feat(frontend) : ERP-27 - admin users page with DataTable and RBAC drawer

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

config/sidebar.php

@@ -8,8 +8,6 @@ declare(strict_types=1);
  * This file defines the sidebar sections displayed in the frontend.
  * Each item references the module that owns it via the `module` key.
  * Items whose module is not active (see config/modules.php) are filtered out.
- * Items may also declare a `permission` key (RBAC permission code) : the item
- * is hidden from users who do not hold that permission.
  *
  * This config is decoupled from the modules themselves: you can freely
  * move an item from one section to another without touching the module code.
@@ -35,18 +33,16 @@ return [
                 'module' => 'core',
             ],
             [
-                'label'      => 'sidebar.core.roles',
+                'label'  => 'sidebar.core.roles',
-                'to'         => '/admin/roles',
+                'to'     => '/admin/roles',
-                'icon'       => 'mdi:shield-account-outline',
+                'icon'   => 'mdi:shield-account-outline',
-                'module'     => 'core',
+                'module' => 'core',
-                'permission' => 'core.roles.view',
             ],
             [
-                'label'      => 'sidebar.core.users',
+                'label'  => 'sidebar.core.users',
-                'to'         => '/admin/users',
+                'to'     => '/admin/users',
-                'icon'       => 'mdi:account-group-outline',
+                'icon'   => 'mdi:account-group-outline',
-                'module'     => 'core',
+                'module' => 'core',
-                'permission' => 'core.users.view',
             ],
             [
                 'label'  => 'sidebar.general.logout',

config/version.yaml

@@ -1,2 +1,2 @@
 parameters:
-    app.version: '0.1.31'
+    app.version: '0.1.29'

frontend/i18n/locales/fr.json

@@ -24,7 +24,7 @@
             "suppliers": "Répertoire fournisseurs"
         },
         "core": {
-            "roles": "Gestion des rôles",
+            "roles": "Gestion des roles",
             "users": "Utilisateurs"
         }
     },
@@ -63,32 +63,33 @@
     },
     "admin": {
         "roles": {
-            "title": "Gestion des rôles",
+            "title": "Gestion des roles",
-            "newRole": "Nouveau rôle",
+            "newRole": "Nouveau role",
-            "editRole": "Modifier le rôle",
+            "editRole": "Modifier le role",
-            "createRole": "Créer un rôle",
+            "createRole": "Creer un role",
-            "noRoles": "Aucun rôle configuré",
+            "noRoles": "Aucun role configure",
             "table": {
-                "label": "Libellé",
+                "label": "Libelle",
                 "code": "Code",
                 "permissions": "Permissions",
-                "system": "Système"
+                "system": "Systeme",
+                "actions": "Actions"
             },
             "form": {
-                "label": "Libellé",
+                "label": "Libelle",
                 "code": "Code",
                 "description": "Description",
                 "permissions": "Permissions"
             },
             "delete": {
-                "title": "Supprimer le rôle",
+                "title": "Supprimer le role",
-                "message": "Êtes-vous sûr de vouloir supprimer le rôle \"{label}\" ? Cette action est irréversible.",
+                "message": "Etes-vous sur de vouloir supprimer le role \"{label}\" ? Cette action est irreversible.",
-                "systemTooltip": "Rôle système non supprimable"
+                "systemTooltip": "Role systeme non supprimable"
             },
             "toast": {
-                "created": "Rôle créé avec succès",
+                "created": "Role cree avec succes",
-                "updated": "Rôle mis à jour avec succès",
+                "updated": "Role mis a jour avec succes",
-                "deleted": "Rôle supprimé avec succès"
+                "deleted": "Role supprime avec succes"
             },
             "permissions": {
                 "selectAll": "Tout selectionner",
@@ -102,22 +103,23 @@
                 "username": "Nom d'utilisateur",
                 "admin": "Administrateur",
                 "roles": "Roles",
-                "directPermissions": "Permissions directes"
+                "directPermissions": "Permissions directes",
+                "actions": "Actions"
             },
             "drawer": {
                 "title": "Permissions de {username}",
                 "selfWarning": "Vous modifiez vos propres droits",
                 "adminToggle": "Administrateur (bypass total)",
-                "rolesSection": "Rôles",
+                "rolesSection": "Roles",
                 "directPermissionsSection": "Permissions directes",
-                "summarySection": "Résumé des permissions effectives",
+                "summarySection": "Resume des permissions effectives",
                 "noEffectivePermissions": "Aucune permission effective",
                 "sourceRole": "via {role}",
                 "sourceDirect": "Direct",
                 "lastAdminWarning": "Impossible de retirer le statut administrateur du dernier admin"
             },
             "toast": {
-                "updated": "Permissions mises à jour avec succès"
+                "updated": "Permissions mises a jour avec succes"
             }
         }
     }

