Korbeil · Oct 10, 2026
@@ -52,23 +52,15 @@ security:
         - { path: ^/event/vote/, roles: ROLE_GITHUB }
         - { path: ^(/event/.*/(vote|cfp|speaker-infos)|/connect/github/check|/event/speaker-infos), roles: ROLE_GITHUB }
         - { path: ^/(login|register|password-reset), roles: PUBLIC_ACCESS }
-        - { path: ^/admin/techletter/members, roles: ROLE_ADMIN }
-        - { path: ^/admin/techletter, roles: ROLE_VEILLE }
-        - { path: ^/admin/company, roles: ROLE_COMPANY_MANAGER }
-        - { path: ^/admin/members/badges, roles: ROLE_ADMIN }
-        - { path: ^/admin/members/users, roles: ROLE_ADMIN }
-        - { path: ^/admin/members/companies, roles: ROLE_ADMIN }
-        - { path: ^/admin/event/speakers-management, roles: ROLE_FORUM }
-        - { path: ^/admin/event/interviews, roles: ROLE_FORUM }
-        - { path: ^/admin/event, roles: ROLE_ADMIN }
-        - { path: ^/admin/members/general_meeting, roles: ROLE_ADMIN }
-        - { path: ^/admin/members/general_meeting_vote, roles: ROLE_ADMIN }
-        - { path: ^/admin/site, roles: ROLE_ADMIN }
-        - { path: ^/admin/planete, roles: ROLE_ADMIN }
-        - { path: ^/admin/accounting, roles: ROLE_ADMIN }
-        - { path: ^/admin/(members/reporting|association/relances|talk|slackmembers/check|healthcheck), roles: ROLE_ADMIN}
-        - { path: ^/member, roles: [ROLE_USER, ROLE_MEMBER_EXPIRED]}
-        - { path: ^/admin/, roles: ROLE_MEMBER_EXPIRED }
+        - { path: ^/member, roles: [ROLE_USER, ROLE_MEMBER_EXPIRED] }
+        # ─── Redirections legacy du domaine authentification (login/logout/password) : publiques ───
+        - { path: ^/admin/(login|logout|password), roles: PUBLIC_ACCESS }
+        # ─── Console : toute personne ayant un rôle fonctionnel (READ ⩾) passe
+        #     (dashboard /admin/ compris) ; anonymes → redirection login,
+        #     membres simples → 403. ───
+        - { path: ^/admin, roles: ROLE_ADMIN }
+        # ─── 4 pages SUPER_ADMIN (administrators, logs, healthcheck, techletter/members) :
+        #     fermées par attributs #[IsGranted] en code, pas par YAML ───
         - { path: ^/blog, allow_if: "request.getClientIp() in ['217.70.189.71', '127.0.0.1', '192.168.42.1'] or request.server.get('ALLOW_BLOG_FROM_ALL') == 1 or request.headers.get('x-afup-blog-api-key') == '%env(BLOG_API_KEY)%'" }
         - { path: ^/blog, roles: ROLE_NO_ACCESS }
         - { path: ^/(event/\w+/tickets|association)paybox-callback, roles: PUBLIC_ACCESS, ips: "%paybox_ips%" }
@@ -77,6 +69,35 @@ security:
 
     role_hierarchy:
         ROLE_USER: [ROLE_MEMBER_EXPIRED]
-        ROLE_COMPANY_MANAGER: [ROLE_USER]
-        ROLE_ADMIN:       [ROLE_USER, ROLE_DEPLOY, ROLE_APERO, ROLE_ANNUAIRE, ROLE_FORUM, ROLE_SITE, ROLE_VEILLE]
-        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
+        # Company managers keep self-service access (bridge, data migration pending)
+        ROLE_COMPANY_MANAGER: [ROLE_USER, ROLE_MEMBRES_READER]
+        # ─── Marqueur console vide : ne donne accès à rien ───
+        ROLE_ADMIN: []
+        # ─── Pont rôles legacy → rôles fonctionnels (migration des comptes DB) ───
+        ROLE_VEILLE: [ROLE_VEILLE_READER]
+        ROLE_ANNUAIRE: [ROLE_MEMBRES_READER]
+        ROLE_SITE: [ROLE_SITE_READER]
+        ROLE_APERO: [ROLE_APERO_READER]
+        ROLE_FORUM: [ROLE_EVENT_READER]
+        ROLE_ANTENNE: [ROLE_ANTENNES_READER]
+        # ─── READ ⇒ console + WRITE ⇒ READ ───
+        ROLE_MEMBRES_READER: [ROLE_ADMIN]
+        ROLE_MEMBRES_WRITER: [ROLE_MEMBRES_READER]
+        ROLE_VEILLE_READER: [ROLE_ADMIN]
+        ROLE_VEILLE_WRITER: [ROLE_VEILLE_READER]
+        ROLE_SITE_READER: [ROLE_ADMIN]
+        ROLE_SITE_WRITER: [ROLE_SITE_READER]
+        ROLE_APERO_READER: [ROLE_ADMIN]
+        ROLE_APERO_WRITER: [ROLE_APERO_READER]
+        ROLE_EVENT_READER: [ROLE_ADMIN]
+        ROLE_EVENT_WRITER: [ROLE_EVENT_READER]
+        ROLE_COMPTA_READER: [ROLE_ADMIN]
+        ROLE_COMPTA_WRITER: [ROLE_COMPTA_READER]
+        ROLE_AG_READER: [ROLE_ADMIN]
+        ROLE_AG_WRITER: [ROLE_AG_READER]
+        ROLE_PLANETE_READER: [ROLE_ADMIN]
+        ROLE_PLANETE_WRITER: [ROLE_PLANETE_READER]
+        ROLE_ANTENNES_READER: [ROLE_ADMIN]
+        ROLE_ANTENNES_WRITER: [ROLE_ANTENNES_READER]
+        # ─── Super admin : tout READ + impersonation ───
+        ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH, ROLE_MEMBRES_READER, ROLE_VEILLE_READER, ROLE_SITE_READER, ROLE_APERO_READER, ROLE_EVENT_READER, ROLE_COMPTA_READER, ROLE_AG_READER, ROLE_PLANETE_READER, ROLE_ANTENNES_READER]
@@ -74,7 +74,18 @@ public function run(): void
                 'prenom' => 'Admin',
                 'email' => 'admin@admin.fr',
                 'niveau_modules' => '00000',
-                'roles' => '',
+                'roles' => json_encode([
+                    'ROLE_SUPER_ADMIN',
+                    'ROLE_MEMBRES_WRITER',
+                    'ROLE_VEILLE_WRITER',
+                    'ROLE_SITE_WRITER',
+                    'ROLE_APERO_WRITER',
+                    'ROLE_EVENT_WRITER',
+                    'ROLE_COMPTA_WRITER',
+                    'ROLE_AG_WRITER',
+                    'ROLE_PLANETE_WRITER',
+                    'ROLE_ANTENNES_WRITER',
+                ]),
                 'adresse' => '',
             ],
             // utilisateur ayant expiré, avec une date de cotisation fixe, utile pour les tests

