Feat/security Allow Admins to Delete Anonymous Tasks (#13)

src/AppBundle/Security/TaskVoter.php

@@ -60,6 +60,8 @@ protected function supports($attribute, $subject)
     /**
      * Perform a single access check operation on a given attribute, subject and token.
      *
+     * @SuppressWarnings(PHPMD.UnusedFormalParameter)
+     *
      * @param string $attribute
      * @param Task $subject
      * @param TokenInterface $token
@@ -94,6 +96,13 @@ private function canDelete(Task $task, User $user, TokenInterface $token)
     {
         $author = $task->getUser();
 
+        // SCENARIO 1: The task is linked to an "anonymous" author (or has no author).
+        // Only admins (ROLE_ADMIN) are allowed to delete these tasks.
+        if ($author === null || $author->getUsername() === 'anonyme') {
+            return $this->decisionManager->decide($token, ['ROLE_ADMIN']);
+        }
+
+        // SCENARIO 2: The task has a valid author.
         // The logged-in user must be the strict author of the task.
         return $user->getId() === $author->getId();
     }

tests/AppBundle/Controller/TaskControllerTest.php

@@ -97,7 +97,7 @@ public function testUserCanDeleteOwnTask()
         // 4. Verify that he is redirected (302) to the list page
         $this->assertEquals(302, $client->getResponse()->getStatusCode());
 
-        $crawler = $client->followRedirect();
+        $client->followRedirect();
         $this->assertContains('La tâche a bien été supprimée.', $client->getResponse()->getContent());
     }
 }