[Specs needed] Access rules & permissions in the BO

[matks]

During the Symfony migration, some Symfony controllers were created with the following access rules:

• index (display the page) can be accessed by a user if he is granted READ permission
• form submission requires either CREATE, UPDATE, DELETE permissions (depends on what the form does)

Others were created with the following access rules:

• index (display the page) can be accessed if the user is granted either READ, CREATE, UPDATE or DELETE permissions
• form submission requires either CREATE, UPDATE, DELETE permissions (depends on what the form does) The 2nd kind of controllers were implementing the rule "if you can modify it, you should be able to display it".

So there was 2 different behaviors being used in the backoffice. There was a need to decide of a global rule to be applied systematically.

After discussing it the core team, we agreed to go for the 1st system:

• READ permission grants a BO user the ability to display the page
• CREATE, UPDATE and DELETE permission grants a BO user the ability to modify some of the page content