Add access controls and permissions for signature steps

Implemented a Voter to enforce permissions on signature steps, ensuring only authorized users can sign steps. Updated relevant controllers and templates to reflect these permissions, and added corresponding tests to validate the changes.

src/Bundle/ChillMainBundle/Controller/WorkflowAddSignatureController.php

@@ -14,13 +14,16 @@ namespace Chill\MainBundle\Controller;
 use Chill\DocStoreBundle\Service\Signature\PDFSignatureZoneAvailable;
 use Chill\MainBundle\Entity\Workflow\EntityWorkflowSignatureStateEnum;
 use Chill\MainBundle\Entity\Workflow\EntityWorkflowStepSignature;
+use Chill\MainBundle\Security\Authorization\EntityWorkflowStepSignatureVoter;
 use Chill\MainBundle\Workflow\EntityWorkflowManager;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
+use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
 use Symfony\Component\HttpKernel\Exception\NotFoundHttpException;
 use Symfony\Component\Routing\Annotation\Route;
 use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
+use Symfony\Component\Security\Core\Security;
 use Symfony\Component\Serializer\Normalizer\NormalizerInterface;
 use Twig\Environment;
 
@@ -32,11 +35,16 @@ final readonly class WorkflowAddSignatureController
         private NormalizerInterface $normalizer,
         private Environment $twig,
         private UrlGeneratorInterface $urlGenerator,
+        private Security $security,
     ) {}
 
     #[Route(path: '/{_locale}/main/workflow/signature/{id}/sign', name: 'chill_main_workflow_signature_add', methods: 'GET')]
     public function __invoke(EntityWorkflowStepSignature $signature, Request $request): Response
     {
+        if (!$this->security->isGranted(EntityWorkflowStepSignatureVoter::SIGN, $signature)) {
+            throw new AccessDeniedHttpException('not authorized to sign this step');
+        }
+
         $entityWorkflow = $signature->getStep()->getEntityWorkflow();
 
         if (EntityWorkflowSignatureStateEnum::PENDING !== $signature->getState()) {