AcadeNice/corentin_wakdo
7
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
corentin_wakdo/docs/domaines/rbac.md
Imugiii f7caf2d50c
All checks were successful
CI / secret-scan (pull_request) Successful in 9s
Details
CI / php-lint (pull_request) Successful in 21s
Details
CI / static-tests (pull_request) Successful in 44s
Details
CI / js-tests (pull_request) Successful in 17s
Details
CI / auto-merge (pull_request) Successful in 5s
Details
docs(domaines): documentation par domaine fonctionnel (7 fiches) 
docs/domaines/ : une fiche par domaine livre (perimetre / ce qui est livre / regles
metier RG-T* / decisions -> ADR / tables), + index.

auth, catalogue, stock-recettes, users, rbac, stats, borne. Commande = P4 (schema pret,
non documentee ici). Troisieme et derniere PR du jeu de documentation socle.
2026-06-17 13:53:56 +00:00

1.5 KiB
Raw Blame History

Domaine — RBAC (roles & permissions)

Perimetre

Gestion des roles et de la matrice role/permission (mlt 10.4 MANAGE_RBAC), permission role.manage. Catalogue de permissions fige au seed (lecture seule).

Ce qui est livre

  • RoleRepository (App\Auth) : roles (CRUD, code immuable), permissions (lecture), matrice (permissionIdsFor/permissionCodesFor, setPermissions tx + replacePermissions raw), role_visible_source (setVisibleSources / raw).
  • RoleController (role.manage) : index, create/store (role custom RG-4), edit/update (champs role + matrice + sources visibles en UNE transaction). Vues admin/roles/{index,form}.
  • Matrice soumise en champs scalaires (perm_<id>, source_<enum>) : Request::formBody ne garde que les scalaires (pas de name[], pas de JS).

Regles metier

  • RG-6 (mlt 10.4) : PIN equipier + audit_log (role.manage) dans une transaction ; details JSON = diff des codes de permission (ajoutes/retires), calcule avant la reecriture delete-and-reinsert.
  • Authorizer::can recharge les permissions a chaque verification (effet immediat).
  • Garde-fous anti-lockout : le role admin conserve role.manage ET reste actif ; code immuable apres creation ; order_source borne a l'ENUM ; code dupli -> 409.

Decisions

ADR-0004 (PIN + audit), ADR-0006 (409).

Tables

role, permission, role_permission, role_visible_source, audit_log. Detail : docs/merise/mlt.md section 10.4.