Three staff members, three jobs:
- Gorm, the boss (
ROLE_PATRON), can do everything; - Bruna, the cook (
ROLE_CUISINIER), creates and edits the dishes; - Pippin, waiting tables, only has
ROLE_USER: he doesn't touch anything.
Problem: Gorm is not even allowed into the kitchen (he doesn't have ROLE_CUISINIER), any cook can remove a dish, and customers see “Edit” and “Remove” buttons that are none of their business.
Your mission
- Hierarchy: the boss also has all the rights of a cook.
- Authorization: only the boss can remove a dish (the
supprimerPlat()action, “delete dish”). - Display: everyone only sees what they are allowed to do.
- “Edit” and the “Kitchen” navigation link: for cooks (and therefore the boss too);
- “Remove from the menu”: for the boss only.
Log in with the accounts created by app:embaucher (the console displays them) to see the difference.
Reminder
Hiding a button protects nothing: anyone can send the request by hand. The real protection is on the server side (#[IsGranted], access_control); hiding the buttons is only for comfort.