frontend/modules/core/components/EffectivePermissions.vue

@@ -40,10 +40,15 @@
 </template>
 
 <script setup lang="ts">
-import type { EffectivePermission } from '~/shared/types/rbac'
-
 const { t } = useI18n()
 
+interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
+
 const props = defineProps<{
     permissions: EffectivePermission[]
 }>()

frontend/modules/core/components/PermissionGroup.vue

@@ -30,7 +30,13 @@
 </template>
 
 <script setup lang="ts">
-import type { Permission } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
 
 const props = defineProps<{
     module: string

frontend/modules/core/components/RoleDeleteModal.vue

@@ -22,8 +22,6 @@
                         <MalioButton
                             :label="t('common.delete')"
                             variant="danger"
-                            icon-name="mdi:delete-outline"
-                            icon-position="left"
                             :disabled="loading"
                             @click="confirm"
                         />
@@ -57,14 +55,6 @@ function cancel() {
 function confirm() {
     emit('confirm')
 }
-
-// Fermer la modale avec la touche Escape
-function onKeydown(e: KeyboardEvent) {
-    if (e.key === 'Escape') cancel()
-}
-
-onMounted(() => document.addEventListener('keydown', onKeydown))
-onUnmounted(() => document.removeEventListener('keydown', onKeydown))
 </script>
 
 <style scoped>

frontend/modules/core/components/RoleDrawer.vue

@@ -19,7 +19,8 @@
                 :label="t('admin.roles.form.code')"
                 input-class="w-full"
                 required
-                :readonly="isEditMode"
+                :readonly="isEditMode && role?.isSystem"
+                :hint="isEditMode && role?.isSystem ? t('admin.roles.delete.systemTooltip') : ''"
             />
 
             <MalioInputTextArea
@@ -53,18 +54,8 @@
             <!-- Boutons -->
             <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
                 <MalioButton
-                    v-if="isEditMode"
-                    :label="t('common.delete')"
-                    variant="danger"
-                    icon-name="mdi:delete-outline"
-                    icon-position="left"
-                    :disabled="role?.isSystem"
-                    @click="emit('delete')"
-                />
-                <MalioButton
-                    v-else
                     :label="t('common.cancel')"
-                    variant="tertiary"
+                    variant="secondary"
                     @click="emit('update:modelValue', false)"
                 />
                 <MalioButton
@@ -79,7 +70,22 @@
 </template>
 
 <script setup lang="ts">
-import type { Permission, Role } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
 
 interface PermissionModule {
     module: string
@@ -97,7 +103,6 @@ const props = defineProps<{
 const emit = defineEmits<{
     'update:modelValue': [value: boolean]
     saved: []
-    delete: []
 }>()
 
 const saving = ref(false)
@@ -131,7 +136,7 @@ const permissionsByModule = computed<PermissionModule[]>(() => {
 async function loadPermissions() {
     const data = await api.get<{ member: Permission[] }>(
         '/permissions',
-        { 'orphan': false, itemsPerPage: 999 },
+        { 'orphan': false, itemsPerPage: 200 },
         { toast: false },
     )
     allPermissions.value = data.member
@@ -193,24 +198,19 @@ function handleToggleAll(module: string, selected: boolean) {
 async function handleSave() {
     saving.value = true
     try {
-        const permissions = Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`)
+        const body = {
+            label: form.value.label,
+            code: form.value.code,
+            description: form.value.description || null,
+            permissions: Array.from(selectedPermissionIds.value).map(id => `/api/permissions/${id}`),
+        }
 
