From a86875c03cbe861926be511aa62c731e370b9b78 Mon Sep 17 00:00:00 2001
From: bach <bachir@figureslibres.io>
Date: Fri, 4 Sep 2026 11:01:07 +0200
Subject: [PATCH] Add admin/editeur/user roles for the associates

root (renamed from the default admin/admin account) keeps full,
unrestricted access outside any role system. These three cover the
actual associates:

- user: read-only, 'access content' only -- can browse /lignes and
  /dashboard, nothing else.
- editeur: 'access content' + create/edit any/delete any
  ligne_comptable content -- can enter and correct accounting lines,
  no site configuration.
- admin: identical permission set to editeur for now (per instruction,
  actual config permissions to be scoped later).

Left the pre-existing "administrator" (is_admin bypass -- too broad)
and "content_editor" (generic Standard-recipe scaffolding, permissions
unrelated to ligne_comptable) roles untouched but unused; worth
pruning later if nothing ends up using them.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 ...ystem.action.user_add_role_action.admin.yml | 14 ++++++++++++++
 ...tem.action.user_add_role_action.editeur.yml | 14 ++++++++++++++
 ...system.action.user_add_role_action.user.yml | 14 ++++++++++++++
 ...em.action.user_remove_role_action.admin.yml | 14 ++++++++++++++
 ....action.user_remove_role_action.editeur.yml | 14 ++++++++++++++
 ...tem.action.user_remove_role_action.user.yml | 14 ++++++++++++++
 config/sync/user.role.admin.yml                | 18 ++++++++++++++++++
 config/sync/user.role.editeur.yml              | 18 ++++++++++++++++++
 config/sync/user.role.user.yml                 | 12 ++++++++++++
 9 files changed, 132 insertions(+)
 create mode 100644 config/sync/system.action.user_add_role_action.admin.yml
 create mode 100644 config/sync/system.action.user_add_role_action.editeur.yml
 create mode 100644 config/sync/system.action.user_add_role_action.user.yml
 create mode 100644 config/sync/system.action.user_remove_role_action.admin.yml
 create mode 100644 config/sync/system.action.user_remove_role_action.editeur.yml
 create mode 100644 config/sync/system.action.user_remove_role_action.user.yml
 create mode 100644 config/sync/user.role.admin.yml
 create mode 100644 config/sync/user.role.editeur.yml
 create mode 100644 config/sync/user.role.user.yml

