From 28346c3c84816341eb6a7d74984595b2dcb1cdb4 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Tue, 10 Mar 2026 13:24:00 +0100
Subject: [PATCH 01/16] 6897: Added authorization voter for screen

---
 .env                                      | 13 ++++
 config/api_platform/screen.yaml           |  9 +--
 config/services.yaml                      |  4 ++
 src/Security/Voter/AuthorizationVoter.php | 73 +++++++++++++++++++++++
 4 files changed, 95 insertions(+), 4 deletions(-)
 create mode 100644 src/Security/Voter/AuthorizationVoter.php

diff --git a/.env b/.env
index 414a776c5..82d2d2273 100644
--- a/.env
+++ b/.env
@@ -129,3 +129,16 @@ CLIENT_PULL_STRATEGY_INTERVAL=90000
 CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
+
+AUTHORIZATION_OVERRIDE='{
+  "Screen": {
+    "EDIT": "ROLE_ADMIN",
+    "EDIT_OWN": "ROLE_EDITOR",
+    "VIEW": "ROLE_EDITOR",
+    "VIEW_OWN": "ROLE_EDITOR",
+    "CREATE": "ROLE_ADMIN",
+    "CREATE_OWN": "ROLE_EDITOR",
+    "DELETE": "ROLE_ADMIN",
+    "DELETE_OWN": "ROLE_EDITOR"
+  }
+}'
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 3ff6b4f83..1a22301f5 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -1,7 +1,6 @@
 ---
 resources:
     App\Entity\Tenant\Screen:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         input: App\Dto\ScreenInput
         output: App\Dto\Screen
         provider: App\State\ScreenProvider
@@ -9,6 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update a Screen resource.
                     summary: Update a Screen resource.
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Screen resource.
                     summary: Delete a Screen resource.
@@ -68,6 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'App\Filter\MultipleSearchFilter'
                     - 'screen.screen_user_exists_filter'
@@ -105,7 +106,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("CREATE", object)'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/config/services.yaml b/config/services.yaml
index b62f35f7f..75ed14fba 100644
--- a/config/services.yaml
+++ b/config/services.yaml
@@ -53,6 +53,10 @@ services:
     Symfony\Component\Security\Http\Authentication\AuthenticationFailureHandlerInterface: '@Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication\AuthenticationFailureHandler'
     Symfony\Component\Security\Http\Authentication\AuthenticationSuccessHandlerInterface: '@Lexik\Bundle\JWTAuthenticationBundle\Security\Http\Authentication\AuthenticationSuccessHandler'
 
+    App\Security\Voter\AuthorizationVoter:
+        arguments:
+            $authorizationOverride: '%env(json:AUTHORIZATION_OVERRIDE)%'
+
     App\EventListener\RelationsChecksumListener:
         arguments:
             $enabled: '%env(bool:RELATIONS_CHECKSUM_ENABLED)%'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
new file mode 100644
index 000000000..974dca07e
--- /dev/null
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -0,0 +1,73 @@
+<?php
+
+namespace App\Security\Voter;
+
+use App\Dto\Screen;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\Voter;
+use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class AuthorizationVoter extends Voter {
+    public const EDIT = 'EDIT';
+    public const VIEW = 'VIEW';
+    public const CREATE = 'CREATE';
+    public const DELETE = 'DELETE';
+    public const OWN = '_OWN';
+    public const SCREEN = 'Screen';
+
+    private array $authorizationDefault = [
+        self::SCREEN => [
+            self::EDIT => ['ROLE_ADMIN'],
+            self::EDIT . self::OWN => ['ROLE_ADMIN'],
+            self::VIEW => ['ROLE_ADMIN'],
+            self::VIEW . self::OWN => ['ROLE_ADMIN'],
+            self::CREATE => ['ROLE_ADMIN'],
+            self::CREATE . self::OWN => ['ROLE_ADMIN'],
+            self::DELETE => ['ROLE_ADMIN'],
+            self::DELETE . self::OWN => ['ROLE_ADMIN'],
+        ]
+    ];
+
+    private array $authorization;
+
+    public function __construct(private readonly array $authorizationOverride, private readonly RoleHierarchyInterface $roleHierarchy)
+    {
+        $this->authorization = array_replace($this->authorizationDefault, $authorizationOverride);
+    }
+
+    protected function supports(string $attribute, mixed $subject): bool
+    {
+        // https://symfony.com/doc/current/security/voters.html
+
+        return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE])
+            && $subject instanceof Screen;
+    }
+
+    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
+    {
+        $user = $token->getUser();
+
+        // if the user is anonymous, do not grant access
+        if (!$user instanceof UserInterface) {
+            return false;
+        }
+
+        $userRoles = $user->getRoles();
+
+        $class = str_replace("App\\Dto\\", "", $subject::class);
+
+        $createdBy = $subject->createdBy;
+
+        $userIdentifier = $user->getUserIdentifier();
+
+        // Check authorization array for demands for $class, $attribute and $userIdentifier
+        // Permissions are different if the user is the creator of the object.
+        $actionKey = $attribute . ($userIdentifier === $createdBy ? self::OWN : '');
+        $requiredRole = $this->authorization[$class][$actionKey];
+
+        $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
+
+        return in_array($requiredRole, $reachableRoles);
+    }
+}

From f48a5f5ea5ddfc9bf47fed986faa229c490befe0 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Tue, 10 Mar 2026 14:21:50 +0100
Subject: [PATCH 02/16] 6897: Added helper class

---
 .env                                          | 26 ++++---
 src/Security/Voter/AuthorizationVoter.php     | 42 +++++-----
 .../Voter/AuthorizationVoterHelper.php        | 77 +++++++++++++++++++
 3 files changed, 113 insertions(+), 32 deletions(-)
 create mode 100644 src/Security/Voter/AuthorizationVoterHelper.php

diff --git a/.env b/.env
index 82d2d2273..a611e705a 100644
--- a/.env
+++ b/.env
@@ -130,15 +130,17 @@ CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
 
-AUTHORIZATION_OVERRIDE='{
-  "Screen": {
-    "EDIT": "ROLE_ADMIN",
-    "EDIT_OWN": "ROLE_EDITOR",
-    "VIEW": "ROLE_EDITOR",
-    "VIEW_OWN": "ROLE_EDITOR",
-    "CREATE": "ROLE_ADMIN",
-    "CREATE_OWN": "ROLE_EDITOR",
-    "DELETE": "ROLE_ADMIN",
-    "DELETE_OWN": "ROLE_EDITOR"
-  }
-}'
+AUTHORIZATION_OVERRIDE='{}'
+# Example value:
+#AUTHORIZATION_OVERRIDE='{
+#  "Screen": {
+#    "EDIT": ["ROLE_ADMIN"],
+#    "EDIT_OWN": ["ROLE_EDITOR"],
+#    "VIEW": ["ROLE_EDITOR"],
+#    "VIEW_OWN": ["ROLE_EDITOR"],
+#    "CREATE": ["ROLE_ADMIN"],
+#    "CREATE_OWN": ["ROLE_EDITOR"],
+#    "DELETE": ["ROLE_ADMIN"],
+#    "DELETE_OWN": ["ROLE_EDITOR"]
+#  }
+#}'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 974dca07e..276401fbf 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -14,34 +14,24 @@ final class AuthorizationVoter extends Voter {
     public const CREATE = 'CREATE';
     public const DELETE = 'DELETE';
     public const OWN = '_OWN';
-    public const SCREEN = 'Screen';
-
-    private array $authorizationDefault = [
-        self::SCREEN => [
-            self::EDIT => ['ROLE_ADMIN'],
-            self::EDIT . self::OWN => ['ROLE_ADMIN'],
-            self::VIEW => ['ROLE_ADMIN'],
-            self::VIEW . self::OWN => ['ROLE_ADMIN'],
-            self::CREATE => ['ROLE_ADMIN'],
-            self::CREATE . self::OWN => ['ROLE_ADMIN'],
-            self::DELETE => ['ROLE_ADMIN'],
-            self::DELETE . self::OWN => ['ROLE_ADMIN'],
-        ]
-    ];
 
     private array $authorization;
 
     public function __construct(private readonly array $authorizationOverride, private readonly RoleHierarchyInterface $roleHierarchy)
     {
-        $this->authorization = array_replace($this->authorizationDefault, $authorizationOverride);
+        $authorizationDefaults = AuthorizationVoterHelper::getAuthorizationDefaults();
+        $this->authorization = array_replace($authorizationDefaults, $authorizationOverride);
     }
 
     protected function supports(string $attribute, mixed $subject): bool
     {
         // https://symfony.com/doc/current/security/voters.html
 
+        $dto = str_contains($subject::class, "App\\Dto\\");
+        $entity = str_contains($subject::class, "App\\Entity\\Tenant\\");
+
         return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE])
-            && $subject instanceof Screen;
+            && $dto || $entity;
     }
 
     protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
@@ -55,19 +45,31 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
 
         $userRoles = $user->getRoles();
 
-        $class = str_replace("App\\Dto\\", "", $subject::class);
+        $dto = str_contains($subject::class, "App\\Dto\\");
+        $entity = str_contains($subject::class, "App\\Entity\\");
+
+        $class = '';
+        $createdBy = null;
 
-        $createdBy = $subject->createdBy;
+        if ($dto) {
+            $class = str_replace("App\\Dto\\", "", $subject::class);
+            $createdBy = $subject->createdBy;
+        } else if ($entity) {
+            $class = str_replace("App\\Entity\\Tenant\\", "", $subject::class);
+            $createdBy = $subject->getCreatedBy();
+        }
 
         $userIdentifier = $user->getUserIdentifier();
 
         // Check authorization array for demands for $class, $attribute and $userIdentifier
         // Permissions are different if the user is the creator of the object.
         $actionKey = $attribute . ($userIdentifier === $createdBy ? self::OWN : '');
-        $requiredRole = $this->authorization[$class][$actionKey];
+        $requiredRoles = $this->authorization[$class][$actionKey];
 
         $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
 
-        return in_array($requiredRole, $reachableRoles);
+        $intersect = array_intersect($requiredRoles, $reachableRoles);
+
+        return !empty($intersect);
     }
 }
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
new file mode 100644
index 000000000..15e79f0f2
--- /dev/null
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Security\Voter;
+
+class AuthorizationVoterHelper
+{
+    private const editorClasses = [
+        "Screen",
+        "ActivationCode",
+        "Feed",
+        "FeedInput",
+        "FeedSource",
+        "FeedSourceInput",
+        "InteractiveSlideActionInput",
+        "Media",
+        "Playlist",
+        "PlaylistInput",
+        "PlaylistScreenRegion",
+        "PlaylistSlide",
+        "ScreenCampaign",
+        "ScreenGroup",
+        "ScreenGroupCampaign",
+        "ScreenGroupInput",
+        "ScreenInput",
+        "ScreenLayout",
+        "ScreenLayoutRegions",
+        "Slide",
+        "SlideInput",
+        "Template",
+    ];
+
+    private const adminClasses = [
+        "Tenant",
+        "Theme",
+        "ThemeInput",
+        "User",
+        "UserActivationCode",
+        "UserActivationCodeInput",
+        "UserInput",
+        "Screen",
+    ];
+
+    public static function getAuthorizationDefaults(): array
+    {
+        $defaults = [];
+
+        // TODO: Adjust to sensible defaults.
+
+        foreach (self::editorClasses as $class) {
+            $defaults[$class] = [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::EDIT . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
+            ];
+        }
+
+        foreach (self::adminClasses as $class) {
+            $defaults[$class] = [
+                AuthorizationVoter::EDIT => ['ROLE_ADMIN'],
+                AuthorizationVoter::EDIT . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
+                AuthorizationVoter::VIEW => ['ROLE_ADMIN'],
+                AuthorizationVoter::VIEW . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
+                AuthorizationVoter::CREATE => ['ROLE_ADMIN'],
+                AuthorizationVoter::CREATE . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
+                AuthorizationVoter::DELETE => ['ROLE_ADMIN'],
+                AuthorizationVoter::DELETE . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
+            ];
+        }
+
+        return $defaults;
+    }
+}

From 4a49210c4579c58c8699cde350c57ba135055ca1 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Tue, 10 Mar 2026 15:09:04 +0100
Subject: [PATCH 03/16] 6897: Started work on admin hasPermission function

---
 .../admin/components/screen/screen-form.jsx   | 66 ++++++++++++++-----
 .../Admin/AdminConfigController.php           |  3 +
 src/Security/Voter/AuthorizationVoter.php     |  9 ++-
 .../Voter/AuthorizationVoterHelper.php        |  4 +-
 4 files changed, 60 insertions(+), 22 deletions(-)

diff --git a/assets/admin/components/screen/screen-form.jsx b/assets/admin/components/screen/screen-form.jsx
index 8f64516c0..f95bc0687 100644
--- a/assets/admin/components/screen/screen-form.jsx
+++ b/assets/admin/components/screen/screen-form.jsx
@@ -83,6 +83,32 @@ function ScreenForm({
     previewOrientationOptions[0].value,
   );
 
+  const hasPermission = (entity, action) => {
+    console.log("hasPermission", entity, action);
+
+    if (config?.authorization) {
+      const currentTenant = JSON.parse(localStorage.getItem("admin-selected-tenant"));
+      const userRoles = currentTenant?.roles;
+
+      const authorization = config.authorization;
+
+      console.log("authorization", authorization);
+
+      const requiredRoles = authorization[entity]?.[action];
+
+      console.log("requiredRoles", requiredRoles);
+
+      const intersect = requiredRoles.filter(value => userRoles.includes(value));
+
+      console.log("intersect", intersect);
+
+      if (intersect.length > 0) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Check if published is set
    *
@@ -382,24 +408,28 @@ function ScreenForm({
           >
             {t("cancel-button")}
           </Button>
-          <Button
-            variant="outline-primary"
-            type="button"
-            className="margin-right-button"
-            id="save_screen"
-            onClick={() => checkInputsHandleSubmit(false)}
-          >
-            {t("save-button")}
-          </Button>
-          <Button
-            variant="primary"
-            type="button"
-            onClick={() => checkInputsHandleSubmit(true)}
-            id="save_slide_an_close"
-            className="margin-right-button"
-          >
-            {t("save-button-and-close")}
-          </Button>
+          {hasPermission("Screen", "EDIT") && (
+            <>
+              <Button
+                variant="outline-primary"
+                type="button"
+                className="margin-right-button"
+                id="save_screen"
+                onClick={() => checkInputsHandleSubmit(false)}
+              >
+                {t("save-button")}
+              </Button>
+              <Button
+                variant="primary"
+                type="button"
+                onClick={() => checkInputsHandleSubmit(true)}
+                id="save_slide_an_close"
+                className="margin-right-button"
+              >
+                {t("save-button-and-close")}
+              </Button>
+            </>
+          )}
           {config?.enhancedPreview && (
             <Button
               variant="success"
diff --git a/src/Controller/Admin/AdminConfigController.php b/src/Controller/Admin/AdminConfigController.php
index 6d61d2afb..5cef96cb0 100644
--- a/src/Controller/Admin/AdminConfigController.php
+++ b/src/Controller/Admin/AdminConfigController.php
@@ -4,6 +4,7 @@
 
 namespace App\Controller\Admin;
 