         if (isEditMode.value && props.role) {
-            // Le code est immuable apres creation (garde backend RoleProcessor)
+            await api.patch(`/roles/${props.role.id}`, body, {
-            await api.patch(`/roles/${props.role.id}`, {
-                label: form.value.label,
-                description: form.value.description || null,
-                permissions,
-            }, {
                 toastSuccessMessage: t('admin.roles.toast.updated'),
             })
         } else {
-            await api.post('/roles', {
+            await api.post('/roles', body, {
-                label: form.value.label,
-                code: form.value.code,
-                description: form.value.description || null,
-                permissions,
-            }, {
                 toastSuccessMessage: t('admin.roles.toast.created'),
             })
         }

frontend/modules/core/components/UserRbacDrawer.vue

@@ -76,7 +76,7 @@
             <div class="flex justify-end gap-3 border-t border-neutral-200 pt-4">
                 <MalioButton
                     :label="t('common.cancel')"
-                    variant="tertiary"
+                    variant="secondary"
                     @click="emit('update:modelValue', false)"
                 />
                 <MalioButton
@@ -91,7 +91,37 @@
 </template>
 
 <script setup lang="ts">
-import type { Permission, Role, UserListItem, EffectivePermission } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
+
+interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
+
+interface EffectivePermission {
+    code: string
+    label: string
+    module: string
+    sources: string[]
+}
 
 interface PermissionModule {
     module: string
@@ -186,7 +216,7 @@ const effectivePermissions = computed<EffectivePermission[]>(() => {
 async function loadData() {
     const [rolesData, permsData] = await Promise.all([
         api.get<{ member: Role[] }>('/roles', {}, { toast: false }),
-        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 999 }, { toast: false }),
+        api.get<{ member: Permission[] }>('/permissions', { orphan: false, itemsPerPage: 200 }, { toast: false }),
     ])
     allRoles.value = rolesData.member
     allPermissions.value = permsData.member
@@ -246,10 +276,6 @@ async function handleSave() {
         }, {
             toastSuccessMessage: t('admin.users.toast.updated'),
         })
-        // Rafraichir les donnees du user courant si auto-edition
-        if (isSelfEdit.value) {
-            await auth.refreshUser()
-        }
         emit('saved')
         emit('update:modelValue', false)
     } finally {

frontend/modules/core/pages/admin/roles.vue

@@ -9,7 +9,6 @@
                 v-if="can('core.roles.manage')"
                 :label="t('admin.roles.newRole')"
                 icon-name="mdi:plus"
-                icon-position="left"
                 @click="openCreateDrawer"
             />
         </div>
@@ -20,7 +19,7 @@
             :columns="columns"
             :items="roleItems"
             :total-items="roles.length"
-            :row-clickable="canManage"
+            :row-clickable="true"
             :empty-message="t('admin.roles.noRoles')"
             @row-click="onRowClick"
         >
@@ -38,6 +37,25 @@
                     {{ t('admin.roles.table.system') }}
                 </span>
             </template>
+            <template #cell-actions="{ item }">
+                <div class="flex items-center justify-end gap-2" @click.stop>
+                    <MalioButtonIcon
+                        v-if="can('core.roles.manage')"
+                        icon="mdi:pencil-outline"
+                        :aria-label="t('common.edit')"
+                        variant="ghost"
+                        @click="openEditDrawer(getRoleById(item.id as number)!)"
+                    />
+                    <MalioButtonIcon
+                        v-if="can('core.roles.manage')"
+                        icon="mdi:delete-outline"
+                        :aria-label="t('common.delete')"
+                        variant="ghost"
+                        :disabled="item.isSystem as boolean"
+                        @click="confirmDelete(getRoleById(item.id as number)!)"
+                    />
+                </div>
+            </template>
         </MalioDataTable>
 
         <!-- Drawer creation/edition -->
@@ -45,7 +63,6 @@
             v-model="drawerOpen"
             :role="selectedRole"
             @saved="onRoleSaved"
-            @delete="onDeleteRequest"
         />
 
