refactor(frontend) : ERP-26 - migrate roles table to MalioDataTable component

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/sidebar.php

@@ -8,8 +8,6 @@ declare(strict_types=1);
  * This file defines the sidebar sections displayed in the frontend.
  * Each item references the module that owns it via the `module` key.
  * Items whose module is not active (see config/modules.php) are filtered out.
- * Items may also declare a `permission` key (RBAC permission code) : the item
- * is hidden from users who do not hold that permission.
  *
  * This config is decoupled from the modules themselves: you can freely
  * move an item from one section to another without touching the module code.
@@ -35,18 +33,10 @@ return [
                 'module' => 'core',
             ],
             [
-                'label'      => 'sidebar.core.roles',
+                'label'  => 'sidebar.core.roles',
-                'to'         => '/admin/roles',
+                'to'     => '/admin/roles',
-                'icon'       => 'mdi:shield-account-outline',
+                'icon'   => 'mdi:shield-account-outline',
-                'module'     => 'core',
+                'module' => 'core',
-                'permission' => 'core.roles.view',
-            ],
-            [
-                'label'      => 'sidebar.core.users',
-                'to'         => '/admin/users',
-                'icon'       => 'mdi:account-group-outline',
-                'module'     => 'core',
-                'permission' => 'core.users.view',
             ],
             [
                 'label'  => 'sidebar.general.logout',

config/version.yaml

@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.1.31'
+    app.version: '0.1.29'

frontend/i18n/locales/fr.json

@@ -24,8 +24,7 @@
             "suppliers": "Répertoire fournisseurs"
         },
         "core": {
-            "roles": "Gestion des rôles",
+            "roles": "Gestion des roles"
-            "users": "Utilisateurs"
         }
     },
     "dashboard": {
@@ -63,62 +62,38 @@
     },
     "admin": {
         "roles": {
-            "title": "Gestion des rôles",
+            "title": "Gestion des roles",
-            "newRole": "Nouveau rôle",
+            "newRole": "Nouveau role",
-            "editRole": "Modifier le rôle",
+            "editRole": "Modifier le role",
-            "createRole": "Créer un rôle",
+            "createRole": "Creer un role",
-            "noRoles": "Aucun rôle configuré",
+            "noRoles": "Aucun role configure",
             "table": {
-                "label": "Libellé",
+                "label": "Libelle",
                 "code": "Code",
                 "permissions": "Permissions",
-                "system": "Système"
+                "system": "Systeme",
+                "actions": "Actions"
             },
             "form": {
-                "label": "Libellé",
+                "label": "Libelle",
                 "code": "Code",
                 "description": "Description",
                 "permissions": "Permissions"
             },
             "delete": {
-                "title": "Supprimer le rôle",
+                "title": "Supprimer le role",
-                "message": "Êtes-vous sûr de vouloir supprimer le rôle \"{label}\" ? Cette action est irréversible.",
+                "message": "Etes-vous sur de vouloir supprimer le role \"{label}\" ? Cette action est irreversible.",
-                "systemTooltip": "Rôle système non supprimable"
+                "systemTooltip": "Role systeme non supprimable"
             },
             "toast": {
-                "created": "Rôle créé avec succès",
+                "created": "Role cree avec succes",
-                "updated": "Rôle mis à jour avec succès",
+                "updated": "Role mis a jour avec succes",
-                "deleted": "Rôle supprimé avec succès"
+                "deleted": "Role supprime avec succes"
             },
             "permissions": {
                 "selectAll": "Tout selectionner",
                 "noPermissions": "Aucune permission disponible"
             }
-        },
-        "users": {
-            "title": "Gestion des utilisateurs",
-            "noUsers": "Aucun utilisateur",
-            "table": {
-                "username": "Nom d'utilisateur",
-                "admin": "Administrateur",
-                "roles": "Roles",
-                "directPermissions": "Permissions directes"
-            },
-            "drawer": {
-                "title": "Permissions de {username}",
-                "selfWarning": "Vous modifiez vos propres droits",
-                "adminToggle": "Administrateur (bypass total)",
-                "rolesSection": "Rôles",
-                "directPermissionsSection": "Permissions directes",
-                "summarySection": "Résumé des permissions effectives",
-                "noEffectivePermissions": "Aucune permission effective",
-                "sourceRole": "via {role}",
-                "sourceDirect": "Direct",
-                "lastAdminWarning": "Impossible de retirer le statut administrateur du dernier admin"
-            },
-            "toast": {
-                "updated": "Permissions mises à jour avec succès"
-            }
         }
     }
 }

