fix(core) : RBAC #344 - ferme leak user list + test cascade delete role

2026-04-15 14:53:49 +02:00
parent 534bdbccdd
commit 0ccbc70f27
2 changed files with 53 additions and 0 deletions
--- a/src/Module/Core/Domain/Entity/User.php
+++ b/src/Module/Core/Domain/Entity/User.php
@@ -31,9 +31,11 @@ use Symfony\Component\Serializer\Attribute\SerializedName;
            normalizationContext: ['groups' => ['me:read']],
        ),
        new Get(
+            security: "is_granted('ROLE_ADMIN')",  // TODO ticket #345 : remplacer par is_granted('core.users.view')
            normalizationContext: ['groups' => ['user:list']],
        ),
        new GetCollection(
+            security: "is_granted('ROLE_ADMIN')",  // TODO ticket #345 : remplacer par is_granted('core.users.view')
            normalizationContext: ['groups' => ['user:list']],
        ),
        new Post(security: "is_granted('ROLE_ADMIN')", processor: UserPasswordHasherProcessor::class),