         <!-- Modale de suppression -->
@@ -59,12 +76,26 @@
 </template>
 
 <script setup lang="ts">
-import type { Role } from '~/shared/types/rbac'
+interface Permission {
+    id: number
+    code: string
+    label: string
+    module: string
+    orphan: boolean
+}
+
+interface Role {
+    id: number
+    code: string
+    label: string
+    description: string | null
+    isSystem: boolean
+    permissions: (Permission | string)[]
+}
 
 const { t } = useI18n()
 const api = useApi()
 const { can } = usePermissions()
-const canManage = computed(() => can('core.roles.manage'))
 
 useHead({ title: t('admin.roles.title') })
 
@@ -76,6 +107,7 @@ const columns = [
     { key: 'code', label: t('admin.roles.table.code') },
     { key: 'permissions', label: t('admin.roles.table.permissions') },
     { key: 'system', label: t('admin.roles.table.system') },
+    { key: 'actions', label: t('admin.roles.table.actions') },
 ]
 
 // Transformer les roles en items compatibles MalioDataTable
@@ -87,6 +119,7 @@ const roleItems = computed(() =>
         permissions: role.permissions.length,
         isSystem: role.isSystem,
         system: '', // colonne geree par le slot
+        actions: '', // colonne geree par le slot
     }))
 )
 
@@ -129,9 +162,9 @@ function openEditDrawer(role: Role) {
     drawerOpen.value = true
 }
 
-function onDeleteRequest() {
+function confirmDelete(role: Role) {
-    if (!selectedRole.value || selectedRole.value.isSystem) return
+    if (role.isSystem) return
-    roleToDelete.value = selectedRole.value
+    roleToDelete.value = role
     deleteModalOpen.value = true
 }
 
@@ -144,7 +177,6 @@ async function handleDelete() {
         })
         deleteModalOpen.value = false
         roleToDelete.value = null
-        drawerOpen.value = false
         await loadRoles()
     } finally {
         deleting.value = false

frontend/modules/core/pages/admin/users.vue

@@ -25,6 +25,17 @@
                     {{ t('admin.users.table.admin') }}
                 </span>
             </template>
+            <template #cell-actions="{ item }">
+                <div class="flex items-center justify-end gap-2" @click.stop>
+                    <MalioButtonIcon
+                        v-if="canManage"
+                        icon="mdi:shield-edit-outline"
+                        :aria-label="t('common.edit')"
+                        variant="ghost"
+                        @click="openDrawer(getUserById(item.id as number)!)"
+                    />
+                </div>
+            </template>
         </MalioDataTable>
 
         <!-- Drawer RBAC -->
@@ -37,7 +48,13 @@
 </template>
 
 <script setup lang="ts">
-import type { UserListItem } from '~/shared/types/rbac'
+interface UserListItem {
+    id: number
+    username: string
+    isAdmin: boolean
+    roles: string[]
+    directPermissions: string[]
+}
 
 const { t } = useI18n()
 const api = useApi()
@@ -45,7 +62,7 @@ const { can } = usePermissions()
 
 useHead({ title: t('admin.users.title') })
 
-const canManage = computed(() => can('core.users.manage'))
+const canManage = can('core.users.manage')
 
 const users = ref<UserListItem[]>([])
 const loading = ref(false)
@@ -57,6 +74,7 @@ const columns = [
     { key: 'admin', label: t('admin.users.table.admin') },
     { key: 'roles', label: t('admin.users.table.roles') },
     { key: 'directPermissions', label: t('admin.users.table.directPermissions') },
+    { key: 'actions', label: t('admin.users.table.actions') },
 ]
 
 const userItems = computed(() =>
@@ -66,6 +84,7 @@ const userItems = computed(() =>
         admin: user.isAdmin,
         roles: user.roles.length,
         directPermissions: user.directPermissions.length,
+        actions: '',
     }))
 )
 

frontend/shared/types/rbac.ts

@@ -1,31 +0,0 @@
-export interface Permission {
-    id: number
-    code: string
-    label: string
-    module: string
-    orphan: boolean
-}
-
-export interface Role {
-    id: number
-    code: string
-    label: string
-    description: string | null
-    isSystem: boolean
-    permissions: (Permission | string)[]
-}
-
-export interface UserListItem {
-    id: number
-    username: string
-    isAdmin: boolean
-    roles: string[]
-    directPermissions: string[]
-}
-
-export interface EffectivePermission {
-    code: string
-    label: string
-    module: string
-    sources: string[]
-}

makefile

@@ -38,7 +38,7 @@ restart: env-init
 	$(DOCKER_COMPOSE) down
 	CURRENT_UID=$(shell id -u) CURRENT_GID=$(shell id -g) $(DOCKER_COMPOSE) up -d
 