frontend/modules/core/components/EffectivePermissions.vue

@@ -1,68 +0,0 @@
-<template>
-    <div>
-        <div v-if="permissions.length === 0" class="text-sm text-neutral-400">
-            {{ t('admin.users.drawer.noEffectivePermissions') }}
-        </div>
-        <div v-else class="divide-y divide-neutral-100 rounded-lg border border-neutral-200">
-            <div
-                v-for="perm in groupedPermissions"
-                :key="perm.module"
-                class="px-4 py-2"
-            >
-                <!-- En-tête du module -->
-                <p class="text-xs font-semibold uppercase text-neutral-400 mb-1">
-                    {{ perm.module }}
-                </p>
-                <div
-                    v-for="item in perm.items"
-                    :key="item.code"
-                    class="flex items-center justify-between py-1"
-                >
-                    <span class="text-sm text-neutral-700">{{ item.label }}</span>
-                    <div class="flex gap-1">
-                        <span
-                            v-for="source in item.sources"
-                            :key="source"
-                            :class="[
-                                'inline-flex items-center rounded-full px-2 py-0.5 text-xs font-medium',
-                                source === t('admin.users.drawer.sourceDirect')
-                                    ? 'bg-green-100 text-green-800'
-                                    : 'bg-blue-100 text-blue-800'
-                            ]"
-                        >
-                            {{ source }}
-                        </span>
-                    </div>
-                </div>
-            </div>
-        </div>
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { EffectivePermission } from '~/shared/types/rbac'
-
-const { t } = useI18n()
-
-const props = defineProps<{
-    permissions: EffectivePermission[]
-}>()
-
-// Grouper par module pour l'affichage
-interface PermissionModuleGroup {
-    module: string
-    items: EffectivePermission[]
-}
-
-const groupedPermissions = computed<PermissionModuleGroup[]>(() => {
-    const groups = new Map<string, EffectivePermission[]>()
-    for (const perm of props.permissions) {
-        const list = groups.get(perm.module) || []
-        list.push(perm)
-        groups.set(perm.module, list)
-    }
-    return Array.from(groups.entries())
-        .map(([module, items]) => ({ module, items }))
-        .sort((a, b) => a.module.localeCompare(b.module))
-})
-</script>

frontend/modules/core/components/PermissionGroup.vue

@@ -30,7 +30,13 @@
 </template>
 
 <script setup lang="ts">
-import type { Permission } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
 
 const props = defineProps<{
     module: string

frontend/modules/core/components/RoleDeleteModal.vue

@@ -22,8 +22,6 @@
                         <MalioButton
                             :label="t('common.delete')"
                             variant="danger"
-                            icon-name="mdi:delete-outline"
-                            icon-position="left"
                             :disabled="loading"
                             @click="confirm"
                         />
@@ -57,14 +55,6 @@ function cancel() {
 function confirm() {
     emit('confirm')
 }
-
-// Fermer la modale avec la touche Escape
-function onKeydown(e: KeyboardEvent) {
-    if (e.key === 'Escape') cancel()
-}
-
-onMounted(() => document.addEventListener('keydown', onKeydown))
-onUnmounted(() => document.removeEventListener('keydown', onKeydown))
 </script>
 
 <style scoped>

frontend/modules/core/components/RoleDrawer.vue

@@ -19,7 +19,8 @@
                 :label="t('admin.roles.form.code')"
                 input-class="w-full"
                 required
-                :readonly="isEditMode"
+                :readonly="isEditMode && role?.isSystem"
+                :hint="isEditMode && role?.isSystem ? t('admin.roles.delete.systemTooltip') : ''"
             />
 
