After the business with the board, Pippin felt guilty. He decided to “tighten security” all by himself, during the night, “tidying up a bit” along the way.
In the morning, here is what Gorm hears:
- a customer was caught in the kitchen, with a spoon in the cauldron. So was Pippin, by the way;
- Gorm, the boss, no longer sees the “Kitchen” link in the navigation;
- Bruna can no longer edit her own dishes: 403. Neither can Gorm, even though he can edit everything.
Your mission
Three bugs are hiding in the security configuration and in the code: find them and fix them, without breaking anything else.
Detective method
Security bugs almost never raise an error: a door stays open, or closes without warning. To investigate:
- Reproduce each symptom in the preview. The demo accounts are displayed by
app:embaucherin the console:bruna@drunken-dragon.me/cauldron,gorm@drunken-dragon.me/barrel,pippin@drunken-dragon.me/potato. - Read the 403 page: its stack trace shows who denied access, an
access_controlrule or an#[IsGranted]. Sometimes the title also says why. - Reread
security.yamlline by line: order of the rules, names of the roles. - Ask yourself who is voting: a voter that never casts a vote makes no noise.
And this time, nobody touches the keys without telling the boss.