-install: copy-git-hook composer-install cache-clear node-use build-nuxtJS migration-migrate test-db-setup
+install: copy-git-hook composer-install cache-clear node-use build-nuxtJS migration-migrate
 
 # Supprime tout est réinstalle tout (Attention ça supprime la bdd aussi)
 reset: delete_built_dir remove_orphans build-without-cache start wait install
@@ -83,15 +83,6 @@ build-without-cache:
 migration-migrate:
 	$(SYMFONY_CONSOLE) doctrine:migrations:migrate --no-interaction
 
-# Cree et initialise la base de test utilisee par PHPUnit
-# (le suffixe "_test" est applique automatiquement par Doctrine en APP_ENV=test)
-# Ordre : fixtures -> sync-permissions, car fixtures:load purge la table permission
-test-db-setup:
-	$(SYMFONY_CONSOLE) doctrine:database:create --env=test --if-not-exists
-	$(SYMFONY_CONSOLE) doctrine:migrations:migrate --env=test --no-interaction
-	$(SYMFONY_CONSOLE) --env=test --no-interaction doctrine:fixtures:load
-	$(SYMFONY_CONSOLE) --env=test --no-interaction app:sync-permissions
-
 fixtures:
 	$(SYMFONY_CONSOLE) --no-interaction doctrine:fixtures:load
 
@@ -109,7 +100,6 @@ db-reset:
 	$(MAKE) migration-migrate
 	$(MAKE) fixtures
 	$(MAKE) sync-permissions
-	$(MAKE) test-db-setup
 
 # Restart la bdd
 db-restart:

src/Module/Core/CoreModule.php

@@ -34,6 +34,7 @@ final class CoreModule
             ['code' => 'core.users.manage', 'label' => 'Gerer les utilisateurs (creer, editer, supprimer)'],
             ['code' => 'core.roles.view', 'label' => 'Voir les roles RBAC'],
             ['code' => 'core.roles.manage', 'label' => 'Gerer les roles et permissions'],
+            ['code' => 'core.permissions.view', 'label' => 'Voir le catalogue des permissions'],
         ];
     }
 }

src/Module/Core/Domain/Entity/Permission.php

@@ -19,11 +19,11 @@ use Symfony\Component\Serializer\Attribute\Groups;
     operations: [
         new GetCollection(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('core.permissions.view')",
         ),
         new Get(
             normalizationContext: ['groups' => ['permission:read']],
-            security: "is_granted('ROLE_USER')",
+            security: "is_granted('core.permissions.view')",
         ),
     ],
 )]

src/Module/Core/Domain/Security/AdminHeadcountGuard.php

@@ -53,13 +53,6 @@ final class AdminHeadcountGuard implements AdminHeadcountGuardInterface
      * La verification est volontairement conservative (<=1) pour couvrir
      * le cas defensif ou la base serait deja dans un etat incoherent (0 admin).
      *
-     * TOCTOU accepte : la verification n'utilise pas de verrou pessimiste
-     * (SELECT ... FOR UPDATE). Deux demotions concurrentes pourraient donc
-     * passer le garde simultanement. Ce risque est accepte dans le contexte
-     * PME/CRM ou les operations d'administration sont rares et mono-operateur.
-     * Si la concurrence admin devient un enjeu, ajouter un verrou pessimiste
-     * sur countAdmins() ou une contrainte CHECK en base.
-     *
      * @throws LastAdminProtectionException si le nombre d'admins est inferieur ou egal a 1
      */
     private function checkAdminHeadcount(): void

src/Shared/Infrastructure/ApiPlatform/State/SidebarProvider.php

@@ -7,7 +7,6 @@ namespace App\Shared\Infrastructure\ApiPlatform\State;
 use ApiPlatform\Metadata\Operation;
 use ApiPlatform\State\ProviderInterface;
 use App\Shared\Infrastructure\ApiPlatform\Resource\SidebarResource;
-use Symfony\Bundle\SecurityBundle\Security;
 