             <MalioInputTextArea
@@ -53,18 +54,8 @@
             <!-- Boutons -->
             <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
                 <MalioButton
-                    v-if="isEditMode"
-                    :label="t('common.delete')"
-                    variant="danger"
-                    icon-name="mdi:delete-outline"
-                    icon-position="left"
-                    :disabled="role?.isSystem"
-                    @click="emit('delete')"
-                />
-                <MalioButton
-                    v-else
                     :label="t('common.cancel')"
-                    variant="tertiary"
+                    variant="secondary"
                     @click="emit('update:modelValue', false)"
                 />
                 <MalioButton
@@ -79,7 +70,22 @@
 </template>
 
 <script setup lang="ts">
-import type { Permission, Role } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
 
 interface PermissionModule {
     module: string
@@ -97,7 +103,6 @@ const props = defineProps<{
 const emit = defineEmits<{
     'update:modelValue': [value: boolean]
     saved: []
-    delete: []
 }>()
 
 const saving = ref(false)
@@ -131,7 +136,7 @@ const permissionsByModule = computed<PermissionModule[]>(() => {
 async function loadPermissions() {
     const data = await api.get<{ member: Permission[] }>(
         '/permissions',
-        { 'orphan': false, itemsPerPage: 999 },
+        { 'orphan': false, itemsPerPage: 200 },
         { toast: false },
     )
     allPermissions.value = data.member
@@ -193,24 +198,19 @@ function handleToggleAll(module: string, selected: boolean) {
 async function handleSave() {
     saving.value = true
     try {
-        const permissions = Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`)
+        const body = {
+            label: form.value.label,
+            code: form.value.code,
+            description: form.value.description || null,
+            permissions: Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`),
+        }
 
         if (isEditMode.value && props.role) {
-            // Le code est immuable apres creation (garde backend RoleProcessor)
+            await api.patch(`/roles/${props.role.id}`, body, {
-            await api.patch(`/roles/${props.role.id}`, {
-                label: form.value.label,
-                description: form.value.description || null,
-                permissions,
-            }, {
                 toastSuccessMessage: t('admin.roles.toast.updated'),
             })
         } else {
-            await api.post('/roles', {
+            await api.post('/roles', body, {
-                label: form.value.label,
-                code: form.value.code,
-                description: form.value.description || null,
-                permissions,
-            }, {
                 toastSuccessMessage: t('admin.roles.toast.created'),
             })
         }