diff --git a/config/sync/system.action.user_add_role_action.admin.yml b/config/sync/system.action.user_add_role_action.admin.yml
new file mode 100644
index 0000000..9802e54
--- /dev/null
+++ b/config/sync/system.action.user_add_role_action.admin.yml
@@ -0,0 +1,14 @@
+uuid: 581c4991-a2c0-4767-87ca-2405fb63c3a1
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.admin
+  module:
+    - user
+id: user_add_role_action.admin
+label: 'Add the Admin role to the selected user(s)'
+type: user
+plugin: user_add_role_action
+configuration:
+  rid: admin
diff --git a/config/sync/system.action.user_add_role_action.editeur.yml b/config/sync/system.action.user_add_role_action.editeur.yml
new file mode 100644
index 0000000..8c67061
--- /dev/null
+++ b/config/sync/system.action.user_add_role_action.editeur.yml
@@ -0,0 +1,14 @@
+uuid: c2b7ee51-1550-4fc0-b43c-32e11e5cf00b
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.editeur
+  module:
+    - user
+id: user_add_role_action.editeur
+label: 'Add the Éditeur role to the selected user(s)'
+type: user
+plugin: user_add_role_action
+configuration:
+  rid: editeur
diff --git a/config/sync/system.action.user_add_role_action.user.yml b/config/sync/system.action.user_add_role_action.user.yml
new file mode 100644
index 0000000..68f9067
--- /dev/null
+++ b/config/sync/system.action.user_add_role_action.user.yml
@@ -0,0 +1,14 @@
+uuid: 24f21f8a-6568-46c9-84ee-d7480458882a
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.user
+  module:
+    - user
+id: user_add_role_action.user
+label: 'Add the Utilisateur (lecture seule) role to the selected user(s)'
+type: user
+plugin: user_add_role_action
+configuration:
+  rid: user
diff --git a/config/sync/system.action.user_remove_role_action.admin.yml b/config/sync/system.action.user_remove_role_action.admin.yml
new file mode 100644
index 0000000..eb7f77d
--- /dev/null
+++ b/config/sync/system.action.user_remove_role_action.admin.yml
@@ -0,0 +1,14 @@
+uuid: cdf63fcb-1d6a-46f8-baaf-1aad7dea8199
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.admin
+  module:
+    - user
+id: user_remove_role_action.admin
+label: 'Remove the Admin role from the selected user(s)'
+type: user
+plugin: user_remove_role_action
+configuration:
+  rid: admin
diff --git a/config/sync/system.action.user_remove_role_action.editeur.yml b/config/sync/system.action.user_remove_role_action.editeur.yml
new file mode 100644
index 0000000..720026f
--- /dev/null
+++ b/config/sync/system.action.user_remove_role_action.editeur.yml
@@ -0,0 +1,14 @@
+uuid: d14de2f6-99a6-4c9a-8eed-c95f83b56607
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.editeur
+  module:
+    - user
+id: user_remove_role_action.editeur
+label: 'Remove the Éditeur role from the selected user(s)'
+type: user
+plugin: user_remove_role_action
+configuration:
+  rid: editeur
diff --git a/config/sync/system.action.user_remove_role_action.user.yml b/config/sync/system.action.user_remove_role_action.user.yml
new file mode 100644
index 0000000..0cc7150
--- /dev/null
+++ b/config/sync/system.action.user_remove_role_action.user.yml
@@ -0,0 +1,14 @@
+uuid: 7198a84f-b1a1-4eae-adf4-f3a9de6cd79f
+langcode: en
+status: true
+dependencies:
+  config:
+    - user.role.user
+  module:
+    - user
+id: user_remove_role_action.user
+label: 'Remove the Utilisateur (lecture seule) role from the selected user(s)'
+type: user
+plugin: user_remove_role_action
+configuration:
+  rid: user
diff --git a/config/sync/user.role.admin.yml b/config/sync/user.role.admin.yml
new file mode 100644
index 0000000..8815621
--- /dev/null
+++ b/config/sync/user.role.admin.yml
@@ -0,0 +1,18 @@
+uuid: 45d15bb6-7222-481f-8306-58f0d207fa97
+langcode: en
+status: true
+dependencies:
+  config:
+    - node.type.ligne_comptable
+  module:
+    - node
+    - system
+id: admin
+label: Admin
+weight: 6
+is_admin: false
+permissions:
+  - 'access content'
+  - 'create ligne_comptable content'
+  - 'delete any ligne_comptable content'
+  - 'edit any ligne_comptable content'
diff --git a/config/sync/user.role.editeur.yml b/config/sync/user.role.editeur.yml
new file mode 100644
index 0000000..e1e6815
--- /dev/null
+++ b/config/sync/user.role.editeur.yml
@@ -0,0 +1,18 @@
+uuid: ab5bea78-990d-4ca0-af28-d209c60a248e
+langcode: en
+status: true
+dependencies:
+  config:
+    - node.type.ligne_comptable
+  module:
+    - node
+    - system
+id: editeur
+label: Éditeur
+weight: 5
+is_admin: false
+permissions:
+  - 'access content'
+  - 'create ligne_comptable content'
+  - 'delete any ligne_comptable content'
+  - 'edit any ligne_comptable content'
diff --git a/config/sync/user.role.user.yml b/config/sync/user.role.user.yml
new file mode 100644
index 0000000..5036c41
--- /dev/null
+++ b/config/sync/user.role.user.yml
@@ -0,0 +1,12 @@
+uuid: 24f4e46d-c714-486d-b000-f092eb727470
+langcode: en
+status: true
+dependencies:
+  module:
+    - system
+id: user
+label: 'Utilisateur (lecture seule)'
+weight: 4
+is_admin: false
+permissions:
+  - 'access content'