Given the same permissions between users and admins (#72)

Author: bastien70

src/Controller/Admin/BackupCrudController.php

@@ -8,7 +8,6 @@
 use App\Entity\Backup;
 use App\Entity\User;
 use App\Helper\FlysystemHelper;
-use App\Security\Voter\BackupVoter;
 use Doctrine\ORM\EntityManagerInterface;
 use Doctrine\ORM\QueryBuilder;
 use EasyCorp\Bundle\EasyAdminBundle\Collection\FieldCollection;
@@ -65,10 +64,6 @@ public function configureFilters(Filters $filters): Filters
     public function createIndexQueryBuilder(SearchDto $searchDto, EntityDto $entityDto, FieldCollection $fields, FilterCollection $filters): QueryBuilder
     {
         return $this->container->get(EntityRepository::class)->createQueryBuilder($searchDto, $entityDto, $fields, $filters)
-            ->join('entity.database', 'database')
-            ->join('database.owner', 'owner')
-            ->andWhere('owner.id = :user')
-            ->setParameter('user', $this->getUser()->getId())
             ->orderBy('entity.createdAt', 'DESC');
     }
 
@@ -96,8 +91,6 @@ public function configureActions(Actions $actions): Actions
 
         return $actions
             ->add(Crud::PAGE_INDEX, $downloadBackupAction)
-            ->setPermission('downloadBackup', BackupVoter::CAN_SHOW_BACKUP)
-            ->setPermission(Action::DELETE, BackupVoter::CAN_SHOW_BACKUP)
             ->remove(Crud::PAGE_INDEX, Action::NEW)
             ->remove(Crud::PAGE_INDEX, Action::EDIT)
             ->disable(Action::NEW, Action::EDIT)

src/Controller/Admin/DatabaseCrudController.php

@@ -12,7 +12,6 @@
 use App\Entity\Enum\BackupTaskPeriodicity;
 use App\Entity\User;
 use App\Helper\DatabaseHelper;
-use App\Security\Voter\DatabaseVoter;
 use App\Service\BackupService;
 use App\Service\BackupStatus;
 use DateTime;
@@ -84,16 +83,12 @@ public function configureFilters(Filters $filters): Filters
     public function createIndexQueryBuilder(SearchDto $searchDto, EntityDto $entityDto, FieldCollection $fields, FilterCollection $filters): QueryBuilder
     {
         return $this->container->get(EntityRepository::class)->createQueryBuilder($searchDto, $entityDto, $fields, $filters)
-            ->join('entity.owner', 'owner')
-            ->andWhere('owner.id = :user')
-            ->setParameter('user', $this->getUser()->getId())
             ->orderBy('entity.createdAt', 'DESC');
     }
 
     public function launchBackupAction(AdminContext $context): Response
     {
         $database = $context->getEntity()->getInstance();
-        $this->denyAccessUnlessGranted(DatabaseVoter::CAN_SHOW_DATABASE, $database);
 
         $backupStatus = $this->backupService->backup($database, Backup::CONTEXT_MANUAL);
         $this->backupService->clean($database);
@@ -115,7 +110,6 @@ public function showDatabaseBackupsAction(AdminContext $context): Response
     {
         /** @var Database $database */
         $database = $context->getEntity()->getInstance();
-        $this->denyAccessUnlessGranted(DatabaseVoter::CAN_SHOW_DATABASE, $database);
 
         $url = $this->adminUrlGenerator->setController(BackupCrudController::class)
             ->setAction(Action::INDEX)
@@ -135,7 +129,6 @@ public function checkConnection(AdminContext $context): Response
     {
         /** @var Database $database */
         $database = $context->getEntity()->getInstance();
-        $this->denyAccessUnlessGranted(DatabaseVoter::CAN_SHOW_DATABASE, $database);
 
         if ($this->databaseHelper->isConnectionOk($database)) {
             $this->addFlash('success', new TranslatableMessage('database.check_connection.flash_success', ['%database%' => $database->getName()]));
@@ -191,11 +184,6 @@ public function configureActions(Actions $actions): Actions
             ->add(Crud::PAGE_INDEX, $launchBackupAction)
             ->add(Crud::PAGE_INDEX, $showDatabaseBackupsAction)
             ->add(Crud::PAGE_INDEX, $checkConnectionAction)
-            ->setPermission(Action::DELETE, DatabaseVoter::CAN_SHOW_DATABASE)
-            ->setPermission(Action::EDIT, DatabaseVoter::CAN_SHOW_DATABASE)
-            ->setPermission('launchBackup', DatabaseVoter::CAN_SHOW_DATABASE)
-            ->setPermission('showDatabaseBackups', DatabaseVoter::CAN_SHOW_DATABASE)
-            ->setPermission('checkConnection', DatabaseVoter::CAN_SHOW_DATABASE)
             ->remove(Crud::PAGE_NEW, Action::SAVE_AND_ADD_ANOTHER)
             ->update(Crud::PAGE_INDEX, Action::NEW, function (Action $action) {
                 return $action->setLabel('database.action.new');

src/Security/Voter/BackupVoter.php

@@ -17,7 +17,7 @@ public function testEdit(): void
 
         $this->loginAsAdmin();
         self::$client->request('GET', $url);
-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseIsSuccessful();
 
         $this->loginAsUser();
         self::$client->request('GET', $url);
@@ -33,7 +33,7 @@ public function testShowDatabaseBackupsAction(): void
 
         $this->loginAsAdmin();
         self::$client->request('GET', $url);
-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseRedirects();
 
         $this->loginAsUser();
         self::$client->request('GET', $url);
@@ -49,7 +49,9 @@ public function testCheckConnection(): void
 
         $this->loginAsUser();
         self::$client->request('GET', $url);
-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseRedirects();
+        $crawler = self::$client->followRedirect();
+        self::assertCount(1, $crawler->filter('.alert-danger'));
 
         $this->loginAsAdmin();
         self::$client->request('GET', $url);
@@ -68,7 +70,10 @@ public function testLaunchBackupAction(): void
 
         $this->loginAsUser();
         self::$client->request('GET', $url);
-        self::assertResponseStatusCodeSame(403);
+        self::assertResponseRedirects();
+        // We expect an error as parameters are randomized with fixtures.
+        $crawler = self::$client->followRedirect();
+        self::assertCount(1, $crawler->filter('.alert-danger'));
 
         $this->loginAsAdmin();
         self::$client->request('GET', $url);