frontend/modules/core/components/UserRbacDrawer.vue

@@ -1,259 +0,0 @@
-<template>
-    <MalioDrawer
-        :model-value="modelValue"
-        :title="t('admin.users.drawer.title', { username: user?.username ?? '' })"
-        drawer-class="w-full max-w-lg"
-        @update:model-value="emit('update:modelValue', $event)"
-    >
-        <div class="flex flex-col gap-6 p-4">
-            <!-- Avertissement auto-edition -->
-            <div
-                v-if="isSelfEdit"
-                class="flex items-center gap-2 rounded-lg border border-yellow-300 bg-yellow-50 px-4 py-3 text-sm text-yellow-800"
-            >
-                <Icon name="mdi:alert-outline" class="size-5 shrink-0" />
-                {{ t('admin.users.drawer.selfWarning') }}
-            </div>
-
-            <!-- Toggle Administrateur -->
-            <MalioCheckbox
-                id="admin-toggle"
-                :label="t('admin.users.drawer.adminToggle')"
-                :model-value="form.isAdmin"
-                label-class="font-semibold text-sm text-neutral-700"
-                @update:model-value="form.isAdmin = $event"
-            />
-
-            <!-- Section Roles -->
-            <div>
-                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
-                    {{ t('admin.users.drawer.rolesSection') }}
-                </h4>
-                <div class="flex flex-col gap-2">
-                    <MalioCheckbox
-                        v-for="role in allRoles"
-                        :key="role.id"
-                        :id="`role-${role.id}`"
-                        :label="role.label"
-                        :model-value="selectedRoleIds.has(role.id)"
-                        label-class="text-sm text-neutral-600"
-                        @update:model-value="(val: boolean) => toggleRole(role.id, val)"
-                    />
-                </div>
-            </div>
-
-            <!-- Section Permissions directes -->
-            <div>
-                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
-                    {{ t('admin.users.drawer.directPermissionsSection') }}
-                </h4>
-                <div v-if="permissionsByModule.length === 0" class="text-sm text-neutral-400">
-                    {{ t('admin.roles.permissions.noPermissions') }}
-                </div>
-                <div class="flex flex-col gap-4">
-                    <PermissionGroup
-                        v-for="group in permissionsByModule"
-                        :key="group.module"
-                        :module="group.module"
-                        :module-label="group.module"
-                        :permissions="group.permissions"
-                        :selected-ids="selectedDirectPermissionIds"
-                        @toggle="handleTogglePermission"
-                        @toggle-all="handleToggleAll"
-                    />
-                </div>
-            </div>
-
-            <!-- Section Resume permissions effectives -->
-            <div>
-                <h4 class="mb-3 text-sm font-semibold text-neutral-700">
-                    {{ t('admin.users.drawer.summarySection') }}
-                </h4>
-                <EffectivePermissions :permissions="effectivePermissions" />
-            </div>
-
-            <!-- Boutons -->
-            <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
-                <MalioButton
-                    :label="t('common.cancel')"
-                    variant="tertiary"
-                    @click="emit('update:modelValue', false)"
-                />
-                <MalioButton
-                    :label="t('common.save')"
-                    variant="primary"
-                    :disabled="saving"
-                    @click="handleSave"
-                />
-            </div>
-        </div>
-    </MalioDrawer>
-</template>
-
-<script setup lang="ts">
-import type { Permission, Role, UserListItem, EffectivePermission } from '~/shared/types/rbac'
-
-interface PermissionModule {
-    module: string
-    permissions: Permission[]
-}
-
-const { t } = useI18n()
-const api = useApi()
-const auth = useAuthStore()
-
-const props = defineProps<{
-    modelValue: boolean
-    user: UserListItem | null
-}>()
-
-const emit = defineEmits<{
-    'update:modelValue': [value: boolean]
-    saved: []
-}>()
-
-const saving = ref(false)
-const allRoles = ref<Role[]>([])
-const allPermissions = ref<Permission[]>([])
-
-const form = ref({ isAdmin: false })
-const selectedRoleIds = ref(new Set<number>())
-const selectedDirectPermissionIds = ref(new Set<number>())
-
-// Detecter l'auto-edition
-const isSelfEdit = computed(() => props.user?.id === auth.user?.id)
-
-// Extraire un ID depuis une IRI API Platform
-function iriToId(iri: string): number {
-    return Number(iri.split('/').pop())
-}
-
-// Grouper les permissions par module (pour les checkboxes)
-const permissionsByModule = computed<PermissionModule[]>(() => {
-    const groups = new Map<string, Permission[]>()
-    for (const perm of allPermissions.value) {
-        if (perm.orphan) continue
-        const list = groups.get(perm.module) || []
-        list.push(perm)
-        groups.set(perm.module, list)
-    }
-    return Array.from(groups.entries())
-        .map(([module, permissions]) => ({ module, permissions }))
-        .sort((a, b) => a.module.localeCompare(b.module))
-})
-
-// Calculer les permissions effectives avec leurs sources
-const effectivePermissions = computed<EffectivePermission[]>(() => {
-    const permMap = new Map<number, Permission>()
-    for (const p of allPermissions.value) {
-        if (!p.orphan) permMap.set(p.id, p)
-    }
-
-    // Construire la map permissionId -> sources[]
-    const result = new Map<number, string[]>()
-
-    // Permissions heritees des roles
-    for (const roleId of selectedRoleIds.value) {
-        const role = allRoles.value.find(r => r.id === roleId)
-        if (!role) continue
-        for (const p of role.permissions) {
-            const pid = typeof p === 'string' ? iriToId(p) : p.id
-            const sources = result.get(pid) || []
-            sources.push(t('admin.users.drawer.sourceRole', { role: role.label }))
-            result.set(pid, sources)
-        }
-    }
-
-    // Permissions directes
-    for (const pid of selectedDirectPermissionIds.value) {
-        const sources = result.get(pid) || []
-        sources.push(t('admin.users.drawer.sourceDirect'))
-        result.set(pid, sources)
-    }
-
-    // Construire la liste finale
-    return Array.from(result.entries())
-        .map(([pid, sources]) => {
-            const perm = permMap.get(pid)
-            if (!perm) return null
-            return { code: perm.code, label: perm.label, module: perm.module, sources }
-        })
-        .filter((p): p is EffectivePermission => p !== null)
-        .sort((a, b) => a.code.localeCompare(b.code))
-})
-
-// Charger roles et permissions
-async function loadData() {
-    const [rolesData, permsData] = await Promise.all([
-        api.get<{ member: Role[] }>('/roles', {}, { toast: false }),
-        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 999 }, { toast: false }),
-    ])
-    allRoles.value = rolesData.member
-    allPermissions.value = permsData.member
-}
-
-// Remplir le formulaire quand le user change
-watch(() => props.user, (user) => {
-    if (user) {
-        form.value.isAdmin = user.isAdmin
-        selectedRoleIds.value = new Set(user.roles.map(iriToId))
-        selectedDirectPermissionIds.value = new Set(user.directPermissions.map(iriToId))
-    } else {
-        form.value.isAdmin = false
-        selectedRoleIds.value = new Set()
-        selectedDirectPermissionIds.value = new Set()
-    }
-}, { immediate: true })
-
-// Charger les donnees quand le drawer s'ouvre
-watch(() => props.modelValue, (open) => {
-    if (open) loadData()
-})
-
-function toggleRole(id: number, selected: boolean) {
-    const ids = new Set(selectedRoleIds.value)
-    if (selected) ids.add(id)
-    else ids.delete(id)
-    selectedRoleIds.value = ids
-}
-
-function handleTogglePermission(id: number, selected: boolean) {
-    const ids = new Set(selectedDirectPermissionIds.value)
-    if (selected) ids.add(id)
-    else ids.delete(id)
-    selectedDirectPermissionIds.value = ids
-}
-
-function handleToggleAll(module: string, selected: boolean) {
-    const ids = new Set(selectedDirectPermissionIds.value)
-    const group = permissionsByModule.value.find(g => g.module === module)
-    if (!group) return
-    for (const perm of group.permissions) {
-        if (selected) ids.add(perm.id)
-        else ids.delete(perm.id)
-    }
-    selectedDirectPermissionIds.value = ids
-}
-
-async function handleSave() {
-    if (!props.user) return
-    saving.value = true
-    try {
-        await api.patch(`/users/${props.user.id}/rbac`, {
-            isAdmin: form.value.isAdmin,
-            roles: Array.from(selectedRoleIds.value).map(id => `/api/roles/${id}`),
-            directPermissions: Array.from(selectedDirectPermissionIds.value).map(id => `/api/permissions/${id}`),
-        }, {
-            toastSuccessMessage: t('admin.users.toast.updated'),
-        })
-        // Rafraichir les donnees du user courant si auto-edition
-        if (isSelfEdit.value) {
-            await auth.refreshUser()
-        }
-        emit('saved')
-        emit('update:modelValue', false)
-    } finally {
-        saving.value = false
-    }
-}
-</script>

