fix: add missing access checks

src/Controller/Administrative/Assignment/CallOffController.php

@@ -25,7 +25,7 @@ class CallOffController extends AbstractController
     }
 
     #[Route('/administrative/assignment/call-off/{uuid}', name: 'app_administrative_assignment_call_off')]
-    #[IsGranted('ROLE_ADMINISTRATIVE')]
+    #[IsGranted('CALL_OFF', subject: 'assignment')]
     public function index(Assignment $assignment, Request $request): Response
     {
         if (true === $request->isMethod('POST')) {

src/Controller/Administrative/Assignment/PublishController.php

@@ -11,6 +11,7 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 class PublishController extends AbstractController
 {
@@ -23,6 +24,7 @@ class PublishController extends AbstractController
     }
 
     #[Route('/administrative/assignment/publish/{uuid}', name: 'app_administrative_assignment_publish')]
+    #[IsGranted('PUBLISH', subject: 'assignment')]
     public function index(Assignment $assignment, Request $request): Response
     {
         $returnUrl = $this->getReturnUrl($request, 'app_administrative_assignment_index');

src/Controller/Administrative/System/Destination/EditController.php

@@ -13,6 +13,7 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 class EditController extends AbstractController
 {
@@ -27,6 +28,7 @@ class EditController extends AbstractController
     }
 
     #[Route('/administrative/destination/edit/{id}', name: 'app_administrative_system_destination_edit')]
+    #[IsGranted('ROLE_ADMINISTRATIVE')]
     public function index(Destination $destination, Request $request): Response
     {
         $destinationDto = DestinationDto::fromEntity($destination);

src/Controller/Administrative/System/Faq/IndexController.php

@@ -32,6 +32,7 @@ class IndexController extends AbstractController
     }
 
     #[Route('/administrative/system/faq/sort', name: 'app_administrative_system_faq_sort', methods: ['POST'])]
+    #[IsGranted('ROLE_ADMINISTRATIVE')]
     public function sort(Request $request): JsonResponse
     {
         $data = json_decode($request->getContent(), true);