+use App\Security\Voter\AuthorizationVoter;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Response;
@@ -18,6 +19,7 @@ public function __construct(
         private readonly bool $showScreenStatus,
         private readonly array $loginMethods,
         private readonly bool $enhancedPreview,
+        private readonly AuthorizationVoter $authorizationVoter,
     ) {}
 
     public function __invoke(): Response
@@ -28,6 +30,7 @@ public function __invoke(): Response
             'showScreenStatus' => $this->showScreenStatus,
             'loginMethods' => $this->loginMethods,
             'enhancedPreview' => $this->enhancedPreview,
+            'authorization' => $this->authorizationVoter->getAuthorization(),
         ]);
     }
 }
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 276401fbf..1032bc555 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -23,6 +23,11 @@ public function __construct(private readonly array $authorizationOverride, priva
         $this->authorization = array_replace($authorizationDefaults, $authorizationOverride);
     }
 
+    public function getAuthorization(): array
+    {
+        return $this->authorization;
+    }
+
     protected function supports(string $attribute, mixed $subject): bool
     {
         // https://symfony.com/doc/current/security/voters.html
@@ -31,7 +36,7 @@ protected function supports(string $attribute, mixed $subject): bool
         $entity = str_contains($subject::class, "App\\Entity\\Tenant\\");
 
         return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE])
-            && $dto || $entity;
+            && ($dto || $entity);
     }
 
     protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
@@ -46,7 +51,7 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
         $userRoles = $user->getRoles();
 
         $dto = str_contains($subject::class, "App\\Dto\\");
-        $entity = str_contains($subject::class, "App\\Entity\\");
+        $entity = str_contains($subject::class, "App\\Entity\\Tenant\\");
 
         $class = '';
         $createdBy = null;
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
index 15e79f0f2..95038af51 100644
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -4,7 +4,7 @@
 
 class AuthorizationVoterHelper
 {
-    private const editorClasses = [
+    private const array editorClasses = [
         "Screen",
         "ActivationCode",
         "Feed",
@@ -29,7 +29,7 @@ class AuthorizationVoterHelper
         "Template",
     ];
 
-    private const adminClasses = [
+    private const array adminClasses = [
         "Tenant",
         "Theme",
         "ThemeInput",

From 6119d8a3c8c56e5b86b746ee2ac81c78d2edae37 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 10:35:05 +0100
Subject: [PATCH 04/16] 6897: Remove OWN concept

---
 .env                                          | 22 ++++++++-----------
 assets/admin/app.jsx                          |  2 +-
 src/Security/Voter/AuthorizationVoter.php     | 11 ++++++----
 .../Voter/AuthorizationVoterHelper.php        | 13 +----------
 4 files changed, 18 insertions(+), 30 deletions(-)

diff --git a/.env b/.env
index a611e705a..04a258790 100644
--- a/.env
+++ b/.env
@@ -130,17 +130,13 @@ CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
 
-AUTHORIZATION_OVERRIDE='{}'
+#AUTHORIZATION_OVERRIDE='{}'
 # Example value:
-#AUTHORIZATION_OVERRIDE='{
-#  "Screen": {
-#    "EDIT": ["ROLE_ADMIN"],
-#    "EDIT_OWN": ["ROLE_EDITOR"],
-#    "VIEW": ["ROLE_EDITOR"],
-#    "VIEW_OWN": ["ROLE_EDITOR"],
-#    "CREATE": ["ROLE_ADMIN"],
-#    "CREATE_OWN": ["ROLE_EDITOR"],
-#    "DELETE": ["ROLE_ADMIN"],
-#    "DELETE_OWN": ["ROLE_EDITOR"]
-#  }
-#}'
+AUTHORIZATION_OVERRIDE='{
+  "Screen": {
+    "EDIT": ["ROLE_ADMIN"],
+    "VIEW": ["ROLE_EDITOR"],
+    "CREATE": ["ROLE_ADMIN"],
+    "DELETE": ["ROLE_ADMIN"]
+  }
+}'
diff --git a/assets/admin/app.jsx b/assets/admin/app.jsx
index 7c67ac413..3973b1a9a 100644
--- a/assets/admin/app.jsx
+++ b/assets/admin/app.jsx
@@ -70,7 +70,7 @@ function App() {
       roles: ["ROLE_ADMIN"],
     },
     screen: {
-      roles: ["ROLE_ADMIN"],
+      roles: ["ROLE_EDITOR"],
     },
     settings: {
       roles: ["ROLE_ADMIN"],
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 1032bc555..4102249af 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -66,10 +66,13 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
 
         $userIdentifier = $user->getUserIdentifier();
 
-        // Check authorization array for demands for $class, $attribute and $userIdentifier
-        // Permissions are different if the user is the creator of the object.
-        $actionKey = $attribute . ($userIdentifier === $createdBy ? self::OWN : '');
-        $requiredRoles = $this->authorization[$class][$actionKey];
+        // The creator has permission to use the object.
+        if ($userIdentifier === $createdBy) {
+            return true;
+        }
+
+        // Check the authorization array for demands for $class and $attribute.
+        $requiredRoles = $this->authorization[$class][$attribute];
 
         $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
 
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
index 95038af51..478460922 100644
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -6,12 +6,10 @@ class AuthorizationVoterHelper
 {
     private const array editorClasses = [
         "Screen",
-        "ActivationCode",
         "Feed",
         "FeedInput",
         "FeedSource",
         "FeedSourceInput",
-        "InteractiveSlideActionInput",
         "Media",
         "Playlist",
         "PlaylistInput",
@@ -30,6 +28,7 @@ class AuthorizationVoterHelper
     ];
 
     private const array adminClasses = [
+        "ActivationCode",
         "Tenant",
         "Theme",
         "ThemeInput",
@@ -44,31 +43,21 @@ public static function getAuthorizationDefaults(): array
     {
         $defaults = [];
 
-        // TODO: Adjust to sensible defaults.
-
         foreach (self::editorClasses as $class) {
             $defaults[$class] = [
                 AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::EDIT . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
                 AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
                 AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
                 AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE . AuthorizationVoter::OWN => ['ROLE_EDITOR'],
             ];
         }
 
         foreach (self::adminClasses as $class) {
             $defaults[$class] = [
                 AuthorizationVoter::EDIT => ['ROLE_ADMIN'],
-                AuthorizationVoter::EDIT . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
                 AuthorizationVoter::VIEW => ['ROLE_ADMIN'],
-                AuthorizationVoter::VIEW . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
                 AuthorizationVoter::CREATE => ['ROLE_ADMIN'],
-                AuthorizationVoter::CREATE . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
                 AuthorizationVoter::DELETE => ['ROLE_ADMIN'],
-                AuthorizationVoter::DELETE . AuthorizationVoter::OWN => ['ROLE_ADMIN'],
             ];
         }
 

From 56ccde0f76c1ba2c43bd6c5953db5785661465d4 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 10:58:27 +0100
Subject: [PATCH 05/16] 6897: Changed security for all api-platform entities

---
 config/api_platform/feed.yaml                   |  3 +++
 config/api_platform/feed_source.yaml            | 12 ++++++++----
 config/api_platform/layout.yaml                 |  2 ++
 config/api_platform/media.yaml                  |  4 ++++
 config/api_platform/playlist.yaml               |  5 +++++
 config/api_platform/playlist_screen_region.yaml |  8 ++++----
 config/api_platform/playlist_slide.yaml         |  6 ++++++
 config/api_platform/screen_campaign.yaml        |  8 +++++---
 config/api_platform/screen_groups.yaml          | 14 +++++++++-----
 config/api_platform/screen_groups_campaign.yaml |  8 +++++---
 config/api_platform/screen_layout_regions.yaml  |  2 ++
 config/api_platform/slide.yaml                  |  5 +++++
 config/api_platform/template.yaml               |  2 ++
 config/api_platform/tenant.yaml                 |  2 ++
 config/api_platform/theme.yaml                  |  9 +++++----
 config/api_platform/user-activation-code.yaml   | 12 ++++++------
 config/api_platform/user.yaml                   | 12 ++++++------
 17 files changed, 79 insertions(+), 35 deletions(-)

diff --git a/config/api_platform/feed.yaml b/config/api_platform/feed.yaml
index 954079915..c30d2a957 100644
--- a/config/api_platform/feed.yaml
+++ b/config/api_platform/feed.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 openapiContext:
                     operationId: get-feeds-id
                     description: Retrieves a feed resource.
@@ -32,6 +33,7 @@ resources:
             _api_Feed_get_data:
                 class: ApiPlatform\Metadata\Get
                 method: GET
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/feeds/{id}/data'
                 read: false
                 controller: App\Controller\Api\FeedGetDataController
@@ -69,6 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index e1eae068b..79f0f11bd 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -7,6 +7,7 @@ resources:
         processor: App\State\FeedSourceProcessor
         operations:
             ApiPlatform\Metadata\Get: &ref_0
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -31,6 +32,7 @@ resources:
                                     examples: null
                             headers: {}
             _api_Feed_get_source_config:
+                security: 'is_granted("VIEW", object)'
                 class: ApiPlatform\Metadata\Get
                 method: GET
                 uriTemplate: '/feed-sources/{id}/config/{name}'
@@ -68,6 +70,7 @@ resources:
                                                   value: value1
                             headers: {}
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -108,7 +111,7 @@ resources:
                                     examples: null
                             headers: {}
             ApiPlatform\Metadata\Put:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update a Feed Source resource.
                     summary: Update a Feed Source resource.
@@ -124,7 +127,7 @@ resources:
                           in: path
                           required: true
             ApiPlatform\Metadata\Delete:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Feed Source resource.
                     summary: Delete a Feed Source resource.
@@ -140,7 +143,7 @@ resources:
                           in: path
                           required: true
             ApiPlatform\Metadata\Post:
-                security: is_granted("ROLE_ADMIN")
+                security: 'is_granted("CREATE", object)'
                 openapiContext:
                     operationId: create-v2-feed-source
                     description: Creates a Feed Source resource.
@@ -148,6 +151,7 @@ resources:
                     tags:
                         - FeedSources
             '_api_/feed_sources/{id}/slides_get': &ref_1
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
@@ -164,7 +168,7 @@ resources:
                 uriTemplate: '/feed-sources/{id}/slides'
                 openapiContext:
                     description: Retrieves collection of weighted slide resources (feedsource).
-                    summary: Retrieves collection of weighted slide resources  (feedsource).
+                    summary: Retrieves collection of weighted slide resources (feedsource).
                     operationId: get-v2-feed-source-slide-id
                     tags:
                         - FeedSources
diff --git a/config/api_platform/layout.yaml b/config/api_platform/layout.yaml
index 46fcf23cc..98a17c937 100644
--- a/config/api_platform/layout.yaml
+++ b/config/api_platform/layout.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/layouts/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -32,6 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index ef1c96254..12d6cbbc0 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -7,6 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/media/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -33,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Media resource.
                     summary: Delete a Media resource.
@@ -49,6 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -84,6 +87,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", object)'
                 controller: App\Controller\Api\MediaController
                 deserialize: false
                 normalizationContext:
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index f68e743c7..d269d2fbe 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -10,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -35,6 +36,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update a Playlist resource.
                     summary: Update a Playlist resource.
@@ -51,6 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Playlist resource.
                     summary: Delete a Playlist resource.
@@ -67,6 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -100,6 +104,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", object)'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index d551b354b..8a09b8951 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -1,12 +1,11 @@
 ---
 resources:
     App\Entity\Tenant\PlaylistScreenRegion:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\PlaylistScreenRegion
 
         operations:
-            # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 # It needs to be here to generate ids in the collection lists.
                 uriTemplate: '/playlist-screen-regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -15,7 +14,7 @@ resources:
                     operationId: getPlaylistScreenRegionItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists/{playlistId}'
                 controller: App\Controller\Api\PlaylistScreenRegionDeleteController
                 read: false
@@ -52,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists'
                 controller: App\Controller\Api\PlaylistScreenRegionPutController
                 read: false
@@ -104,6 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index a8c00187e..29819ed18 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -6,6 +6,7 @@ resources:
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/playlist-slides/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -14,6 +15,7 @@ resources:
                     operationId: getPlaylistSlideItem
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", object)'
                 uriTemplate: '/playlists/{id}/slides/{slideId}'
                 controller: App\Controller\Api\PlaylistSlideDeleteController
                 read: false
@@ -42,6 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", object)'
                 uriTemplate: '/playlists/{id}/slides'
                 controller: App\Controller\Api\PlaylistSlidePutController
                 read: false
@@ -87,6 +90,7 @@ resources:
 
             # https://api-platform.com/docs/core/controllers/
             _api_/slides/{id}/playlists_get: &get_playlists
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['slides/playlists:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -136,6 +140,7 @@ resources:
                             headers: {}
 
             _api_/slides/{id}/playlists_put:
+                security: 'is_granted("EDIT", object)'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 filters:
@@ -179,6 +184,7 @@ resources:
                                                 description: Playlist ULID
 
             _api_/playlists/{id}/slides_get: &get_slides
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['playlist-slide:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index 24b367528..bca2eb2db 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -1,18 +1,18 @@
 ---
 resources:
     App\Entity\Tenant\ScreenCampaign:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\ScreenCampaign
 
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 uriTemplate: '/screens/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenCampaignDeleteController
                 read: false
@@ -41,7 +41,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 uriTemplate: '/screens/{id}/campaigns'
                 controller: App\Controller\Api\ScreenCampaignPutController
                 read: false
@@ -83,6 +83,7 @@ resources:
                                                     type: string
 
             _api_/screens/{id}/campaigns_get: &campaigns_get
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['screen-campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -133,6 +134,7 @@ resources:
                             headers: {}
 
             _api_/campaigns/{id}/screens_get: &screens_get
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['campaigns/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 56274eeb3..669ee0371 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -1,7 +1,6 @@
 ---
 resources:
     App\Entity\Tenant\ScreenGroup:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         input: App\Dto\ScreenGroupInput
         output: App\Dto\ScreenGroup
         provider: App\State\ScreenGroupProvider
@@ -11,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Retrieves a Screen group resource.
@@ -35,7 +35,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Update a Screen group resource.
@@ -53,7 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Delete a Screen group resource.
@@ -71,7 +71,7 @@ resources:
                           required: true
 
             _api_/screens/{id}/screen-groups_put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 uriTemplate: '/screens/{id}/screen-groups'
@@ -108,7 +108,7 @@ resources:
                                     examples:
 
             _api_/screens/{id}/screen-groups/{screenGroupId}_delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 class: ApiPlatform\Metadata\Delete
                 method: DELETE
                 uriTemplate: '/screens/{id}/screen-groups/{screenGroupId}'
@@ -139,6 +139,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -174,6 +175,7 @@ resources:
                             headers: {}
 
             _api_/screens/{id}/screen-groups_get: &get_screen_groups
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['screens/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -211,6 +213,7 @@ resources:
                           description: The number of items per page
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", object)'
                 uriTemplate: '/screen-groups'
                 openapiContext:
                     description: Create Screen group resources.
@@ -220,6 +223,7 @@ resources:
                         - ScreenGroups
 
             _api_/screen-groups/{id}/screens_get: &get_screens
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['screen-groups/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 0662937cd..8af514324 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -1,12 +1,12 @@
 ---
 resources:
     App\Entity\Tenant\ScreenGroupCampaign:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN")'
         output: App\Dto\ScreenGroupCampaign
 
