony\Component\Validator\Constraints as Assert;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(
             security: "is_granted('ROLE_ADMIN')",
             denormalizationContext: ['groups' => ['project:write', 'project:create']],

src/Entity/Task.php

@@ -22,8 +22,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false),
+        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')", processor: TaskNumberProcessor::class),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TaskDocument.php

@@ -19,8 +19,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(paginationEnabled: false),
+        new GetCollection(paginationEnabled: false, security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(
             security: "is_granted('ROLE_ADMIN')",
             processor: TaskDocumentProcessor::class,

src/Entity/TaskEffort.php

@@ -16,8 +16,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TaskGroup.php

@@ -19,8 +19,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TaskPriority.php

@@ -16,8 +16,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TaskStatus.php

@@ -16,8 +16,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TaskTag.php

@@ -16,8 +16,8 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_ADMIN')"),
         new Patch(security: "is_granted('ROLE_ADMIN')"),
         new Delete(security: "is_granted('ROLE_ADMIN')"),

src/Entity/TimeEntry.php

@@ -24,15 +24,16 @@ use Symfony\Component\Serializer\Attribute\Groups;
 
 #[ApiResource(
     operations: [
-        new GetCollection(),
+        new GetCollection(security: "is_granted('ROLE_USER')"),
         new GetCollection(
             name: 'active_time_entry',
             uriTemplate: '/time_entries/active',
             provider: ActiveTimeEntryProvider::class,
             description: 'Get the active timer for the current user',
             paginationEnabled: false,
+            security: "is_granted('ROLE_USER')",
         ),
-        new Get(),
+        new Get(security: "is_granted('ROLE_USER')"),
         new Post(security: "is_granted('ROLE_USER')"),
         new Patch(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),
         new Delete(security: "is_granted('ROLE_ADMIN') or object.getUser() == user"),