 /**
  * @implements ProviderInterface<object>
@@ -17,10 +16,10 @@ class SidebarProvider implements ProviderInterface
     /** @var list<string> */
     private readonly array $activeModuleIds;
 
-    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string, permission?: string}>}> */
+    /** @var list<array{label: string, icon: string, items: list<array{label: string, to: string, icon: string, module: string}>}> */
     private readonly array $sidebarConfig;
 
-    public function __construct(private readonly Security $security)
+    public function __construct()
     {
         $configDir = dirname(__DIR__, 5).'/config';
 
@@ -59,18 +58,6 @@ class SidebarProvider implements ProviderInterface
                     continue;
                 }
 
-                // Filtrage par permission RBAC : si l'item declare une permission
-                // requise et que l'utilisateur courant ne la possede pas, l'item
-                // est masque et sa route ajoutee aux routes desactivees.
-                $requiredPermission = $item['permission'] ?? null;
-                if (null !== $requiredPermission && !$this->security->isGranted($requiredPermission)) {
-                    if (isset($item['to'])) {
-                        $disabledRoutes[] = $item['to'];
-                    }
-
-                    continue;
-                }
-
                 $items[] = [
                     'label' => $item['label'],
                     'to'    => $item['to'],

tests/Module/Core/Api/PermissionApiTest.php

@@ -166,16 +166,51 @@ final class PermissionApiTest extends AbstractApiTestCase
         self::assertResponseStatusCodeSame(401);
     }
 
-    public function testStandardUserCanListPermissions(): void
+    public function testNonAdminReturns403(): void
     {
-        // Le catalogue de permissions est accessible a tout utilisateur authentifie.
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions');
 
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    // --- Tests voter RBAC : non-admin avec / sans permission ---
+
+    public function testListPermissionsAsUserWithViewPermissionReturns200(): void
+    {
+        // Un non-admin portant core.permissions.view doit pouvoir lister.
+        $credentials = $this->createUserWithPermission('core.permissions.view');
+        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
+        $client->request('GET', '/api/permissions');
+
         self::assertResponseIsSuccessful();
     }
 
-    public function testStandardUserCanGetPermission(): void
+    public function testListPermissionsAsStandardUserReturns403(): void
+    {
+        // alice n'a aucune permission RBAC : acces refuse.
+        $client = $this->authenticatedClient('alice', 'alice');
+        $client->request('GET', '/api/permissions');
+
+        self::assertResponseStatusCodeSame(403);
+    }
+
+    public function testGetPermissionAsUserWithViewPermissionReturns200(): void
+    {
+        // Recupere l'id d'une permission existante pour construire l'URL GET item.
+        $permission = $this->getEm()->getRepository(Permission::class)
+            ->findOneBy(['code' => 'test.core.users.view'])
+        ;
+        self::assertNotNull($permission);
+
+        $credentials = $this->createUserWithPermission('core.permissions.view');
+        $client      = $this->authenticatedClient($credentials['username'], $credentials['password']);
+        $client->request('GET', '/api/permissions/'.$permission->getId());
+
+        self::assertResponseIsSuccessful();
+    }
+
+    public function testGetPermissionAsStandardUserReturns403(): void
     {
         $permission = $this->getEm()->getRepository(Permission::class)
             ->findOneBy(['code' => 'test.core.users.view'])
@@ -185,7 +220,7 @@ final class PermissionApiTest extends AbstractApiTestCase
         $client = $this->authenticatedClient('alice', 'alice');
         $client->request('GET', '/api/permissions/'.$permission->getId());
 
-        self::assertResponseIsSuccessful();
+        self::assertResponseStatusCodeSame(403);
     }
 
     private function cleanupTestPermissions(): void