[jdurand-teclib]

Checklist before requesting a review

Please delete options that are not relevant.

• I have performed a self-review of my code.
• I have added tests (when available) that prove my fix is effective or that my feature works.
• I have updated the CHANGELOG with a short functional description of the fix or new feature.
• This change requires a documentation update.

Description

• This feature request comes from !46030
• Here is a brief description of what this PR does
  • Add a new policy to "Access controls" tab, that allows defining a white list of languages. A user that have his Glpi not configured in the correct language will not be able to see the form. The covered cases are the following.
  • Added unit tests
  • Added e2e tests

Behavior

• The option appears by itself on the plugin installation.
• It is disabled by default, so it doesn't disrupt existing configurations.
• If the plugin is uninstalled (not just disabled, really uninstalled), the data is wiped and the configurations needs to be done again after reinstalling the plugin.

Language access policy: access matrix

Core rule: any Deny refuses access; otherwise at least one Grant is needed; if every policy abstains, access is refused.
"Listed" means the user's current GLPI language is in the policy's list (anonymous visitors: browser or GLPI default language).

#	Active policies	Who	Language	Language vote	Other policies' vote	Result
1	Language only	Logged in	Listed	Grant	—	✅ Allowed
2	Language only	Logged in	Not listed	Deny	—	❌ Refused
3	Language only (empty list)	Logged in	Any	Deny	—	❌ Refused (warning shown in admin)
4	Language only	Anonymous	Any	Abstain / Deny	—	🔒 Sent to login page (no policy allows anonymous)
5	Language + Allow list	Logged in, in allow list	Listed	Abstain	Grant	✅ Allowed
6	Language + Allow list	Logged in, in allow list	Not listed	Deny	Grant	❌ Refused
7	Language + Allow list	Logged in, not in allow list	Listed	Abstain	Abstain	❌ Refused
8	Language + Allow list	Logged in, not in allow list	Not listed	Deny	Abstain	❌ Refused
9	Language + Allow list "All users"	Logged in	Listed	Abstain	Grant	✅ Allowed
10	Language + Allow list "All users"	Logged in	Not listed	Deny	Grant	❌ Refused
11	Language + Allow list	Anonymous	Any	—	—	🔒 Sent to login page
12	Language + Direct access	Logged in or anonymous¹	Listed, valid token	Abstain	Grant	✅ Allowed
13	Language + Direct access	Logged in or anonymous¹	Not listed, valid token	Deny	Grant	❌ Refused
14	Language + Direct access	Logged in or anonymous¹	Listed, no or wrong token	Abstain	Abstain	❌ Refused
15	Language + Direct access (anonymous not allowed)	Anonymous	Any	—	—	🔒 Sent to login page
16	Language + Allow list + Direct access	Logged in	Listed, and (in allow list or valid token)	Abstain	≥1 Grant	✅ Allowed
17	Language + Allow list + Direct access	Logged in	Not listed	Deny	Any	❌ Refused
18	Language policy inactive	Anyone	Any	—	Core rules	Core decides, language has no effect
19	No active policy at all	Anyone	Any	—	—	❌ Refused
20	Admin previewing the form	Admin	Any	—	—	✅ Allowed (preview skips all access checks)

¹ Anonymous visitors only when Direct access has "allow unauthenticated" turned on.

Screenshots (if appropriate):

Documentations updates:

[FR] https://github.com/glpi-network/gitbook-fr/commit/805434629d0fa8f279f52c08790cca4e0318d42c
[EN] https://github.com/glpi-network/gitbook/commit/a625463bbb78f8e23dc517327274a3569d775034

[stonebuzz]

LGTM