frontend/modules/core/pages/admin/roles.vue

@@ -9,7 +9,6 @@
                 v-if="can('core.roles.manage')"
                 :label="t('admin.roles.newRole')"
                 icon-name="mdi:plus"
-                icon-position="left"
                 @click="openCreateDrawer"
             />
         </div>
@@ -20,7 +19,7 @@
             :columns="columns"
             :items="roleItems"
             :total-items="roles.length"
-            :row-clickable="canManage"
+            :row-clickable="true"
             :empty-message="t('admin.roles.noRoles')"
             @row-click="onRowClick"
         >
@@ -38,6 +37,25 @@
                     {{ t('admin.roles.table.system') }}
                 </span>
             </template>
+            <template #cell-actions="{ item }">
+                <div class="flex items-center justify-end gap-2" @click.stop>
+                    <MalioButtonIcon
+                        v-if="can('core.roles.manage')"
+                        icon="mdi:pencil-outline"
+                        :aria-label="t('common.edit')"
+                        variant="ghost"
+                        @click="openEditDrawer(getRoleById(item.id as number)!)"
+                    />
+                    <MalioButtonIcon
+                        v-if="can('core.roles.manage')"
+                        icon="mdi:delete-outline"
+                        :aria-label="t('common.delete')"
+                        variant="ghost"
+                        :disabled="item.isSystem as boolean"
+                        @click="confirmDelete(getRoleById(item.id as number)!)"
+                    />
+                </div>
+            </template>
         </MalioDataTable>
 