@@ -22,5 +22,6 @@ parameters:
 rules:
     - AppBundle\StaticAnalysis\Rule\NoDebugFunctionsRule
     - AppBundle\StaticAnalysis\Rule\NoGetUserMethodRule
+    - AppBundle\StaticAnalysis\Rule\AdminControllerIsGrantedRule
     - AppBundle\StaticAnalysis\Rule\DoctrineRepositoryRule
     - AppBundle\StaticAnalysis\Rule\DoctrineDisableDQLRule
@@ -622,7 +622,10 @@ public function getRoles(): array
             $defaultRoles = ['ROLE_MEMBER_EXPIRED'];
         }
         if ($this->level === self::LEVEL_ADMIN) {
-            $defaultRoles[] = 'ROLE_SUPER_ADMIN';
+            // Un admin de base console seulement : ROLE_ADMIN est vide (marqueur d'accès console).
+            // Les droits fonctionnels viennent des levelModules ci-dessous.
+            // ROLE_SUPER_ADMIN est désormais réservé et ne doit plus être attribué automatiquement.
+            $defaultRoles[] = 'ROLE_ADMIN';
         }
         if (isset($this->levelModules[0]) && (int) $this->levelModules[0] > 0) {
             $defaultRoles[] = 'ROLE_APERO';
@@ -643,7 +646,7 @@ public function getRoles(): array
         // On enlève le rôle ROLE_MEMBER_EXPIRED vu qu'il est défini en fonction de la cotisation dans les defaultRoles
         // on fait de même avec tous les autres rôles définis en fonction des champs levelModules car ils peuvent se retrouver
         // en base dans le tableau de rôle, et on ne veux pas que si on modifie le levelModules pour l'enlever, il reste via le roles
-        $userRoles = array_diff($this->roles, ['ROLE_MEMBER_EXPIRED', 'ROLE_SUPER_ADMIN', 'ROLE_APERO', 'ROLE_ANNUAIRE', 'ROLE_SITE', 'ROLE_FORUM', 'ROLE_ANTENNE']);
+        $userRoles = array_diff($this->roles, ['ROLE_MEMBER_EXPIRED', 'ROLE_APERO', 'ROLE_ANNUAIRE', 'ROLE_SITE', 'ROLE_FORUM', 'ROLE_ANTENNE']);
 
         return array_unique(array_merge($userRoles, $defaultRoles));
     }

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddAccountAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddCategoryAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddEventAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddOperationAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddPaymentAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class AddRuleAction extends AbstractController
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use AppBundle\Accounting\Entity\Repository\AccountRepository;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class ArchiveAccountAction extends AbstractController
 {
     public function __construct(private readonly AccountRepository $accountRepository) {}

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditAccountAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditCategoryAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditEventAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditOperationAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditPaymentAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class EditRuleAction extends AbstractController
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListAccountAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 final readonly class ListCategoryAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListEventAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListOperationAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListPaymentAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListRuleAction
 {
     public function __construct(

@@ -8,7 +8,9 @@
 use AppBundle\Accounting\Entity\Repository\AccountRepository;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\RedirectResponse;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 final class RestoreAccountAction extends AbstractController
 {
     public function __construct(private readonly AccountRepository $accountRepository) {}

@@ -11,7 +11,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class DownloadInvoiceAction extends AbstractController
 {
     public function __construct(

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class EditInvoiceAction extends AbstractController
 {
     public function __construct(private readonly InvoicingRepository $invoicingRepository) {}

@@ -14,7 +14,9 @@
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Twig\Environment;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_READER')]
 class ListInvoiceAction extends AbstractController
 {
     public function __construct(

@@ -14,7 +14,9 @@
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Security\Csrf\CsrfToken;
 use Symfony\Component\Security\Csrf\CsrfTokenManagerInterface;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class MarkFactureAsSentAction extends AbstractController
 {
     public function __construct(

@@ -13,7 +13,9 @@
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class SendInvoiceEmailAction extends AbstractController
 {
     public function __construct(

@@ -11,7 +11,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class AddTransactionAction extends AbstractController
 {
     public function __construct(

@@ -9,7 +9,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class AllocateAction extends AbstractController
 {
     public function __construct(private readonly TransactionRepository $transactionRepository) {}

@@ -10,7 +10,9 @@
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
+#[IsGranted('ROLE_COMPTA_WRITER')]
 class DeleteAction extends AbstractController
 {
     public function __construct(