Feat/security Allow Admins to Delete Anonymous Tasks (#13)

[Mike031289]

This PR resolves issue #13 by updating the authorization rules to allow administrators (ROLE_ADMIN) to delete tasks that are assigned to the "anonymous" user.

Changes Implemented

1. Authorization Logic (TaskVoter.php)

• Updated the canDelete method to check if the task's author is null or named anonyme.
• Used AccessDecisionManagerInterface to authorize the deletion if the logged-in user has the ROLE_ADMIN role in these specific scenarios.

2. User Interface (list.html.twig)

• Wrapped the delete button in conditional checks so that the action is only visible to:
  • The actual author of the task.
  • An administrator if the task is marked as "Anonyme".

3. Automated Tests (TaskControllerTest.php)

• Added functional test cases to assert that:
  • A standard ROLE_USER cannot see the delete button or delete an anonymous task (expects 403 Forbidden).
  • A ROLE_ADMIN can see the delete button and successfully delete an anonymous task.

---

Acceptance Criteria Checklist

• Update authorization logic in the Voter to handle the "anonyme" exception.
• Allow deletion if: User is Author OR (Task is Anonymous AND User is Admin).
• Conditionally display the delete button on the Twig template.
• Add functional tests for both ROLE_USER (denied) and ROLE_ADMIN (allowed) behaviors.

---

How to Test

1. Load updated fixtures:

   php bin/console doctrine:fixtures:load
   

Close #13

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}