         <!-- Drawer creation/edition -->
@@ -45,7 +63,6 @@
             v-model="drawerOpen"
             :role="selectedRole"
             @saved="onRoleSaved"
-            @delete="onDeleteRequest"
         />
 
         <!-- Modale de suppression -->
@@ -59,12 +76,26 @@
 </template>
 
 <script setup lang="ts">
-import type { Role } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
 
 const { t } = useI18n()
 const api = useApi()
 const { can } = usePermissions()
-const canManage = computed(() => can('core.roles.manage'))
 
 useHead({ title: t('admin.roles.title') })
 
@@ -76,6 +107,7 @@ const columns = [
     { key: 'code', label: t('admin.roles.table.code') },
     { key: 'permissions', label: t('admin.roles.table.permissions') },
     { key: 'system', label: t('admin.roles.table.system') },
+    { key: 'actions', label: t('admin.roles.table.actions') },
 ]
 
 // Transformer les roles en items compatibles MalioDataTable
@@ -87,6 +119,7 @@ const roleItems = computed(() =>
         permissions: role.permissions.length,
         isSystem: role.isSystem,
         system: '', // colonne geree par le slot
+        actions: '', // colonne geree par le slot
     }))
 )
 
@@ -129,9 +162,9 @@ function openEditDrawer(role: Role) {
     drawerOpen.value = true
 }
 
-function onDeleteRequest() {
+function confirmDelete(role: Role) {
-    if (!selectedRole.value || selectedRole.value.isSystem) return
+    if (role.isSystem) return
-    roleToDelete.value = selectedRole.value
+    roleToDelete.value = role
     deleteModalOpen.value = true
 }
 
@@ -144,7 +177,6 @@ async function handleDelete() {
         })
         deleteModalOpen.value = false
         roleToDelete.value = null
-        drawerOpen.value = false
         await loadRoles()
     } finally {
         deleting.value = false

frontend/modules/core/pages/admin/users.vue

@@ -1,107 +0,0 @@
-<template>
-    <div>
-        <!-- En-tete -->
-        <div class="flex items-center justify-between">
-            <h1 class="text-xl font-bold text-primary-500 sm:text-2xl">
-                {{ t('admin.users.title') }}
-            </h1>
-        </div>
-
-        <!-- Table des utilisateurs -->
-        <MalioDataTable
-            class="mt-6"
-            :columns="columns"
-            :items="userItems"
-            :total-items="users.length"
-            :row-clickable="canManage"
-            :empty-message="t('admin.users.noUsers')"
-            @row-click="onRowClick"
-        >
-            <template #cell-admin="{ item }">
-                <span
-                    v-if="item.admin"
-                    class="inline-flex items-center rounded-full bg-purple-100 px-2.5 py-0.5 text-xs font-medium text-purple-800"
-                >
-                    {{ t('admin.users.table.admin') }}
-                </span>
-            </template>
-        </MalioDataTable>
-
-        <!-- Drawer RBAC -->
-        <UserRbacDrawer
-            v-model="drawerOpen"
-            :user="selectedUser"
-            @saved="onUserSaved"
-        />
-    </div>
-</template>
-
-<script setup lang="ts">
-import type { UserListItem } from '~/shared/types/rbac'
-
-const { t } = useI18n()
-const api = useApi()
-const { can } = usePermissions()
-
-useHead({ title: t('admin.users.title') })
-
-const canManage = computed(() => can('core.users.manage'))
-
-const users = ref<UserListItem[]>([])
-const loading = ref(false)
-const drawerOpen = ref(false)
-const selectedUser = ref<UserListItem | null>(null)
-
-const columns = [
-    { key: 'username', label: t('admin.users.table.username') },
-    { key: 'admin', label: t('admin.users.table.admin') },
-    { key: 'roles', label: t('admin.users.table.roles') },
-    { key: 'directPermissions', label: t('admin.users.table.directPermissions') },
-]
-
-const userItems = computed(() =>
-    users.value.map(user => ({
-        id: user.id,
-        username: user.username,
-        admin: user.isAdmin,
-        roles: user.roles.length,
-        directPermissions: user.directPermissions.length,
-    }))
-)
-
-async function loadUsers() {
-    loading.value = true
-    try {
-        const data = await api.get<{ member: UserListItem[] }>(
-            '/users',
-            {},
-            { toast: false },
-        )
-        users.value = data.member
-    } finally {
-        loading.value = false
-    }
-}
-
-function getUserById(id: number): UserListItem | undefined {
-    return users.value.find(u => u.id === id)
-}
-
-function openDrawer(user: UserListItem) {
-    selectedUser.value = user
-    drawerOpen.value = true
-}
-
-function onRowClick(item: Record<string, unknown>) {
-    const user = getUserById(item.id as number)
-    if (user) openDrawer(user)
-}
-
-function onUserSaved() {
-    loadUsers()
-}
-
-onMounted(() => {
-    loadUsers()
-})
-</script>