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-groups-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenGroupCampaignItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 uriTemplate: '/screen-groups/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenGroupCampaignDeleteController
                 read: false
@@ -44,7 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 uriTemplate: '/screen-groups/{id}/campaigns'
                 controller: App\Controller\Api\ScreenGroupCampaignPutController
                 read: false
@@ -86,6 +86,7 @@ resources:
                                                     type: string
 
             getScreenGroupsCampaigns: &get_campaigns
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['screen-groups/campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -136,6 +137,7 @@ resources:
                             headers: {}
 
             getCampaignScreensGroups: &get_screen_groups
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['campaigns/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_layout_regions.yaml b/config/api_platform/screen_layout_regions.yaml
index a1c656708..618f7c060 100644
--- a/config/api_platform/screen_layout_regions.yaml
+++ b/config/api_platform/screen_layout_regions.yaml
@@ -7,6 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/layouts/regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
@@ -14,6 +15,7 @@ resources:
                     operationId: getScreenLayoutRegionsItem
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/layouts/regions'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 96328776d..1b9d09364 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -10,6 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 openapiContext:
                     operationId: get-v2-slide-id
                     description: Retrieves a Slide resource.
@@ -33,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
+                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update a Slide resource.
                     summary: Update a Slide resource.
@@ -49,6 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Slide resource.
                     summary: Delete a Slide resource.
@@ -65,6 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -101,6 +105,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
+                security: 'is_granted("CREATE", object)'
                 openapiContext:
                     operationId: create-v2-slides
                     description: Creates a Slide resource.
diff --git a/config/api_platform/template.yaml b/config/api_platform/template.yaml
index 718bbf9ff..483e0de63 100644
--- a/config/api_platform/template.yaml
+++ b/config/api_platform/template.yaml
@@ -8,6 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 openapiContext:
                     description: Retrieves a Template resource.
                     summary: Retrieve a Template resource.
@@ -31,6 +32,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/tenant.yaml b/config/api_platform/tenant.yaml
index 3a640e354..30381a0b0 100644
--- a/config/api_platform/tenant.yaml
+++ b/config/api_platform/tenant.yaml
@@ -6,6 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
+                security: 'is_granted("VIEW", object)'
                 openapiContext:
                     description: Retrieves a tenant resource.
                     summary: Retrieve a tenant resource.
@@ -29,6 +30,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 filters: ['entity.search_filter', 'entity.blameable_filter']
                 openapiContext:
                     operationId: get-v2-tenants
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 917e6956b..0164f86c0 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -1,13 +1,13 @@
 ---
 resources:
     App\Entity\Tenant\Theme:
-        security: 'is_granted("ROLE_SCREEN") or is_granted("ROLE_ADMIN") or is_granted("ROLE_EDITOR")'
         input: App\Dto\ThemeInput
         output: App\Dto\Theme
         processor: App\State\ThemeProcessor
         provider: App\State\ThemeProvider
 
         operations:
+            security: 'is_granted("VIEW", object)'
             ApiPlatform\Metadata\Get: &get
                 normalizationContext:
                     groups: ['theme:read']
@@ -34,6 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['theme:read']
                 filters:
@@ -71,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("EDIT", object)'
                 openapiContext:
                     description: Update a Theme resource.
                     summary: Update a Theme resource.
@@ -88,7 +89,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("DELETE", object)'
                 openapiContext:
                     description: Delete a Theme resource.
                     summary: Delete a Theme resource.
@@ -105,7 +106,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("ROLE_ADMIN")'
+                security: 'is_granted("CREATE", object)'
                 openapiContext:
                     operationId: create-v2-themes
                     description: Creates a Theme resource.
diff --git a/config/api_platform/user-activation-code.yaml b/config/api_platform/user-activation-code.yaml
index 5533be74d..f5cc2b994 100644
--- a/config/api_platform/user-activation-code.yaml
+++ b/config/api_platform/user-activation-code.yaml
@@ -8,14 +8,14 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                uriTemplate: /user-activation-codes/{id}
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
-            ApiPlatform\Metadata\Delete:
                 uriTemplate: /user-activation-codes/{id}
+            ApiPlatform\Metadata\Delete:
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes/{id}
             ApiPlatform\Metadata\Post:
-                uriTemplate: /user-activation-codes
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes
                 input: App\Dto\UserActivationCodeInput
                 processor: App\State\UserActivationCodeProcessor
                 openapiContext:
@@ -25,13 +25,13 @@ resources:
                     tags:
                         - UserActivationCode
             ApiPlatform\Metadata\GetCollection:
-                uriTemplate: /user-activation-codes
                 security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
+                uriTemplate: /user-activation-codes
             _api_/user-activation-codes/refresh_code:
+                security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
                 class: ApiPlatform\Metadata\Post
                 method: POST
                 uriTemplate: /user-activation-codes/refresh
-                security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
                 controller: App\Controller\Api\UserRefreshCodeController
                 input: App\Dto\ActivationCode
                 openapiContext:
@@ -41,10 +41,10 @@ resources:
                     tags:
                         - UserActivationCode
             _api_/user-activation-codes/activate:
+                security: 'is_granted("ROLE_USER")'
                 class: ApiPlatform\Metadata\Post
                 method: POST
                 uriTemplate: /user-activation-codes/activate
-                security: 'is_granted("ROLE_USER")'
                 controller: App\Controller\Api\UserActivateController
                 input: App\Dto\ActivationCode
                 openapiContext:
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index a04b62987..47013a9ba 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -1,14 +1,13 @@
 ---
 resources:
     App\Entity\User:
-        security: 'is_granted("ROLE_EXTERNAL_USER_ADMIN")'
         input: App\Dto\UserInput
         output: App\Dto\User
         provider: App\State\UserProvider
         operations:
             ApiPlatform\Metadata\Get: &get
-                uriTemplate: '/users/{id}'
                 security: 'is_granted("VIEW", object)'
+                uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Retrieves User resource.
                     summary: Retrieve User resource.
@@ -30,8 +29,8 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\PUT:
-                uriTemplate: '/users/{id}'
                 security: 'is_granted("EDIT", object)'
+                uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Update User resource.
                     summary: Update User resource.
@@ -46,8 +45,8 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\DELETE:
-                uriTemplate: '/users/{id}'
                 security: 'is_granted("DELETE", object)'
+                uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Delete an User resource.
                     summary: Delete an User resource.
@@ -62,10 +61,10 @@ resources:
                           required: true
 
             _api_/users/{id}/remove_from_tenant:
+                security: 'is_granted("EDIT", object)'
                 class: ApiPlatform\Metadata\Delete
                 uriTemplate: '/users/{id}/remove-from-tenant'
                 method: 'DELETE'
-                security: 'is_granted("EDIT", object)'
                 controller: App\Controller\Api\UserRemoveFromTenantController
                 openapiContext:
                     description: Remove a User resource from the current tenant.
@@ -84,6 +83,7 @@ resources:
                             description: User removed from tenant
 
             ApiPlatform\Metadata\GetCollection:
+                security: 'is_granted("VIEW", object)'
                 uriTemplate: '/users'
                 filters:
                     - 'user.search_filter'
@@ -118,8 +118,8 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\POST:
-                uriTemplate: '/users'
                 security: 'is_granted("CREATE", object)'
+                uriTemplate: '/users'
                 openapiContext:
                     description: Create a User resource.
                     summary: Create a User resource.

From f8ef493bc53c0628b49e9fd1e2753c55004c0cff Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 11:18:53 +0100
Subject: [PATCH 06/16] 6897: Placed security entry correctly

---
 config/api_platform/feed_source.yaml | 8 +++++++-
 config/api_platform/theme.yaml       | 2 +-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index 79f0f11bd..d0d943b99 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -31,6 +31,7 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             _api_Feed_get_source_config:
                 security: 'is_granted("VIEW", object)'
                 class: ApiPlatform\Metadata\Get
@@ -69,6 +70,7 @@ resources:
                                                   id: id1
                                                   value: value1
                             headers: {}
+
             ApiPlatform\Metadata\GetCollection:
                 security: 'is_granted("VIEW", object)'
                 filters:
@@ -100,7 +102,7 @@ resources:
                           description: The number of items per page
                         - schema:
                               type: string
-                          pattern: '^[A-Za-z0-9]*$'
+                              pattern: '^[A-Za-z0-9]*$'
                           name: supportedFeedOutputType
                           in: query
                     responses:
@@ -110,6 +112,7 @@ resources:
                                 application/ld+json:
                                     examples: null
                             headers: {}
+
             ApiPlatform\Metadata\Put:
                 security: 'is_granted("EDIT", object)'
                 openapiContext:
@@ -126,6 +129,7 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Delete:
                 security: 'is_granted("DELETE", object)'
                 openapiContext:
@@ -142,6 +146,7 @@ resources:
                           name: id
                           in: path
                           required: true
+
             ApiPlatform\Metadata\Post:
                 security: 'is_granted("CREATE", object)'
                 openapiContext:
@@ -150,6 +155,7 @@ resources:
                     summary: Creates a Feed Source resource.
                     tags:
                         - FeedSources
+
             '_api_/feed_sources/{id}/slides_get': &ref_1
                 security: 'is_granted("VIEW", object)'
                 normalizationContext:
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 0164f86c0..fd01d7b9e 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -7,8 +7,8 @@ resources:
         provider: App\State\ThemeProvider
 
         operations:
-            security: 'is_granted("VIEW", object)'
             ApiPlatform\Metadata\Get: &get
+                security: 'is_granted("VIEW", object)'
                 normalizationContext:
                     groups: ['theme:read']
                 openapiContext:

From fd47a25846ef94a878f5c31c2f639e4e853c8536 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 12:42:21 +0100
Subject: [PATCH 07/16] 6897: Started work on handling lists

---
 assets/admin/app.jsx                          |  2 +-
 assets/admin/components/restricted-route.jsx  |  3 +++
 config/api_platform/feed.yaml                 |  2 +-
 config/api_platform/feed_source.yaml          |  4 ++--
 config/api_platform/layout.yaml               |  2 +-
 config/api_platform/media.yaml                |  2 +-
 config/api_platform/playlist.yaml             |  2 +-
 .../api_platform/playlist_screen_region.yaml  |  2 +-
 config/api_platform/playlist_slide.yaml       |  4 ++--
 config/api_platform/screen.yaml               |  4 ++--
 config/api_platform/screen_campaign.yaml      |  4 ++--
 config/api_platform/screen_groups.yaml        |  6 ++---
 .../api_platform/screen_groups_campaign.yaml  |  4 ++--
 .../api_platform/screen_layout_regions.yaml   |  2 +-
 config/api_platform/slide.yaml                |  2 +-
 config/api_platform/template.yaml             |  2 +-
 config/api_platform/tenant.yaml               |  2 +-
 config/api_platform/theme.yaml                |  2 +-
 config/api_platform/user.yaml                 |  2 +-
 src/Security/Voter/AuthorizationVoter.php     | 24 +++++++++++--------
 20 files changed, 42 insertions(+), 35 deletions(-)

diff --git a/assets/admin/app.jsx b/assets/admin/app.jsx
index 3973b1a9a..988558ba5 100644
--- a/assets/admin/app.jsx
+++ b/assets/admin/app.jsx
@@ -70,7 +70,7 @@ function App() {
       roles: ["ROLE_ADMIN"],
     },
     screen: {
-      roles: ["ROLE_EDITOR"],
+      roles: ["ROLE_EDITOR", "ROLE_ADMIN"],
     },
     settings: {
       roles: ["ROLE_ADMIN"],
diff --git a/assets/admin/components/restricted-route.jsx b/assets/admin/components/restricted-route.jsx
index eb2ef3b12..1a45bc4c8 100644
--- a/assets/admin/components/restricted-route.jsx
+++ b/assets/admin/components/restricted-route.jsx
@@ -17,6 +17,9 @@ function RestrictedRoute({ children, roles }) {
   const userHasRequiredRole = context.selectedTenant.get?.roles.find((value) =>
     roles.includes(value),
   );
+
+  console.log("asd", roles, userHasRequiredRole, context.selectedTenant.get?.roles);
+
   if (context.authenticated.get && !userHasRequiredRole) {
     return <NoAccess />;
   }
diff --git a/config/api_platform/feed.yaml b/config/api_platform/feed.yaml
index c30d2a957..a3229a18b 100644
--- a/config/api_platform/feed.yaml
+++ b/config/api_platform/feed.yaml
@@ -71,7 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "FEED")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index d0d943b99..1702b3fa4 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -72,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "FEED_SOURCE")'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -157,7 +157,7 @@ resources:
                         - FeedSources
 
             '_api_/feed_sources/{id}/slides_get': &ref_1
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "FEED_SOURCE_SLIDES")'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
diff --git a/config/api_platform/layout.yaml b/config/api_platform/layout.yaml
index 98a17c937..184a18db2 100644
--- a/config/api_platform/layout.yaml
+++ b/config/api_platform/layout.yaml
@@ -33,7 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "LAYOUT")'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index 12d6cbbc0..210f48e19 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "MEDIA")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index d269d2fbe..4592e416d 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -70,7 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "PLAYLIST")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index 8a09b8951..3216db53f 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -103,7 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "PLAYLIST_SCREEN_REGION")'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index 29819ed18..4d3159192 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -90,7 +90,7 @@ resources:
 
             # https://api-platform.com/docs/core/controllers/
             _api_/slides/{id}/playlists_get: &get_playlists
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SLIDE_PLAYLIST")'
                 normalizationContext:
                     groups: ['slides/playlists:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -184,7 +184,7 @@ resources:
                                                 description: Playlist ULID
 
             _api_/playlists/{id}/slides_get: &get_slides
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "PLAYLIST_SLIDE")'
                 normalizationContext:
                     groups: ['playlist-slide:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 1a22301f5..3089055fd 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -8,7 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SCREEN", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN")'
                 filters:
                     - 'App\Filter\MultipleSearchFilter'
                     - 'screen.screen_user_exists_filter'
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index bca2eb2db..1e063f9b9 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -83,7 +83,7 @@ resources:
                                                     type: string
 
             _api_/screens/{id}/campaigns_get: &campaigns_get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_CAMPAIGN")'
                 normalizationContext:
                     groups: ['screen-campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -134,7 +134,7 @@ resources:
                             headers: {}
 
             _api_/campaigns/{id}/screens_get: &screens_get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "CAMPAIGN_SCREEN")'
                 normalizationContext:
                     groups: ['campaigns/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 669ee0371..0b8a19f8e 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -139,7 +139,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_GROUP")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -175,7 +175,7 @@ resources:
                             headers: {}
 
             _api_/screens/{id}/screen-groups_get: &get_screen_groups
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_SCREEN_GROUP")'
                 normalizationContext:
                     groups: ['screens/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -223,7 +223,7 @@ resources:
                         - ScreenGroups
 
