[Router] Allow CRUD controllers to control which actions to generate admin routes for

[natepage]

Lately I found myself creating a few "read-only" CRUD controllers with only the index and detail actions, and it works well as I can configure permissions on the actions to limit access to undesired ones.

However, I've realised that admin routes for all actions were still generated which results in 8 admin routes per CRUD controller where I actually need only 2 😄

This feature allows CRUD controllers, using the #[AdminRoute] attribute at the class level to allow/deny actions which dictates which routes to generate.

Besides addressing the growing number of unused routes, I believe this could be good for security as well, if nobody is supposed to be able to delete an entity then do not expose the route to attempt at all 😄

[Seb33300]

Hi @natepage, I think this is already possible through permissions: https://symfony.com/bundles/EasyAdminBundle/current/security.html#restrict-access-to-actions

[natepage]

Hi @Seb33300 thank you for your reply, you're right EA allows to use permissions to restrict access to actions, and I use it already, however I'm addressing a different use-case here.

Restricting access to an action implies it will be available to a subset of users, therefore its associated route must be generated, and the decision is made when handling the request.

The use-case I cover here is "nobody should be able to trigger action X on crud Y, ever" regardless of permissions, so instead of generating its route, allowing actors to try to trigger it to only decline them, this solution allows applications to explicitly prevent the route from being generated.

[KDederichs]

Isn't that just ->disable(Action::EDIT, Action::DELETE, Action::BATCH_DELETE, Action::NEW) on configureActions?
Dunno if it actually stops the routes from being generated (if it doesn't that might warrant a PR) but I think you're trying to replicate that.

[natepage]

@KDederichs I looked into that before opening this PR, and no it doesn't 😄

EA RouteGenerator relies exclusively on reflection and attributes, which I think makes sense because all methods in CrudControllers are called within the context of processing a Request and could make all sorts of complex decisions to disable actions, register fields, etc.

Hence this PR