frontend/shared/types/rbac.ts

@@ -1,31 +0,0 @@
-export interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-export interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
-
-export interface UserListItem {
-    id: number
-    username: string
-    isAdmin: boolean
-    roles: string[]
-    directPermissions: string[]
-}
-
-export interface EffectivePermission {
-    code: string
-    label: string
-    module: string
-    sources: string[]
-}

makefile

@@ -38,7 +38,7 @@ restart: env-init
 	$(DOCKER_COMPOSE) down
 	CURRENT_UID=$(shell id -u) CURRENT_GID=$(shell id -g) $(DOCKER_COMPOSE) up -d
 
-install: copy-git-hook composer-install cache-clear node-use build-nuxtJS migration-migrate test-db-setup
+install: copy-git-hook composer-install cache-clear node-use build-nuxtJS migration-migrate
 
 # Supprime tout est réinstalle tout (Attention ça supprime la bdd aussi)
 reset: delete_built_dir remove_orphans build-without-cache start wait install
@@ -83,15 +83,6 @@ build-without-cache:
 migration-migrate:
 	$(SYMFONY_CONSOLE) doctrine:migrations:migrate --no-interaction
 
-# Cree et initialise la base de test utilisee par PHPUnit
-# (le suffixe "_test" est applique automatiquement par Doctrine en APP_ENV=test)
-# Ordre : fixtures -> sync-permissions, car fixtures:load purge la table permission
-test-db-setup:
-	$(SYMFONY_CONSOLE) doctrine:database:create --env=test --if-not-exists
-	$(SYMFONY_CONSOLE) doctrine:migrations:migrate --env=test --no-interaction
-	$(SYMFONY_CONSOLE) --env=test --no-interaction doctrine:fixtures:load
-	$(SYMFONY_CONSOLE) --env=test --no-interaction app:sync-permissions
-
 fixtures:
 	$(SYMFONY_CONSOLE) --no-interaction doctrine:fixtures:load
 
@@ -109,7 +100,6 @@ db-reset:
 	$(MAKE) migration-migrate
 	$(MAKE) fixtures
 	$(MAKE) sync-permissions
-	$(MAKE) test-db-setup
 
 # Restart la bdd
 db-restart:

src/Module/Core/CoreModule.php

@@ -34,6 +34,7 @@ final class CoreModule
             ['code' => 'core.users.manage', 'label' => 'Gerer les utilisateurs (creer, editer, supprimer)'],
             ['code' => 'core.roles.view', 'label' => 'Voir les roles RBAC'],
             ['code' => 'core.roles.manage', 'label' => 'Gerer les roles et permissions'],
+            ['code' => 'core.permissions.view', 'label' => 'Voir le catalogue des permissions'],
         ];
     }
 }

src/Module/Core/Domain/Entity/Permission.php

@@ -19,11 +19,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
     operations: [
         new GetCollection(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('core.permissions.view')",
         ),
         new Get(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('core.permissions.view')",
         ),
     ],
 )]