             _api_/screen-groups/{id}/screens_get: &get_screens
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_GROUP_SCREEN")'
                 normalizationContext:
                     groups: ['screen-groups/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 8af514324..8e60ea373 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -86,7 +86,7 @@ resources:
                                                     type: string
 
             getScreenGroupsCampaigns: &get_campaigns
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_GROUP_CAMPAIGN")'
                 normalizationContext:
                     groups: ['screen-groups/campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -137,7 +137,7 @@ resources:
                             headers: {}
 
             getCampaignScreensGroups: &get_screen_groups
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "CAMPAIGN_SCREEN_GROUP")'
                 normalizationContext:
                     groups: ['campaigns/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_layout_regions.yaml b/config/api_platform/screen_layout_regions.yaml
index 618f7c060..526f79e4f 100644
--- a/config/api_platform/screen_layout_regions.yaml
+++ b/config/api_platform/screen_layout_regions.yaml
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenLayoutRegionsItem
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SCREEN_LAYOUT_REGION")'
                 uriTemplate: '/layouts/regions'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 1b9d09364..64ba3b9dc 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "SLIDE")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/template.yaml b/config/api_platform/template.yaml
index 483e0de63..1730f58d0 100644
--- a/config/api_platform/template.yaml
+++ b/config/api_platform/template.yaml
@@ -32,7 +32,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "TEMPLATE")'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/tenant.yaml b/config/api_platform/tenant.yaml
index 30381a0b0..15d139b3d 100644
--- a/config/api_platform/tenant.yaml
+++ b/config/api_platform/tenant.yaml
@@ -30,7 +30,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "TENANT")'
                 filters: ['entity.search_filter', 'entity.blameable_filter']
                 openapiContext:
                     operationId: get-v2-tenants
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index fd01d7b9e..1dbedee16 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "THEME")'
                 normalizationContext:
                     groups: ['theme:read']
                 filters:
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index 47013a9ba..2d06cda19 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -83,7 +83,7 @@ resources:
                             description: User removed from tenant
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("LIST", "USER")'
                 uriTemplate: '/users'
                 filters:
                     - 'user.search_filter'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 4102249af..91015f210 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -2,18 +2,18 @@
 
 namespace App\Security\Voter;
 
-use App\Dto\Screen;
+use ApiPlatform\State\Pagination\TraversablePaginator;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
 use Symfony\Component\Security\Core\User\UserInterface;
 
 final class AuthorizationVoter extends Voter {
-    public const EDIT = 'EDIT';
-    public const VIEW = 'VIEW';
-    public const CREATE = 'CREATE';
-    public const DELETE = 'DELETE';
-    public const OWN = '_OWN';
+    public const string EDIT = 'EDIT';
+    public const string VIEW = 'VIEW';
+    public const string LIST = 'LIST';
+    public const string CREATE = 'CREATE';
+    public const string DELETE = 'DELETE';
 
     private array $authorization;
 
@@ -32,11 +32,11 @@ protected function supports(string $attribute, mixed $subject): bool
     {
         // https://symfony.com/doc/current/security/voters.html
 
-        $dto = str_contains($subject::class, "App\\Dto\\");
-        $entity = str_contains($subject::class, "App\\Entity\\Tenant\\");
+        if ($attribute === self::LIST && $subject instanceof TraversablePaginator) {
+            return true;
+        }
 
-        return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE])
-            && ($dto || $entity);
+        return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE]);
     }
 
     protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
@@ -48,6 +48,10 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
             return false;
         }
 
+        if ($attribute === self::VIEW) {
+            return true;
+        }
+
         $userRoles = $user->getRoles();
 
         $dto = str_contains($subject::class, "App\\Dto\\");

From baf53ec473f4c0b563bbb11fb7660b900bd19a6b Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 12:52:01 +0100
Subject: [PATCH 08/16] 6897: Added object to list and view security entries

---
 config/api_platform/feed.yaml                   | 6 +++---
 config/api_platform/feed_source.yaml            | 8 ++++----
 config/api_platform/layout.yaml                 | 4 ++--
 config/api_platform/media.yaml                  | 4 ++--
 config/api_platform/playlist.yaml               | 4 ++--
 config/api_platform/playlist_screen_region.yaml | 4 ++--
 config/api_platform/playlist_slide.yaml         | 6 +++---
 config/api_platform/screen.yaml                 | 2 +-
 config/api_platform/screen_campaign.yaml        | 6 +++---
 config/api_platform/screen_groups.yaml          | 8 ++++----
 config/api_platform/screen_groups_campaign.yaml | 6 +++---
 config/api_platform/screen_layout_regions.yaml  | 4 ++--
 config/api_platform/slide.yaml                  | 4 ++--
 config/api_platform/template.yaml               | 4 ++--
 config/api_platform/tenant.yaml                 | 4 ++--
 config/api_platform/theme.yaml                  | 4 ++--
 config/api_platform/user.yaml                   | 4 ++--
 17 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/config/api_platform/feed.yaml b/config/api_platform/feed.yaml
index a3229a18b..00bc9ba32 100644
--- a/config/api_platform/feed.yaml
+++ b/config/api_platform/feed.yaml
@@ -6,7 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 openapiContext:
                     operationId: get-feeds-id
                     description: Retrieves a feed resource.
@@ -33,7 +33,7 @@ resources:
             _api_Feed_get_data:
                 class: ApiPlatform\Metadata\Get
                 method: GET
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "FEED", object: object})'
                 uriTemplate: '/feeds/{id}/data'
                 read: false
                 controller: App\Controller\Api\FeedGetDataController
@@ -71,7 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "FEED")'
+                security: 'is_granted("LIST", {type: "FEED"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index 1702b3fa4..ed7935a57 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -7,7 +7,7 @@ resources:
         processor: App\State\FeedSourceProcessor
         operations:
             ApiPlatform\Metadata\Get: &ref_0
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -33,7 +33,7 @@ resources:
                             headers: {}
 
             _api_Feed_get_source_config:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "FEED_SOURCE", object: object})'
                 class: ApiPlatform\Metadata\Get
                 method: GET
                 uriTemplate: '/feed-sources/{id}/config/{name}'
@@ -72,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "FEED_SOURCE")'
+                security: 'is_granted("LIST", {type: "FEED_SOURCE"})'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -157,7 +157,7 @@ resources:
                         - FeedSources
 
             '_api_/feed_sources/{id}/slides_get': &ref_1
-                security: 'is_granted("LIST", "FEED_SOURCE_SLIDES")'
+                security: 'is_granted("LIST", {type: "FEED_SOURCE_SLIDES"})'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
diff --git a/config/api_platform/layout.yaml b/config/api_platform/layout.yaml
index 184a18db2..5ce22511e 100644
--- a/config/api_platform/layout.yaml
+++ b/config/api_platform/layout.yaml
@@ -6,7 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -33,7 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "LAYOUT")'
+                security: 'is_granted("LIST", {type: "LAYOUT"})'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index 210f48e19..578202eff 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -7,7 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "MEDIA", object: object})'
                 uriTemplate: '/media/{id}'
                 normalizationContext:
                     jsonld_embed_context: true
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "MEDIA")'
+                security: 'is_granted("LIST", {type: "MEDIA"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index 4592e416d..bf104e216 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -10,7 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
@@ -70,7 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "PLAYLIST")'
+                security: 'is_granted("LIST", {type: "PLAYLIST"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index 3216db53f..e247cc258 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -5,7 +5,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 # It needs to be here to generate ids in the collection lists.
                 uriTemplate: '/playlist-screen-regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -103,7 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
-                security: 'is_granted("LIST", "PLAYLIST_SCREEN_REGION")'
+                security: 'is_granted("LIST", {type: "PLAYLIST_SCREEN_REGION"})'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index 4d3159192..cd53bca8f 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -6,7 +6,7 @@ resources:
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "PLAYLIST_SLIDE", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/playlist-slides/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -90,7 +90,7 @@ resources:
 
             # https://api-platform.com/docs/core/controllers/
             _api_/slides/{id}/playlists_get: &get_playlists
-                security: 'is_granted("LIST", "SLIDE_PLAYLIST")'
+                security: 'is_granted("LIST", {type: "SLIDE_PLAYLIST"})'
                 normalizationContext:
                     groups: ['slides/playlists:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -184,7 +184,7 @@ resources:
                                                 description: Playlist ULID
 
             _api_/playlists/{id}/slides_get: &get_slides
-                security: 'is_granted("LIST", "PLAYLIST_SLIDE")'
+                security: 'is_granted("LIST", {type: "PLAYLIST_SLIDE"})'
                 normalizationContext:
                     groups: ['playlist-slide:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 3089055fd..164f656f8 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "SCREEN")'
+                security: 'is_granted("LIST", {type: "SCREEN"})'
                 filters:
                     - 'App\Filter\MultipleSearchFilter'
                     - 'screen.screen_user_exists_filter'
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index 1e063f9b9..2ec3319cb 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -6,7 +6,7 @@ resources:
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SCREEN_CAMPAIGN", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -83,7 +83,7 @@ resources:
                                                     type: string
 
             _api_/screens/{id}/campaigns_get: &campaigns_get
-                security: 'is_granted("LIST", "SCREEN_CAMPAIGN")'
+                security: 'is_granted("LIST", {type: "SCREEN_CAMPAIGN"})'
                 normalizationContext:
                     groups: ['screen-campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -134,7 +134,7 @@ resources:
                             headers: {}
 
             _api_/campaigns/{id}/screens_get: &screens_get
-                security: 'is_granted("LIST", "CAMPAIGN_SCREEN")'
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN"})'
                 normalizationContext:
                     groups: ['campaigns/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 0b8a19f8e..90c19131d 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -10,7 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Retrieves a Screen group resource.
@@ -139,7 +139,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "SCREEN_GROUP")'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -175,7 +175,7 @@ resources:
                             headers: {}
 
             _api_/screens/{id}/screen-groups_get: &get_screen_groups
-                security: 'is_granted("LIST", "SCREEN_SCREEN_GROUP")'
+                security: 'is_granted("LIST", {type: "SCREEN_SCREEN_GROUP"})'
                 normalizationContext:
                     groups: ['screens/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -223,7 +223,7 @@ resources:
                         - ScreenGroups
 
             _api_/screen-groups/{id}/screens_get: &get_screens
-                security: 'is_granted("LIST", "SCREEN_GROUP_SCREEN")'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_SCREEN"})'
                 normalizationContext:
                     groups: ['screen-groups/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 8e60ea373..04523a0c1 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -6,7 +6,7 @@ resources:
         operations:
             # prettier-ignore
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 # It needs to be here to generate id's in the collection lists.
                 uriTemplate: '/screen-groups-campaigns/{id}'
                 controller: App\Controller\Api\NotFoundAction
@@ -86,7 +86,7 @@ resources:
                                                     type: string
 
             getScreenGroupsCampaigns: &get_campaigns
-                security: 'is_granted("LIST", "SCREEN_GROUP_CAMPAIGN")'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_CAMPAIGN"})'
                 normalizationContext:
                     groups: ['screen-groups/campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -137,7 +137,7 @@ resources:
                             headers: {}
 
             getCampaignScreensGroups: &get_screen_groups
-                security: 'is_granted("LIST", "CAMPAIGN_SCREEN_GROUP")'
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN_GROUP"})'
                 normalizationContext:
                     groups: ['campaigns/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_layout_regions.yaml b/config/api_platform/screen_layout_regions.yaml
index 526f79e4f..72686675a 100644
--- a/config/api_platform/screen_layout_regions.yaml
+++ b/config/api_platform/screen_layout_regions.yaml
@@ -7,7 +7,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SCREEN_LAYOUT_REGIONS", object: object})'
                 uriTemplate: '/layouts/regions/{id}'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenLayoutRegionsItem
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "SCREEN_LAYOUT_REGION")'
+                security: 'is_granted("LIST", {type: "SCREEN_LAYOUT_REGION"})'
                 uriTemplate: '/layouts/regions'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 64ba3b9dc..7dc6fe9ab 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -10,7 +10,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "SLIDE", object: object})'
                 openapiContext:
                     operationId: get-v2-slide-id
                     description: Retrieves a Slide resource.
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "SLIDE")'
+                security: 'is_granted("LIST", {type: "SLIDE"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/template.yaml b/config/api_platform/template.yaml
index 1730f58d0..5b7aad080 100644
--- a/config/api_platform/template.yaml
+++ b/config/api_platform/template.yaml
@@ -8,7 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "TEMPLATE", object: object})'
                 openapiContext:
                     description: Retrieves a Template resource.
                     summary: Retrieve a Template resource.
@@ -32,7 +32,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "TEMPLATE")'
+                security: 'is_granted("LIST", {type: "TEMPLATE"})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/tenant.yaml b/config/api_platform/tenant.yaml
index 15d139b3d..c58688965 100644
--- a/config/api_platform/tenant.yaml
+++ b/config/api_platform/tenant.yaml
@@ -6,7 +6,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get:
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "TENANT", object: object})'
                 openapiContext:
                     description: Retrieves a tenant resource.
                     summary: Retrieve a tenant resource.
@@ -30,7 +30,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "TENANT")'
+                security: 'is_granted("LIST", {type: "TENANT"})'
                 filters: ['entity.search_filter', 'entity.blameable_filter']
                 openapiContext:
                     operationId: get-v2-tenants
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 1dbedee16..242211927 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -8,7 +8,7 @@ resources:
 
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "THEME", object: object})'
                 normalizationContext:
                     groups: ['theme:read']
                 openapiContext:
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "THEME")'
+                security: 'is_granted("LIST", {type: "THEME"})'
                 normalizationContext:
                     groups: ['theme:read']
                 filters:
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index 2d06cda19..c34e8f361 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -6,7 +6,7 @@ resources:
         provider: App\State\UserProvider
         operations:
             ApiPlatform\Metadata\Get: &get
-                security: 'is_granted("VIEW", object)'
+                security: 'is_granted("VIEW", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Retrieves User resource.
@@ -83,7 +83,7 @@ resources:
                             description: User removed from tenant
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", "USER")'
+                security: 'is_granted("LIST", {type: "USER"})'
                 uriTemplate: '/users'
                 filters:
                     - 'user.search_filter'

From feeab71aeca2b64279ae190b06db57947a23b909 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 12:55:47 +0100
Subject: [PATCH 09/16] 6897: Changed edit and delete operations to use object
 as subject

---
 config/api_platform/feed_source.yaml            | 4 ++--
 config/api_platform/media.yaml                  | 2 +-
 config/api_platform/playlist.yaml               | 4 ++--
 config/api_platform/playlist_screen_region.yaml | 4 ++--
 config/api_platform/playlist_slide.yaml         | 6 +++---
 config/api_platform/screen.yaml                 | 4 ++--
 config/api_platform/screen_campaign.yaml        | 4 ++--
 config/api_platform/screen_groups.yaml          | 8 ++++----
 config/api_platform/screen_groups_campaign.yaml | 4 ++--
 config/api_platform/slide.yaml                  | 4 ++--
 config/api_platform/theme.yaml                  | 4 ++--
 config/api_platform/user.yaml                   | 6 +++---
 12 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index ed7935a57..1da7bb796 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -114,7 +114,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Update a Feed Source resource.
                     summary: Update a Feed Source resource.
@@ -131,7 +131,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     description: Delete a Feed Source resource.
                     summary: Delete a Feed Source resource.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index 578202eff..2ad07c91b 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "MEDIA", object: object})'
                 openapiContext:
                     description: Delete a Media resource.
                     summary: Delete a Media resource.
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index bf104e216..aecb9ede3 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -36,7 +36,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Update a Playlist resource.
                     summary: Update a Playlist resource.
@@ -53,7 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "PLAYLIST", object: object})'
                 openapiContext:
                     description: Delete a Playlist resource.
                     summary: Delete a Playlist resource.
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index e247cc258..8ba2ec784 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -14,7 +14,7 @@ resources:
                     operationId: getPlaylistScreenRegionItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists/{playlistId}'
                 controller: App\Controller\Api\PlaylistScreenRegionDeleteController
                 read: false
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 uriTemplate: '/screens/{id}/regions/{regionId}/playlists'
                 controller: App\Controller\Api\PlaylistScreenRegionPutController
                 read: false
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index cd53bca8f..3ed2850c4 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -15,7 +15,7 @@ resources:
                     operationId: getPlaylistSlideItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "PLAYLIST_SLIDE", object: object})'
                 uriTemplate: '/playlists/{id}/slides/{slideId}'
                 controller: App\Controller\Api\PlaylistSlideDeleteController
                 read: false
@@ -44,7 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SLIDE", object: object})'
                 uriTemplate: '/playlists/{id}/slides'
                 controller: App\Controller\Api\PlaylistSlidePutController
                 read: false
@@ -140,7 +140,7 @@ resources:
                             headers: {}
 
             _api_/slides/{id}/playlists_put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "PLAYLIST_SLIDE", object: object})'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 filters:
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 164f656f8..69fc5e9a7 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SCREEN", object: object})'
                 openapiContext:
                     description: Update a Screen resource.
                     summary: Update a Screen resource.
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SCREEN", object: object})'
                 openapiContext:
                     description: Delete a Screen resource.
                     summary: Delete a Screen resource.
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index 2ec3319cb..3ae58c7ae 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -12,7 +12,7 @@ resources:
                 controller: App\Controller\Api\NotFoundAction
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SCREEN_CAMPAIGN", object: object})'
                 uriTemplate: '/screens/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenCampaignDeleteController
                 read: false
@@ -41,7 +41,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SCREEN_CAMPAIGN", object: object})'
                 uriTemplate: '/screens/{id}/campaigns'
                 controller: App\Controller\Api\ScreenCampaignPutController
                 read: false
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 90c19131d..287b67b9e 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -35,7 +35,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Update a Screen group resource.
@@ -53,7 +53,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups/{id}'
                 openapiContext:
                     description: Delete a Screen group resource.
@@ -71,7 +71,7 @@ resources:
                           required: true
 
             _api_/screens/{id}/screen-groups_put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP", object: object})'
                 class: ApiPlatform\Metadata\Put
                 method: PUT
                 uriTemplate: '/screens/{id}/screen-groups'
@@ -108,7 +108,7 @@ resources:
                                     examples:
 
             _api_/screens/{id}/screen-groups/{screenGroupId}_delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP", object: object})'
                 class: ApiPlatform\Metadata\Delete
                 method: DELETE
                 uriTemplate: '/screens/{id}/screen-groups/{screenGroupId}'
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 04523a0c1..51be48930 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenGroupCampaignItem
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 uriTemplate: '/screen-groups/{id}/campaigns/{campaignId}'
                 controller: App\Controller\Api\ScreenGroupCampaignDeleteController
                 read: false
@@ -44,7 +44,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 uriTemplate: '/screen-groups/{id}/campaigns'
                 controller: App\Controller\Api\ScreenGroupCampaignPutController
                 read: false
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 7dc6fe9ab..aba03debe 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "SLIDE", object: object})'
                 openapiContext:
                     description: Update a Slide resource.
                     summary: Update a Slide resource.
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "SLIDE", object: object})'
                 openapiContext:
                     description: Delete a Slide resource.
                     summary: Delete a Slide resource.
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 242211927..36fde49df 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -72,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Put:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "THEME", object: object})'
                 openapiContext:
                     description: Update a Theme resource.
                     summary: Update a Theme resource.
@@ -89,7 +89,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Delete:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "THEME", object: object})'
                 openapiContext:
                     description: Delete a Theme resource.
                     summary: Delete a Theme resource.
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index c34e8f361..3f7694d7d 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -29,7 +29,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\PUT:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Update User resource.
@@ -45,7 +45,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\DELETE:
-                security: 'is_granted("DELETE", object)'
+                security: 'is_granted("DELETE", {type: "USER", object: object})'
                 uriTemplate: '/users/{id}'
                 openapiContext:
                     description: Delete an User resource.
@@ -61,7 +61,7 @@ resources:
                           required: true
 
             _api_/users/{id}/remove_from_tenant:
-                security: 'is_granted("EDIT", object)'
+                security: 'is_granted("EDIT", {type: "USER", object: object})'
                 class: ApiPlatform\Metadata\Delete
                 uriTemplate: '/users/{id}/remove-from-tenant'
                 method: 'DELETE'

From 6f6760cff1d744a87790cd7055136c044a2eb6d9 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 13:47:46 +0100
Subject: [PATCH 10/16] 6897: Aligned is granted structure

---
 .env                                          |  2 +-
 config/api_platform/feed.yaml                 |  2 +-
 config/api_platform/feed_source.yaml          |  4 +-
 config/api_platform/layout.yaml               |  2 +-
 config/api_platform/media.yaml                |  2 +-
 config/api_platform/playlist.yaml             |  2 +-
 .../api_platform/playlist_screen_region.yaml  |  2 +-
 config/api_platform/playlist_slide.yaml       |  4 +-
 config/api_platform/screen.yaml               |  2 +-
 config/api_platform/screen_campaign.yaml      |  4 +-
 config/api_platform/screen_groups.yaml        |  6 +--
 .../api_platform/screen_groups_campaign.yaml  |  4 +-
 .../api_platform/screen_layout_regions.yaml   |  2 +-
 config/api_platform/slide.yaml                |  2 +-
 config/api_platform/template.yaml             |  2 +-
 config/api_platform/tenant.yaml               |  2 +-
 config/api_platform/theme.yaml                |  2 +-
 config/api_platform/user.yaml                 |  2 +-
 src/Security/Voter/AuthorizationVoter.php     | 43 +++++++++++--------
 19 files changed, 50 insertions(+), 41 deletions(-)

diff --git a/.env b/.env
index 04a258790..adfb74794 100644
--- a/.env
+++ b/.env
@@ -133,7 +133,7 @@ CLIENT_DEBUG=false
 #AUTHORIZATION_OVERRIDE='{}'
 # Example value:
 AUTHORIZATION_OVERRIDE='{
-  "Screen": {
+  "SCREEN": {
     "EDIT": ["ROLE_ADMIN"],
     "VIEW": ["ROLE_EDITOR"],
     "CREATE": ["ROLE_ADMIN"],
diff --git a/config/api_platform/feed.yaml b/config/api_platform/feed.yaml
index 00bc9ba32..ac5f9827d 100644
--- a/config/api_platform/feed.yaml
+++ b/config/api_platform/feed.yaml
@@ -71,7 +71,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "FEED"})'
+                security: 'is_granted("LIST", {type: "FEED", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index 1da7bb796..40e94f23f 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -72,7 +72,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "FEED_SOURCE"})'
+                security: 'is_granted("LIST", {type: "FEED_SOURCE", object: object})'
                 filters:
                     - entity.search_filter
                     - entity.blameable_filter
@@ -157,7 +157,7 @@ resources:
                         - FeedSources
 
             '_api_/feed_sources/{id}/slides_get': &ref_1
-                security: 'is_granted("LIST", {type: "FEED_SOURCE_SLIDES"})'
+                security: 'is_granted("LIST", {type: "FEED_SOURCE_SLIDES", object: object})'
                 normalizationContext:
                     groups:
                         - 'playlist-slide:read'
diff --git a/config/api_platform/layout.yaml b/config/api_platform/layout.yaml
index 5ce22511e..a8c8b4734 100644
--- a/config/api_platform/layout.yaml
+++ b/config/api_platform/layout.yaml
@@ -33,7 +33,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "LAYOUT"})'
+                security: 'is_granted("LIST", {type: "LAYOUT", object: object})'
                 uriTemplate: '/layouts'
                 openapiContext:
                     description: Retrieve a collection of layouts resources.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index 2ad07c91b..75dfe8736 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -51,7 +51,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "MEDIA"})'
+                security: 'is_granted("LIST", {type: "MEDIA", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index aecb9ede3..a78d3dd48 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -70,7 +70,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "PLAYLIST"})'
+                security: 'is_granted("LIST", {type: "PLAYLIST", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/playlist_screen_region.yaml b/config/api_platform/playlist_screen_region.yaml
index 8ba2ec784..f654c3af1 100644
--- a/config/api_platform/playlist_screen_region.yaml
+++ b/config/api_platform/playlist_screen_region.yaml
@@ -103,7 +103,7 @@ resources:
                             description: 'Not found'
 
             ApiPlatform\Metadata\GetCollection: &get_collection
-                security: 'is_granted("LIST", {type: "PLAYLIST_SCREEN_REGION"})'
+                security: 'is_granted("LIST", {type: "PLAYLIST_SCREEN_REGION", object: object})'
                 normalizationContext:
                     groups: ['playlist-screen-region:read']
                 provider: App\State\PlaylistScreenRegionProvider
diff --git a/config/api_platform/playlist_slide.yaml b/config/api_platform/playlist_slide.yaml
index 3ed2850c4..04db6a1b9 100644
--- a/config/api_platform/playlist_slide.yaml
+++ b/config/api_platform/playlist_slide.yaml
@@ -90,7 +90,7 @@ resources:
 
             # https://api-platform.com/docs/core/controllers/
             _api_/slides/{id}/playlists_get: &get_playlists
-                security: 'is_granted("LIST", {type: "SLIDE_PLAYLIST"})'
+                security: 'is_granted("LIST", {type: "SLIDE_PLAYLIST", object: object})'
                 normalizationContext:
                     groups: ['slides/playlists:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -184,7 +184,7 @@ resources:
                                                 description: Playlist ULID
 
             _api_/playlists/{id}/slides_get: &get_slides
-                security: 'is_granted("LIST", {type: "PLAYLIST_SLIDE"})'
+                security: 'is_granted("LIST", {type: "PLAYLIST_SLIDE", object: object})'
                 normalizationContext:
                     groups: ['playlist-slide:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 69fc5e9a7..8cc48b584 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "SCREEN"})'
+                security: 'is_granted("LIST", {type: "SCREEN", object: object})'
                 filters:
                     - 'App\Filter\MultipleSearchFilter'
                     - 'screen.screen_user_exists_filter'
diff --git a/config/api_platform/screen_campaign.yaml b/config/api_platform/screen_campaign.yaml
index 3ae58c7ae..51db0a4f8 100644
--- a/config/api_platform/screen_campaign.yaml
+++ b/config/api_platform/screen_campaign.yaml
@@ -83,7 +83,7 @@ resources:
                                                     type: string
 
             _api_/screens/{id}/campaigns_get: &campaigns_get
-                security: 'is_granted("LIST", {type: "SCREEN_CAMPAIGN"})'
+                security: 'is_granted("LIST", {type: "SCREEN_CAMPAIGN", object: object})'
                 normalizationContext:
                     groups: ['screen-campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -134,7 +134,7 @@ resources:
                             headers: {}
 
             _api_/campaigns/{id}/screens_get: &screens_get
-                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN"})'
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN", object: object})'
                 normalizationContext:
                     groups: ['campaigns/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 287b67b9e..1369b1094 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -139,7 +139,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "SCREEN_GROUP"})'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
@@ -175,7 +175,7 @@ resources:
                             headers: {}
 
             _api_/screens/{id}/screen-groups_get: &get_screen_groups
-                security: 'is_granted("LIST", {type: "SCREEN_SCREEN_GROUP"})'
+                security: 'is_granted("LIST", {type: "SCREEN_SCREEN_GROUP", object: object})'
                 normalizationContext:
                     groups: ['screens/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -223,7 +223,7 @@ resources:
                         - ScreenGroups
 
             _api_/screen-groups/{id}/screens_get: &get_screens
-                security: 'is_granted("LIST", {type: "SCREEN_GROUP_SCREEN"})'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_SCREEN", object: object})'
                 normalizationContext:
                     groups: ['screen-groups/screens:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_groups_campaign.yaml b/config/api_platform/screen_groups_campaign.yaml
index 51be48930..3bbbe1f32 100644
--- a/config/api_platform/screen_groups_campaign.yaml
+++ b/config/api_platform/screen_groups_campaign.yaml
@@ -86,7 +86,7 @@ resources:
                                                     type: string
 
             getScreenGroupsCampaigns: &get_campaigns
-                security: 'is_granted("LIST", {type: "SCREEN_GROUP_CAMPAIGN"})'
+                security: 'is_granted("LIST", {type: "SCREEN_GROUP_CAMPAIGN", object: object})'
                 normalizationContext:
                     groups: ['screen-groups/campaigns:read']
                 class: ApiPlatform\Metadata\GetCollection
@@ -137,7 +137,7 @@ resources:
                             headers: {}
 
             getCampaignScreensGroups: &get_screen_groups
-                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN_GROUP"})'
+                security: 'is_granted("LIST", {type: "CAMPAIGN_SCREEN_GROUP", object: object})'
                 normalizationContext:
                     groups: ['campaigns/screen-groups:read']
                 class: ApiPlatform\Metadata\GetCollection
diff --git a/config/api_platform/screen_layout_regions.yaml b/config/api_platform/screen_layout_regions.yaml
index 72686675a..ea2695a41 100644
--- a/config/api_platform/screen_layout_regions.yaml
+++ b/config/api_platform/screen_layout_regions.yaml
@@ -15,7 +15,7 @@ resources:
                     operationId: getScreenLayoutRegionsItem
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "SCREEN_LAYOUT_REGION"})'
+                security: 'is_granted("LIST", {type: "SCREEN_LAYOUT_REGION", object: object})'
                 uriTemplate: '/layouts/regions'
                 controller: App\Controller\Api\NotFoundAction
                 openapiContext:
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index aba03debe..3bd4d0fdb 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -68,7 +68,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "SLIDE"})'
+                security: 'is_granted("LIST", {type: "SLIDE", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/template.yaml b/config/api_platform/template.yaml
index 5b7aad080..cd00b17b4 100644
--- a/config/api_platform/template.yaml
+++ b/config/api_platform/template.yaml
@@ -32,7 +32,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "TEMPLATE"})'
+                security: 'is_granted("LIST", {type: "TEMPLATE", object: object})'
                 filters:
                     - 'entity.search_filter'
                     - 'entity.blameable_filter'
diff --git a/config/api_platform/tenant.yaml b/config/api_platform/tenant.yaml
index c58688965..28ea943c3 100644
--- a/config/api_platform/tenant.yaml
+++ b/config/api_platform/tenant.yaml
@@ -30,7 +30,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "TENANT"})'
+                security: 'is_granted("LIST", {type: "TENANT", object: object})'
                 filters: ['entity.search_filter', 'entity.blameable_filter']
                 openapiContext:
                     operationId: get-v2-tenants
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 36fde49df..7c4880c68 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -34,7 +34,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "THEME"})'
+                security: 'is_granted("LIST", {type: "THEME", object: object})'
                 normalizationContext:
                     groups: ['theme:read']
                 filters:
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index 3f7694d7d..6635e1d18 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -83,7 +83,7 @@ resources:
                             description: User removed from tenant
 
             ApiPlatform\Metadata\GetCollection:
-                security: 'is_granted("LIST", {type: "USER"})'
+                security: 'is_granted("LIST", {type: "USER", object: object})'
                 uriTemplate: '/users'
                 filters:
                     - 'user.search_filter'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 91015f210..4f6a29ec1 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -32,11 +32,19 @@ protected function supports(string $attribute, mixed $subject): bool
     {
         // https://symfony.com/doc/current/security/voters.html
 
-        if ($attribute === self::LIST && $subject instanceof TraversablePaginator) {
+        $p = 1;
+
+        if (in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE, self::LIST]) &&
+            is_array($subject) &&
+            !empty($subject['type']) &&
+            !empty($subject['object'])
+        ) {
+            // TODO: Check for allowed types.
+
             return true;
         }
 