src/Module/Core/Domain/Security/AdminHeadcountGuard.php

@@ -53,13 +53,6 @@ final class AdminHeadcountGuard implements AdminHeadcountGuardInterface
      * La verification est volontairement conservative (<=1) pour couvrir
      * le cas defensif ou la base serait deja dans un etat incoherent (0 admin).
      *
-     * TOCTOU accepte : la verification n'utilise pas de verrou pessimiste
-     * (SELECT ... FOR UPDATE). Deux demotions concurrentes pourraient donc
-     * passer le garde simultanement. Ce risque est accepte dans le contexte
-     * PME/CRM ou les operations d'administration sont rares et mono-operateur.
-     * Si la concurrence admin devient un enjeu, ajouter un verrou pessimiste
-     * sur countAdmins() ou une contrainte CHECK en base.
-     *
      * @throws LastAdminProtectionException si le nombre d'admins est inferieur ou egal a 1
      */
     private function checkAdminHeadcount(): void

src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php

@@ -7,7 +7,6 @@ namespace App\Shared\Infrastructure\ApiPlatform\State;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\State\ProviderInterface;
 use App\Shared\Infrastructure\ApiPlatform\Resource\SidebarResource;
-use Symfony\Bundle\SecurityBundle\Security;
 
 /**
  * @implements ProviderInterface<object>
@@ -17,10 +16,10 @@ class SidebarProvider implements ProviderInterface
     /** @var list<string> */
     private readonly array $activeModuleIds;
 
-    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string, permission?: string}>}> */
+    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string}>}> */
     private readonly array $sidebarConfig;
 
-    public function __construct(private readonly Security $security)
+    public function __construct()
     {
         $configDir = dirname(__DIR__, 5).'/config';
 
@@ -59,18 +58,6 @@ class SidebarProvider implements ProviderInterface
                     continue;
                 }
 
-                // Filtrage par permission RBAC : si l'item declare une permission
-                // requise et que l'utilisateur courant ne la possede pas, l'item
-                // est masque et sa route ajoutee aux routes desactivees.
-                $requiredPermission = $item['permission'] ?? null;
-                if (null !== $requiredPermission && !$this->security->isGranted($requiredPermission)) {
-                    if (isset($item['to'])) {
-                        $disabledRoutes[] = $item['to'];
-                    }
-
-                    continue;
-                }
-
                 $items[] = [
                     'label' => $item['label'],
                     'to'    => $item['to'],

tests/Module/Core/Api/PermissionApiTest.php

@@ -166,16 +166,51 @@ final class PermissionApiTest extends AbstractApiTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testStandardUserCanListPermissions(): void
+    public function testNonAdminReturns403(): void
     {
-        // Le catalogue de permissions est accessible a tout utilisateur authentifie.
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions');
 
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    // --- Tests voter RBAC : non-admin avec / sans permission ---
+
+    public function testListPermissionsAsUserWithViewPermissionReturns200(): void
+    {
+        // Un non-admin portant core.permissions.view doit pouvoir lister.
+        $credentials = $this->createUserWithPermission('core.permissions.view');
+        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
+        $client->request('GET', '/api/permissions');
+
         self::assertResponseIsSuccessful();
     }
 
-    public function testStandardUserCanGetPermission(): void
+    public function testListPermissionsAsStandardUserReturns403(): void
+    {
+        // alice n'a aucune permission RBAC : acces refuse.
+        $client = $this->authenticatedClient('alice', 'alice');
+        $client->request('GET', '/api/permissions');
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testGetPermissionAsUserWithViewPermissionReturns200(): void
+    {
+        // Recupere l'id d'une permission existante pour construire l'URL GET item.
+        $permission = $this->getEm()->getRepository(Permission::class)
+            ->findOneBy(['code' => 'test.core.users.view'])
+        ;
+        self::assertNotNull($permission);
+
+        $credentials = $this->createUserWithPermission('core.permissions.view');
+        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
+        $client->request('GET', '/api/permissions/'.$permission->getId());
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testGetPermissionAsStandardUserReturns403(): void
     {
         $permission = $this->getEm()->getRepository(Permission::class)
             ->findOneBy(['code' => 'test.core.users.view'])
@@ -185,7 +220,7 @@ final class PermissionApiTest extends AbstractApiTestCase
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions/'.$permission->getId());
 
-        self::assertResponseIsSuccessful();
+        self::assertResponseStatusCodeSame(403);
     }
 
     private function cleanupTestPermissions(): void