-        return in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE]);
+        return false;
     }
 
     protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool
@@ -48,35 +56,36 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
             return false;
         }
 
-        if ($attribute === self::VIEW) {
+        $type = $subject['type'];
+        $object = $subject['object'];
+
+        if ($attribute === self::LIST) {
+            // TODO: Check for list permissions. Object is a TraversablePaginator.
             return true;
         }
 
-        $userRoles = $user->getRoles();
-
-        $dto = str_contains($subject::class, "App\\Dto\\");
-        $entity = str_contains($subject::class, "App\\Entity\\Tenant\\");
-
-        $class = '';
         $createdBy = null;
 
-        if ($dto) {
-            $class = str_replace("App\\Dto\\", "", $subject::class);
-            $createdBy = $subject->createdBy;
-        } else if ($entity) {
-            $class = str_replace("App\\Entity\\Tenant\\", "", $subject::class);
-            $createdBy = $subject->getCreatedBy();
+        $isDTO = str_starts_with($object::class, "App\\Dto\\");
+        $isEntity = str_starts_with($object::class, "App\\Entity\\");
+
+        if ($isDTO) {
+            $createdBy = $object->createdBy;
+        } else if ($isEntity) {
+            $createdBy = $object->getCreatedBy();
         }
 
         $userIdentifier = $user->getUserIdentifier();
 
-        // The creator has permission to use the object.
+        // The creator always has permission to use the object.
         if ($userIdentifier === $createdBy) {
             return true;
         }
 
         // Check the authorization array for demands for $class and $attribute.
-        $requiredRoles = $this->authorization[$class][$attribute];
+        $requiredRoles = $this->authorization[$type][$attribute];
+
+        $userRoles = $user->getRoles();
 
         $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
 

From 86ab0efe9b6be9d111fee869fdb08e4e5ce577b8 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 14:06:48 +0100
Subject: [PATCH 11/16] 6897: Changed structure of security voter

---
 src/Security/Voter/AuthorizationVoter.php     |  47 ++--
 .../Voter/AuthorizationVoterHelper.php        | 249 ++++++++++++++----
 2 files changed, 225 insertions(+), 71 deletions(-)

diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 4f6a29ec1..11f23d14b 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -32,15 +32,15 @@ protected function supports(string $attribute, mixed $subject): bool
     {
         // https://symfony.com/doc/current/security/voters.html
 
-        $p = 1;
+        // Supports entries of the form:
+        // security: 'is_granted("<ATTRIBUTE>", {type: "<TYPE>", object: object})'
 
         if (in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE, self::LIST]) &&
             is_array($subject) &&
             !empty($subject['type']) &&
-            !empty($subject['object'])
+            !empty($subject['object']) &&
+            in_array($subject['type'], AuthorizationVoterHelper::TYPES)
         ) {
-            // TODO: Check for allowed types.
-
             return true;
         }
 
@@ -59,36 +59,33 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
         $type = $subject['type'];
         $object = $subject['object'];
 
-        if ($attribute === self::LIST) {
-            // TODO: Check for list permissions. Object is a TraversablePaginator.
-            return true;
-        }
+        // For all entities check if the user is the creator.
+        if ($attribute !== self::LIST) {
+            $createdBy = null;
 
-        $createdBy = null;
+            $isDTO = str_starts_with($object::class, "App\\Dto\\");
+            $isEntity = str_starts_with($object::class, "App\\Entity\\");
 
-        $isDTO = str_starts_with($object::class, "App\\Dto\\");
-        $isEntity = str_starts_with($object::class, "App\\Entity\\");
+            if ($isDTO) {
+                $createdBy = $object->createdBy;
+            } else if ($isEntity) {
+                $createdBy = $object->getCreatedBy();
+            }
 
-        if ($isDTO) {
-            $createdBy = $object->createdBy;
-        } else if ($isEntity) {
-            $createdBy = $object->getCreatedBy();
-        }
+            $userIdentifier = $user->getUserIdentifier();
 
-        $userIdentifier = $user->getUserIdentifier();
-
-        // The creator always has permission to use the object.
-        if ($userIdentifier === $createdBy) {
-            return true;
+            // The creator always has permission to use the object.
+            if ($userIdentifier === $createdBy) {
+                return true;
+            }
         }
 
-        // Check the authorization array for demands for $class and $attribute.
-        $requiredRoles = $this->authorization[$type][$attribute];
-
         $userRoles = $user->getRoles();
-
         $reachableRoles = $this->roleHierarchy->getReachableRoleNames($userRoles);
 
+        // Check the authorization array for demands for $class and $attribute.
+        $requiredRoles = $this->authorization[$type][$attribute];
+
         $intersect = array_intersect($requiredRoles, $reachableRoles);
 
         return !empty($intersect);
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
index 478460922..4395d3c6f 100644
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -4,63 +4,220 @@
 
 class AuthorizationVoterHelper
 {
-    private const array editorClasses = [
-        "Screen",
-        "Feed",
-        "FeedInput",
-        "FeedSource",
-        "FeedSourceInput",
-        "Media",
-        "Playlist",
-        "PlaylistInput",
-        "PlaylistScreenRegion",
-        "PlaylistSlide",
-        "ScreenCampaign",
-        "ScreenGroup",
-        "ScreenGroupCampaign",
-        "ScreenGroupInput",
-        "ScreenInput",
-        "ScreenLayout",
-        "ScreenLayoutRegions",
-        "Slide",
-        "SlideInput",
-        "Template",
-    ];
+    public const string CAMPAIGN_SCREEN = "CAMPAIGN_SCREEN";
+    public const string CAMPAIGN_SCREEN_GROUP = "CAMPAIGN_SCREEN_GROUP";
+    public const string FEED = "FEED";
+    public const string FEED_SOURCE = "FEED_SOURCE";
+    public const string FEED_SOURCE_SLIDES = "FEED_SOURCE_SLIDES";
+    public const string LAYOUT = "LAYOUT";
+    public const string MEDIA = "MEDIA";
+    public const string PLAYLIST = "PLAYLIST";
+    public const string PLAYLIST_SCREEN_REGION = "PLAYLIST_SCREEN_REGION";
+    public const string PLAYLIST_SLIDE = "PLAYLIST_SLIDE";
+    public const string SCREEN = "SCREEN";
+    public const string SCREEN_CAMPAIGN = "SCREEN_CAMPAIGN";
+    public const string SCREEN_GROUP = "SCREEN_GROUP";
+    public const string SCREEN_GROUP_CAMPAIGN = "SCREEN_GROUP_CAMPAIGN";
+    public const string SCREEN_GROUP_SCREEN = "SCREEN_GROUP_SCREEN";
+    public const string SCREEN_LAYOUT_REGION = "SCREEN_LAYOUT_REGION";
+    public const string SCREEN_SCREEN_GROUP = "SCREEN_SCREEN_GROUP";
+    public const string SLIDE = "SLIDE";
+    public const string SLIDE_PLAYLIST = "SLIDE_PLAYLIST";
+    public const string TEMPLATE = "TEMPLATE";
+    public const string TENANT = "TENANT";
+    public const string THEME = "THEME";
+    public const string USER = "USER";
 
-    private const array adminClasses = [
-        "ActivationCode",
-        "Tenant",
-        "Theme",
-        "ThemeInput",
-        "User",
-        "UserActivationCode",
-        "UserActivationCodeInput",
-        "UserInput",
-        "Screen",
+    public const array TYPES = [
+        self::CAMPAIGN_SCREEN,
+        self::CAMPAIGN_SCREEN_GROUP,
+        self::FEED,
+        self::FEED_SOURCE,
+        self::FEED_SOURCE_SLIDES,
+        self::LAYOUT,
+        self::MEDIA,
+        self::PLAYLIST,
+        self::PLAYLIST_SCREEN_REGION,
+        self::PLAYLIST_SLIDE,
+        self::SCREEN,
+        self::SCREEN_CAMPAIGN,
+        self::SCREEN_GROUP,
+        self::SCREEN_GROUP_CAMPAIGN,
+        self::SCREEN_GROUP_SCREEN,
+        self::SCREEN_LAYOUT_REGION,
+        self::SCREEN_SCREEN_GROUP,
+        self::SLIDE,
+        self::SLIDE_PLAYLIST,
+        self::TEMPLATE,
+        self::TENANT,
+        self::THEME,
+        self::USER,
     ];
 
     public static function getAuthorizationDefaults(): array
     {
-        $defaults = [];
-
-        foreach (self::editorClasses as $class) {
-            $defaults[$class] = [
+        return [
+            "CAMPAIGN_SCREEN" => [
                 AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
                 AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
                 AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
                 AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-            ];
-        }
-
-        foreach (self::adminClasses as $class) {
-            $defaults[$class] = [
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "CAMPAIGN_SCREEN_GROUP" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "FEED" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "FEED_SOURCE" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "FEED_SOURCE_SLIDES" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "LAYOUT" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "MEDIA" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "PLAYLIST" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "PLAYLIST_SCREEN_REGION" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "PLAYLIST_SLIDE" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_CAMPAIGN" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_GROUP" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_GROUP_CAMPAIGN" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_GROUP_SCREEN" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_LAYOUT_REGION" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SCREEN_SCREEN_GROUP" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SLIDE" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "SLIDE_PLAYLIST" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "TEMPLATE" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "TENANT" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "THEME" => [
                 AuthorizationVoter::EDIT => ['ROLE_ADMIN'],
-                AuthorizationVoter::VIEW => ['ROLE_ADMIN'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
                 AuthorizationVoter::CREATE => ['ROLE_ADMIN'],
                 AuthorizationVoter::DELETE => ['ROLE_ADMIN'],
-            ];
-        }
-
-        return $defaults;
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+            "USER" => [
+                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
+                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
+                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
+                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
+                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            ],
+        ];
     }
 }

From 713439991cb9f18baa26f84f2a7937f580d3a3f5 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 14:12:03 +0100
Subject: [PATCH 12/16] 6897: Changed to use constants

---
 .../Voter/AuthorizationVoterHelper.php        | 322 +++++++++---------
 1 file changed, 162 insertions(+), 160 deletions(-)

diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
index 4395d3c6f..164d98032 100644
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -2,6 +2,8 @@
 
 namespace App\Security\Voter;
 
+use App\Utils\Roles;
+
 class AuthorizationVoterHelper
 {
     public const string CAMPAIGN_SCREEN = "CAMPAIGN_SCREEN";
@@ -57,166 +59,166 @@ class AuthorizationVoterHelper
     public static function getAuthorizationDefaults(): array
     {
         return [
-            "CAMPAIGN_SCREEN" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "CAMPAIGN_SCREEN_GROUP" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "FEED" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "FEED_SOURCE" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "FEED_SOURCE_SLIDES" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "LAYOUT" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "MEDIA" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "PLAYLIST" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "PLAYLIST_SCREEN_REGION" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "PLAYLIST_SLIDE" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_CAMPAIGN" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_GROUP" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_GROUP_CAMPAIGN" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_GROUP_SCREEN" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_LAYOUT_REGION" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SCREEN_SCREEN_GROUP" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SLIDE" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "SLIDE_PLAYLIST" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "TEMPLATE" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "TENANT" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "THEME" => [
-                AuthorizationVoter::EDIT => ['ROLE_ADMIN'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_ADMIN'],
-                AuthorizationVoter::DELETE => ['ROLE_ADMIN'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
-            ],
-            "USER" => [
-                AuthorizationVoter::EDIT => ['ROLE_EDITOR'],
-                AuthorizationVoter::VIEW => ['ROLE_EDITOR'],
-                AuthorizationVoter::CREATE => ['ROLE_EDITOR'],
-                AuthorizationVoter::DELETE => ['ROLE_EDITOR'],
-                AuthorizationVoter::LIST => ['ROLE_EDITOR'],
+            self::CAMPAIGN_SCREEN => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::CAMPAIGN_SCREEN_GROUP => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::FEED => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::FEED_SOURCE => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::FEED_SOURCE_SLIDES => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::LAYOUT => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::MEDIA => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::PLAYLIST => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::PLAYLIST_SCREEN_REGION => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::PLAYLIST_SLIDE => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_CAMPAIGN => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_GROUP => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_GROUP_CAMPAIGN => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_GROUP_SCREEN => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_LAYOUT_REGION => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SCREEN_SCREEN_GROUP => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SLIDE => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::SLIDE_PLAYLIST => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::TEMPLATE => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::TENANT => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::THEME => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_ADMIN],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_ADMIN],
+                AuthorizationVoter::DELETE => [Roles::ROLE_ADMIN],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+            ],
+            self::USER => [
+                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
             ],
         ];
     }

From a36decb3a191a3da9ecfc69b2841fbf3ab5cd7f5 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 14:36:37 +0100
Subject: [PATCH 13/16] 6897: Cleanup

---
 .env                                          |  21 +-
 src/Security/Voter/AuthorizationVoter.php     |  10 +-
 .../Voter/AuthorizationVoterHelper.php        | 329 +++++++++---------
 3 files changed, 180 insertions(+), 180 deletions(-)

diff --git a/.env b/.env
index adfb74794..43287774d 100644
--- a/.env
+++ b/.env
@@ -130,13 +130,16 @@ CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
 
-#AUTHORIZATION_OVERRIDE='{}'
+AUTHORIZATION_OVERRIDE='{}'
+# TODO: Write documentation.
+# See src/Security/Voter/AuthorizationVoterHelper.php for complete authorization array.
 # Example value:
-AUTHORIZATION_OVERRIDE='{
-  "SCREEN": {
-    "EDIT": ["ROLE_ADMIN"],
-    "VIEW": ["ROLE_EDITOR"],
-    "CREATE": ["ROLE_ADMIN"],
-    "DELETE": ["ROLE_ADMIN"]
-  }
-}'
+# AUTHORIZATION_OVERRIDE='{
+#   "SCREEN": {
+#     "LIST": ["ROLE_EDITOR"],
+#     "VIEW": ["ROLE_EDITOR"],
+#     "EDIT": ["ROLE_ADMIN"],
+#     "CREATE": ["ROLE_ADMIN"],
+#     "DELETE": ["ROLE_ADMIN"],
+#   }
+# }'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 11f23d14b..3f2076f7b 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -2,7 +2,6 @@
 
 namespace App\Security\Voter;
 
-use ApiPlatform\State\Pagination\TraversablePaginator;
 use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
 use Symfony\Component\Security\Core\Authorization\Voter\Voter;
 use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
@@ -17,10 +16,11 @@ final class AuthorizationVoter extends Voter {
 
     private array $authorization;
 
-    public function __construct(private readonly array $authorizationOverride, private readonly RoleHierarchyInterface $roleHierarchy)
-    {
-        $authorizationDefaults = AuthorizationVoterHelper::getAuthorizationDefaults();
-        $this->authorization = array_replace($authorizationDefaults, $authorizationOverride);
+    public function __construct(
+        private readonly array $authorizationOverride,
+        private readonly RoleHierarchyInterface $roleHierarchy
+    ) {
+        $this->authorization = array_replace(AuthorizationVoterHelper::AUTHORIZATION_DEFAULTS, $authorizationOverride);
     }
 
     public function getAuthorization(): array
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
index 164d98032..e7786464c 100644
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ b/src/Security/Voter/AuthorizationVoterHelper.php
@@ -56,170 +56,167 @@ class AuthorizationVoterHelper
         self::USER,
     ];
 
-    public static function getAuthorizationDefaults(): array
-    {
-        return [
-            self::CAMPAIGN_SCREEN => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::CAMPAIGN_SCREEN_GROUP => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::FEED => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::FEED_SOURCE => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::FEED_SOURCE_SLIDES => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::LAYOUT => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::MEDIA => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::PLAYLIST => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::PLAYLIST_SCREEN_REGION => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::PLAYLIST_SLIDE => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_CAMPAIGN => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_GROUP => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_GROUP_CAMPAIGN => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_GROUP_SCREEN => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_LAYOUT_REGION => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SCREEN_SCREEN_GROUP => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SLIDE => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::SLIDE_PLAYLIST => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::TEMPLATE => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::TENANT => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::THEME => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_ADMIN],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_ADMIN],
-                AuthorizationVoter::DELETE => [Roles::ROLE_ADMIN],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-            self::USER => [
-                AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-                AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-            ],
-        ];
-    }
+    public const array AUTHORIZATION_DEFAULTS = [
+        self::CAMPAIGN_SCREEN => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::CAMPAIGN_SCREEN_GROUP => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE_SLIDES => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::LAYOUT => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::MEDIA => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SCREEN_REGION => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SLIDE => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_CAMPAIGN => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_CAMPAIGN => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_SCREEN => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_LAYOUT_REGION => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_SCREEN_GROUP => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE_PLAYLIST => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TEMPLATE => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TENANT => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::THEME => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_ADMIN],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_ADMIN],
+            AuthorizationVoter::DELETE => [Roles::ROLE_ADMIN],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::USER => [
+            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
+            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
+        ],
+    ];
 }

From a933a718773234eb9e9c30658bfeae2cf934664e Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Wed, 11 Mar 2026 14:50:05 +0100
Subject: [PATCH 14/16] 6897: Refactored code

---
 .env                                          |   4 +-
 src/Security/Voter/AuthorizationVoter.php     |  14 +-
 .../Voter/AuthorizationVoterHelper.php        | 222 ----------------
 .../Voter/AuthorizationVoterValues.php        | 236 ++++++++++++++++++
 4 files changed, 242 insertions(+), 234 deletions(-)
 delete mode 100644 src/Security/Voter/AuthorizationVoterHelper.php
 create mode 100644 src/Security/Voter/AuthorizationVoterValues.php

diff --git a/.env b/.env
index 43287774d..87cc05619 100644
--- a/.env
+++ b/.env
@@ -130,9 +130,8 @@ CLIENT_COLOR_SCHEME='{"type":"library","lat":56.0,"lng":10.0}'
 CLIENT_DEBUG=false
 ###< Client configuration ###
 
-AUTHORIZATION_OVERRIDE='{}'
 # TODO: Write documentation.
-# See src/Security/Voter/AuthorizationVoterHelper.php for complete authorization array.
+# See src/Security/Voter/AuthorizationVoterValues.php for complete default authorization array.
 # Example value:
 # AUTHORIZATION_OVERRIDE='{
 #   "SCREEN": {
@@ -143,3 +142,4 @@ AUTHORIZATION_OVERRIDE='{}'
 #     "DELETE": ["ROLE_ADMIN"],
 #   }
 # }'
+AUTHORIZATION_OVERRIDE='{}'
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index 3f2076f7b..eca437f58 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -8,19 +8,13 @@
 use Symfony\Component\Security\Core\User\UserInterface;
 
 final class AuthorizationVoter extends Voter {
-    public const string EDIT = 'EDIT';
-    public const string VIEW = 'VIEW';
-    public const string LIST = 'LIST';
-    public const string CREATE = 'CREATE';
-    public const string DELETE = 'DELETE';
-
     private array $authorization;
 
     public function __construct(
         private readonly array $authorizationOverride,
         private readonly RoleHierarchyInterface $roleHierarchy
     ) {
-        $this->authorization = array_replace(AuthorizationVoterHelper::AUTHORIZATION_DEFAULTS, $authorizationOverride);
+        $this->authorization = array_replace(AuthorizationVoterValues::AUTHORIZATION_DEFAULTS, $authorizationOverride);
     }
 
     public function getAuthorization(): array
@@ -35,11 +29,11 @@ protected function supports(string $attribute, mixed $subject): bool
         // Supports entries of the form:
         // security: 'is_granted("<ATTRIBUTE>", {type: "<TYPE>", object: object})'
 
-        if (in_array($attribute, [self::EDIT, self::VIEW, self::CREATE, self::DELETE, self::LIST]) &&
+        if (in_array($attribute, AuthorizationVoterValues::ATTRIBUTES) &&
             is_array($subject) &&
             !empty($subject['type']) &&
             !empty($subject['object']) &&
-            in_array($subject['type'], AuthorizationVoterHelper::TYPES)
+            in_array($subject['type'], AuthorizationVoterValues::TYPES)
         ) {
             return true;
         }
@@ -60,7 +54,7 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
         $object = $subject['object'];
 
         // For all entities check if the user is the creator.
-        if ($attribute !== self::LIST) {
+        if ($attribute !== AuthorizationVoterValues::LIST) {
             $createdBy = null;
 
             $isDTO = str_starts_with($object::class, "App\\Dto\\");
diff --git a/src/Security/Voter/AuthorizationVoterHelper.php b/src/Security/Voter/AuthorizationVoterHelper.php
deleted file mode 100644
index e7786464c..000000000
--- a/src/Security/Voter/AuthorizationVoterHelper.php
+++ /dev/null
@@ -1,222 +0,0 @@
-<?php
-
-namespace App\Security\Voter;
-
-use App\Utils\Roles;
-
-class AuthorizationVoterHelper
-{
-    public const string CAMPAIGN_SCREEN = "CAMPAIGN_SCREEN";
-    public const string CAMPAIGN_SCREEN_GROUP = "CAMPAIGN_SCREEN_GROUP";
-    public const string FEED = "FEED";
-    public const string FEED_SOURCE = "FEED_SOURCE";
-    public const string FEED_SOURCE_SLIDES = "FEED_SOURCE_SLIDES";
-    public const string LAYOUT = "LAYOUT";
-    public const string MEDIA = "MEDIA";
-    public const string PLAYLIST = "PLAYLIST";
-    public const string PLAYLIST_SCREEN_REGION = "PLAYLIST_SCREEN_REGION";
-    public const string PLAYLIST_SLIDE = "PLAYLIST_SLIDE";
-    public const string SCREEN = "SCREEN";
-    public const string SCREEN_CAMPAIGN = "SCREEN_CAMPAIGN";
-    public const string SCREEN_GROUP = "SCREEN_GROUP";
-    public const string SCREEN_GROUP_CAMPAIGN = "SCREEN_GROUP_CAMPAIGN";
-    public const string SCREEN_GROUP_SCREEN = "SCREEN_GROUP_SCREEN";
-    public const string SCREEN_LAYOUT_REGION = "SCREEN_LAYOUT_REGION";
-    public const string SCREEN_SCREEN_GROUP = "SCREEN_SCREEN_GROUP";
-    public const string SLIDE = "SLIDE";
-    public const string SLIDE_PLAYLIST = "SLIDE_PLAYLIST";
-    public const string TEMPLATE = "TEMPLATE";
-    public const string TENANT = "TENANT";
-    public const string THEME = "THEME";
-    public const string USER = "USER";
-
-    public const array TYPES = [
-        self::CAMPAIGN_SCREEN,
-        self::CAMPAIGN_SCREEN_GROUP,
-        self::FEED,
-        self::FEED_SOURCE,
-        self::FEED_SOURCE_SLIDES,
-        self::LAYOUT,
-        self::MEDIA,
-        self::PLAYLIST,
-        self::PLAYLIST_SCREEN_REGION,
-        self::PLAYLIST_SLIDE,
-        self::SCREEN,
-        self::SCREEN_CAMPAIGN,
-        self::SCREEN_GROUP,
-        self::SCREEN_GROUP_CAMPAIGN,
-        self::SCREEN_GROUP_SCREEN,
-        self::SCREEN_LAYOUT_REGION,
-        self::SCREEN_SCREEN_GROUP,
-        self::SLIDE,
-        self::SLIDE_PLAYLIST,
-        self::TEMPLATE,
-        self::TENANT,
-        self::THEME,
-        self::USER,
-    ];
-
-    public const array AUTHORIZATION_DEFAULTS = [
-        self::CAMPAIGN_SCREEN => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::CAMPAIGN_SCREEN_GROUP => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::FEED => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::FEED_SOURCE => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::FEED_SOURCE_SLIDES => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::LAYOUT => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::MEDIA => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::PLAYLIST => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::PLAYLIST_SCREEN_REGION => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::PLAYLIST_SLIDE => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_CAMPAIGN => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_GROUP => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_GROUP_CAMPAIGN => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_GROUP_SCREEN => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_LAYOUT_REGION => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SCREEN_SCREEN_GROUP => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SLIDE => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::SLIDE_PLAYLIST => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::TEMPLATE => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::TENANT => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::THEME => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_ADMIN],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_ADMIN],
-            AuthorizationVoter::DELETE => [Roles::ROLE_ADMIN],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-        self::USER => [
-            AuthorizationVoter::EDIT => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::VIEW => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::CREATE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::DELETE => [Roles::ROLE_EDITOR],
-            AuthorizationVoter::LIST => [Roles::ROLE_EDITOR],
-        ],
-    ];
-}
diff --git a/src/Security/Voter/AuthorizationVoterValues.php b/src/Security/Voter/AuthorizationVoterValues.php
new file mode 100644
index 000000000..c84bada9b
--- /dev/null
+++ b/src/Security/Voter/AuthorizationVoterValues.php
@@ -0,0 +1,236 @@
+<?php
+
+namespace App\Security\Voter;
+
+use App\Utils\Roles;
+
+class AuthorizationVoterValues
+{
+    public const string CAMPAIGN_SCREEN = "CAMPAIGN_SCREEN";
+    public const string CAMPAIGN_SCREEN_GROUP = "CAMPAIGN_SCREEN_GROUP";
+    public const string FEED = "FEED";
+    public const string FEED_SOURCE = "FEED_SOURCE";
+    public const string FEED_SOURCE_SLIDES = "FEED_SOURCE_SLIDES";
+    public const string LAYOUT = "LAYOUT";
+    public const string MEDIA = "MEDIA";
+    public const string PLAYLIST = "PLAYLIST";
+    public const string PLAYLIST_SCREEN_REGION = "PLAYLIST_SCREEN_REGION";
+    public const string PLAYLIST_SLIDE = "PLAYLIST_SLIDE";
+    public const string SCREEN = "SCREEN";
+    public const string SCREEN_CAMPAIGN = "SCREEN_CAMPAIGN";
+    public const string SCREEN_GROUP = "SCREEN_GROUP";
+    public const string SCREEN_GROUP_CAMPAIGN = "SCREEN_GROUP_CAMPAIGN";
+    public const string SCREEN_GROUP_SCREEN = "SCREEN_GROUP_SCREEN";
+    public const string SCREEN_LAYOUT_REGION = "SCREEN_LAYOUT_REGION";
+    public const string SCREEN_SCREEN_GROUP = "SCREEN_SCREEN_GROUP";
+    public const string SLIDE = "SLIDE";
+    public const string SLIDE_PLAYLIST = "SLIDE_PLAYLIST";
+    public const string TEMPLATE = "TEMPLATE";
+    public const string TENANT = "TENANT";
+    public const string THEME = "THEME";
+    public const string USER = "USER";
+
+    public const string EDIT = 'EDIT';
+    public const string VIEW = 'VIEW';
+    public const string LIST = 'LIST';
+    public const string CREATE = 'CREATE';
+    public const string DELETE = 'DELETE';
+
+    public const array ATTRIBUTES = [
+        self::EDIT,
+        self::VIEW,
+        self::LIST,
+        self::CREATE,
+        self::DELETE,
+    ];
+
+    public const array TYPES = [
+        self::CAMPAIGN_SCREEN,
+        self::CAMPAIGN_SCREEN_GROUP,
+        self::FEED,
+        self::FEED_SOURCE,
+        self::FEED_SOURCE_SLIDES,
+        self::LAYOUT,
+        self::MEDIA,
+        self::PLAYLIST,
+        self::PLAYLIST_SCREEN_REGION,
+        self::PLAYLIST_SLIDE,
+        self::SCREEN,
+        self::SCREEN_CAMPAIGN,
+        self::SCREEN_GROUP,
+        self::SCREEN_GROUP_CAMPAIGN,
+        self::SCREEN_GROUP_SCREEN,
+        self::SCREEN_LAYOUT_REGION,
+        self::SCREEN_SCREEN_GROUP,
+        self::SLIDE,
+        self::SLIDE_PLAYLIST,
+        self::TEMPLATE,
+        self::TENANT,
+        self::THEME,
+        self::USER,
+    ];
+
+    public const array AUTHORIZATION_DEFAULTS = [
+        self::CAMPAIGN_SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::CAMPAIGN_SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::FEED_SOURCE_SLIDES => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::LAYOUT => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::MEDIA => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SCREEN_REGION => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::PLAYLIST_SLIDE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_CAMPAIGN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_CAMPAIGN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_GROUP_SCREEN => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_LAYOUT_REGION => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SCREEN_SCREEN_GROUP => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::SLIDE_PLAYLIST => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TEMPLATE => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::TENANT => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::THEME => [
+            self::EDIT => [Roles::ROLE_ADMIN],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_ADMIN],
+            self::DELETE => [Roles::ROLE_ADMIN],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+        self::USER => [
+            self::EDIT => [Roles::ROLE_EDITOR],
+            self::VIEW => [Roles::ROLE_EDITOR],
+            self::CREATE => [Roles::ROLE_EDITOR],
+            self::DELETE => [Roles::ROLE_EDITOR],
+            self::LIST => [Roles::ROLE_EDITOR],
+        ],
+    ];
+}

From 7fa786ec83b4cf385376b24ee897a3eb22adea14 Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Thu, 12 Mar 2026 15:08:58 +0100
Subject: [PATCH 15/16] 6897: Added authorization tests for screen endpoints

---
 config/api_platform/screen.yaml           |  2 +-
 src/Security/Voter/AuthorizationVoter.php |  9 +--
 tests/Api/ScreensTest.php                 | 86 +++++++++++++++++++++++
 3 files changed, 92 insertions(+), 5 deletions(-)

diff --git a/config/api_platform/screen.yaml b/config/api_platform/screen.yaml
index 8cc48b584..fc13ff43a 100644
--- a/config/api_platform/screen.yaml
+++ b/config/api_platform/screen.yaml
@@ -106,7 +106,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "SCREEN", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/src/Security/Voter/AuthorizationVoter.php b/src/Security/Voter/AuthorizationVoter.php
index eca437f58..e36675888 100644
--- a/src/Security/Voter/AuthorizationVoter.php
+++ b/src/Security/Voter/AuthorizationVoter.php
@@ -32,7 +32,6 @@ protected function supports(string $attribute, mixed $subject): bool
         if (in_array($attribute, AuthorizationVoterValues::ATTRIBUTES) &&
             is_array($subject) &&
             !empty($subject['type']) &&
-            !empty($subject['object']) &&
             in_array($subject['type'], AuthorizationVoterValues::TYPES)
         ) {
             return true;
@@ -51,10 +50,10 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
         }
 
         $type = $subject['type'];
-        $object = $subject['object'];
+        $object = $subject['object'] ?? null;
 
         // For all entities check if the user is the creator.
-        if ($attribute !== AuthorizationVoterValues::LIST) {
+        if ($object !== null && $attribute !== AuthorizationVoterValues::LIST) {
             $createdBy = null;
 
             $isDTO = str_starts_with($object::class, "App\\Dto\\");
@@ -82,6 +81,8 @@ protected function voteOnAttribute(string $attribute, mixed $subject, TokenInter
 
         $intersect = array_intersect($requiredRoles, $reachableRoles);
 
-        return !empty($intersect);
+        $allow = !empty($intersect);
+
+        return $allow;
     }
 }
diff --git a/tests/Api/ScreensTest.php b/tests/Api/ScreensTest.php
index 1ea349674..f278694b1 100644
--- a/tests/Api/ScreensTest.php
+++ b/tests/Api/ScreensTest.php
@@ -11,6 +11,7 @@
 use App\Entity\Tenant\Screen;
 use App\Entity\Tenant\ScreenGroup;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Doctrine\ORM\EntityManager;
 
 class ScreensTest extends AbstractBaseApiTestCase
@@ -272,4 +273,89 @@ public function testDeleteScreen(): void
             static::getContainer()->get('doctrine')->getRepository(Screen::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testScreenAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Screen::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/screens', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $layoutIri = $this->findIriBy(ScreenLayout::class, ['title' => '2 boxes']);
+        $response = $client->request('POST', '/v2/screens', [
+            'json' => [
+                'title' => 'Test screen for ROLE_EDITOR',
+                'layout' => $layoutIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testScreenAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Screen::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/screens', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $layoutIri = $this->findIriBy(ScreenLayout::class, ['title' => '2 boxes']);
+        $client->request('POST', '/v2/screens', [
+            'json' => [
+                'title' => 'Test screen for ROLE_USER',
+                'layout' => $layoutIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }

From 7f368607c6349a525fe093deb555b93516094a4d Mon Sep 17 00:00:00 2001
From: Troels Ugilt Jensen <6103205+tuj@users.noreply.github.com>
Date: Mon, 16 Mar 2026 09:51:08 +0100
Subject: [PATCH 16/16] 6897: Added tests

---
 config/api_platform/feed_source.yaml   |  2 +-
 config/api_platform/media.yaml         |  2 +-
 config/api_platform/playlist.yaml      |  2 +-
 config/api_platform/screen_groups.yaml |  2 +-
 config/api_platform/slide.yaml         |  2 +-
 config/api_platform/theme.yaml         |  2 +-
 config/api_platform/user.yaml          |  2 +-
 tests/Api/FeedSourceTest.php           | 88 +++++++++++++++++++++++++
 tests/Api/MediaTest.php                | 63 ++++++++++++++++++
 tests/Api/PlaylistsTest.php            | 82 +++++++++++++++++++++++
 tests/Api/ScreenGroupsTest.php         | 82 +++++++++++++++++++++++
 tests/Api/SlidesTest.php               | 90 ++++++++++++++++++++++++++
 tests/Api/ThemesTest.php               | 73 +++++++++++++++++++++
 13 files changed, 485 insertions(+), 7 deletions(-)

diff --git a/config/api_platform/feed_source.yaml b/config/api_platform/feed_source.yaml
index 40e94f23f..458abbe9e 100644
--- a/config/api_platform/feed_source.yaml
+++ b/config/api_platform/feed_source.yaml
@@ -148,7 +148,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "FEED_SOURCE", object: object})'
                 openapiContext:
                     operationId: create-v2-feed-source
                     description: Creates a Feed Source resource.
diff --git a/config/api_platform/media.yaml b/config/api_platform/media.yaml
index 75dfe8736..c67739598 100644
--- a/config/api_platform/media.yaml
+++ b/config/api_platform/media.yaml
@@ -87,7 +87,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "MEDIA", object: object})'
                 controller: App\Controller\Api\MediaController
                 deserialize: false
                 normalizationContext:
diff --git a/config/api_platform/playlist.yaml b/config/api_platform/playlist.yaml
index a78d3dd48..5358d826c 100644
--- a/config/api_platform/playlist.yaml
+++ b/config/api_platform/playlist.yaml
@@ -104,7 +104,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "PLAYLIST", object: object})'
                 normalizationContext:
                     jsonld_embed_context: true
                 openapiContext:
diff --git a/config/api_platform/screen_groups.yaml b/config/api_platform/screen_groups.yaml
index 1369b1094..756c2b8cd 100644
--- a/config/api_platform/screen_groups.yaml
+++ b/config/api_platform/screen_groups.yaml
@@ -213,7 +213,7 @@ resources:
                           description: The number of items per page
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "SCREEN_GROUP", object: object})'
                 uriTemplate: '/screen-groups'
                 openapiContext:
                     description: Create Screen group resources.
diff --git a/config/api_platform/slide.yaml b/config/api_platform/slide.yaml
index 3bd4d0fdb..091fc1467 100644
--- a/config/api_platform/slide.yaml
+++ b/config/api_platform/slide.yaml
@@ -105,7 +105,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "SLIDE", object: object})'
                 openapiContext:
                     operationId: create-v2-slides
                     description: Creates a Slide resource.
diff --git a/config/api_platform/theme.yaml b/config/api_platform/theme.yaml
index 7c4880c68..d506e6118 100644
--- a/config/api_platform/theme.yaml
+++ b/config/api_platform/theme.yaml
@@ -106,7 +106,7 @@ resources:
                           required: true
 
             ApiPlatform\Metadata\Post:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "THEME", object: object})'
                 openapiContext:
                     operationId: create-v2-themes
                     description: Creates a Theme resource.
diff --git a/config/api_platform/user.yaml b/config/api_platform/user.yaml
index 6635e1d18..6259e9bb9 100644
--- a/config/api_platform/user.yaml
+++ b/config/api_platform/user.yaml
@@ -118,7 +118,7 @@ resources:
                             headers: {}
 
             ApiPlatform\Metadata\POST:
-                security: 'is_granted("CREATE", object)'
+                security: 'is_granted("CREATE", {type: "USER", object: object})'
                 uriTemplate: '/users'
                 openapiContext:
                     description: Create a User resource.
diff --git a/tests/Api/FeedSourceTest.php b/tests/Api/FeedSourceTest.php
index f72e32618..a7cbfd1b2 100644
--- a/tests/Api/FeedSourceTest.php
+++ b/tests/Api/FeedSourceTest.php
@@ -8,6 +8,7 @@
 use App\Entity\Tenant\FeedSource;
 use App\Entity\Tenant\Slide;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpClient\Exception\ClientException;
 
 class FeedSourceTest extends AbstractBaseApiTestCase
@@ -247,4 +248,91 @@ public function testDeleteFeedSourceInUse(): void
             $manager->getRepository(FeedSource::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testFeedSourceAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(FeedSource::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/feed-sources', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/feed-sources', [
+            'json' => [
+                'title' => 'Test feed source for ROLE_EDITOR',
+                'feedType' => 'rss',
+                'secrets' => [],
+                'supportedFeedOutputType' => 'App\FeedType\Rss\RssOutputType',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testFeedSourceAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(FeedSource::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/feed-sources', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/feed-sources', [
+            'json' => [
+                'title' => 'Test feed source for ROLE_USER',
+                'feedType' => 'rss',
+                'secrets' => [],
+                'supportedFeedOutputType' => 'App\FeedType\Rss\RssOutputType',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/MediaTest.php b/tests/Api/MediaTest.php
index a18189a0f..e4a762d2c 100644
--- a/tests/Api/MediaTest.php
+++ b/tests/Api/MediaTest.php
@@ -5,7 +5,9 @@
 namespace App\Tests\Api;
 
 use App\Entity\Tenant;
+use App\Entity\Tenant\Media;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 
 class MediaTest extends AbstractBaseApiTestCase
@@ -160,4 +162,65 @@ public function testMediaUpload(): void
         // @TODO: hydra:member[0].assets: Object value found, but an array is required
         //        $this->assertMatchesResourceItemJsonSchema(Media::class);
     }
+
+    public function testMediaAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Media::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/media', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $uploadedFile = new UploadedFile(__DIR__.'/../files/test.png', 'test.png');
+        $response = $client->request('POST', '/v2/media', [
+            'headers' => ['Content-Type' => 'multipart/form-data'],
+            'extra' => [
+                'files' => [
+                    'file' => $uploadedFile,
+                ],
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testMediaAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Media::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/media', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $uploadedFile = new UploadedFile(__DIR__.'/../files/test.png', 'test.png');
+        $client->request('POST', '/v2/media', [
+            'headers' => ['Content-Type' => 'multipart/form-data'],
+            'extra' => [
+                'files' => [
+                    'file' => $uploadedFile,
+                ],
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/PlaylistsTest.php b/tests/Api/PlaylistsTest.php
index d0fabd239..2dd6b5cf3 100644
--- a/tests/Api/PlaylistsTest.php
+++ b/tests/Api/PlaylistsTest.php
@@ -6,6 +6,7 @@
 
 use App\Entity\Tenant\Playlist;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 use Symfony\Component\HttpFoundation\Response;
 
 class PlaylistsTest extends AbstractBaseApiTestCase
@@ -403,4 +404,85 @@ public function testSharedPlaylists(): void
 
         $this->assertCount(13, $response->toArray()['hydra:member']);
     }
+
+    public function testPlaylistAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Playlist::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/playlists', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/playlists', [
+            'json' => [
+                'title' => 'Test playlist for ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testPlaylistAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Playlist::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/playlists', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/playlists', [
+            'json' => [
+                'title' => 'Test playlist for ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/ScreenGroupsTest.php b/tests/Api/ScreenGroupsTest.php
index 4046955b8..29c51b957 100644
--- a/tests/Api/ScreenGroupsTest.php
+++ b/tests/Api/ScreenGroupsTest.php
@@ -7,6 +7,7 @@
 use App\Entity\Tenant\Screen;
 use App\Entity\Tenant\ScreenGroup;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class ScreenGroupsTest extends AbstractBaseApiTestCase
 {
@@ -227,4 +228,85 @@ public function testDeleteScreenGroupsScreenRelations(): void
 
         $this->assertFalse($screen->getScreenGroups()->contains($screenGroup));
     }
+
+    public function testScreenGroupAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(ScreenGroup::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/screen-groups', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $response = $client->request('POST', '/v2/screen-groups', [
+            'json' => [
+                'title' => 'Test screen group for ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testScreenGroupAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(ScreenGroup::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/screen-groups', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $client->request('POST', '/v2/screen-groups', [
+            'json' => [
+                'title' => 'Test screen group for ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/SlidesTest.php b/tests/Api/SlidesTest.php
index 492ef980b..b040c980c 100644
--- a/tests/Api/SlidesTest.php
+++ b/tests/Api/SlidesTest.php
@@ -9,6 +9,7 @@
 use App\Entity\Tenant\Slide;
 use App\Entity\Tenant\Theme;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class SlidesTest extends AbstractBaseApiTestCase
 {
@@ -312,4 +313,93 @@ public function testDeleteSlide(): void
             static::getContainer()->get('doctrine')->getRepository(Slide::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testSlideAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Slide::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/slides', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test POST - ROLE_EDITOR should have access
+        $templateIri = $this->findIriBy(Template::class, ['title' => 'Image-Text']);
+        $themeIri = $this->findIriBy(Theme::class, ['title' => 'Image-Text']);
+        $response = $client->request('POST', '/v2/slides', [
+            'json' => [
+                'title' => 'Test slide for ROLE_EDITOR',
+                'template' => $templateIri,
+                'theme' => $themeIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test PUT - ROLE_EDITOR should have access
+        $client->request('PUT', $createdIri, [
+            'json' => [
+                'title' => 'Updated by ROLE_EDITOR',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseIsSuccessful();
+
+        // Test DELETE - ROLE_EDITOR should have access
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testSlideAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Slide::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/slides', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test POST - ROLE_USER should be denied
+        $templateIri = $this->findIriBy(Template::class, ['title' => 'Image-Text']);
+        $themeIri = $this->findIriBy(Theme::class, ['title' => 'Image-Text']);
+        $client->request('POST', '/v2/slides', [
+            'json' => [
+                'title' => 'Test slide for ROLE_USER',
+                'template' => $templateIri,
+                'theme' => $themeIri,
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test PUT - ROLE_USER should be denied
+        $client->request('PUT', $iri, [
+            'json' => [
+                'title' => 'Updated by ROLE_USER',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_USER should be denied
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }
diff --git a/tests/Api/ThemesTest.php b/tests/Api/ThemesTest.php
index 4cb8ca9c8..4dd4be3a1 100644
--- a/tests/Api/ThemesTest.php
+++ b/tests/Api/ThemesTest.php
@@ -7,6 +7,7 @@
 use App\Entity\Tenant\Slide;
 use App\Entity\Tenant\Theme;
 use App\Tests\AbstractBaseApiTestCase;
+use App\Utils\Roles;
 
 class ThemesTest extends AbstractBaseApiTestCase
 {
@@ -215,4 +216,76 @@ public function testDeleteThemeInUse(): void
             static::getContainer()->get('doctrine')->getRepository(Theme::class)->findOneBy(['id' => $ulid])
         );
     }
+
+    public function testThemeAuthorizationRoleEditor(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_EDITOR should have access
+        $client->request('GET', '/v2/themes', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+
+        // Test GET item - ROLE_EDITOR should have access
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testThemeAuthorizationRoleUser(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_USER);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test GET collection - ROLE_USER should be denied
+        $client->request('GET', '/v2/themes', ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test GET item - ROLE_USER should be denied
+        $client->request('GET', $iri, ['headers' => ['Content-Type' => 'application/ld+json']]);
+        $this->assertResponseStatusCodeSame(403);
+    }
+
+    public function testThemeAuthorizationRoleAdminCanCreateDelete(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_ADMIN);
+
+        // Test POST - ROLE_ADMIN should have access (not ROLE_EDITOR)
+        $response = $client->request('POST', '/v2/themes', [
+            'json' => [
+                'title' => 'Test theme for ROLE_ADMIN',
+                'logo' => 'data:image/svg+xml;base64,test',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(201);
+        $createdIri = $response->toArray()['@id'];
+
+        // Test DELETE - ROLE_ADMIN should have access (not ROLE_EDITOR)
+        $client->request('DELETE', $createdIri);
+        $this->assertResponseStatusCodeSame(204);
+    }
+
+    public function testThemeAuthorizationRoleEditorCannotCreateDelete(): void
+    {
+        $client = $this->getAuthenticatedClient(Roles::ROLE_EDITOR);
+        $iri = $this->findIriBy(Theme::class, ['tenant' => $this->tenant]);
+
+        // Test POST - ROLE_EDITOR should be denied (only ROLE_ADMIN can create)
+        $client->request('POST', '/v2/themes', [
+            'json' => [
+                'title' => 'Test theme for ROLE_EDITOR',
+                'logo' => 'data:image/svg+xml;base64,test',
+            ],
+            'headers' => [
+                'Content-Type' => 'application/ld+json',
+            ],
+        ]);
+        $this->assertResponseStatusCodeSame(403);
+
+        // Test DELETE - ROLE_EDITOR should be denied (only ROLE_ADMIN can delete)
+        $client->request('DELETE', $iri);
+        $this->assertResponseStatusCodeSame(403);
+    }
 }