fix(acl): align top-menu permissions, parents, and dead keys

[Ibochkarev]

What changed and why

Menu rows, controllers, and processors used different Access Policy keys for the same screens. Parent folders also reused child page keys, so denying System Settings hid the whole Gear menu.

This PR:

• Aligns Error Log menu and page on error_log_view (drops view_eventlog)
• Aligns Gear → Menus menu and system/action on menus (drops actions)
• Clears the unused logout menu gate (logout controller/processor already allow exit)
• Gives parents their own keys:
  • Media → menu_media (browser stays file_manager)
  • Access → menu_access (ACL / Resource Groups / Flush Permissions stay access_permissions)
  • Gear → menu_system (System Settings stays settings)
• Removes dead keys from AdministratorTemplate and core policies: about, credits, export_static, menu_security, menu_support, menu_tools
• Updates English lexicon descriptions for the new map (mgr_log_view, parent keys, settings / file_manager / access_permissions)

Upgrade script setup/includes/upgrades/common/3.3.0-top-menu-access-policy.php (wired from mysql/3.3.0-pl.php):

• Rewrites the listed menu rows, including comma-separated permission tokens
• Grants menu_media / menu_access / menu_system when the old shared key was present (keeps parent visibility)
• Does not OR-merge view_eventlog→error_log_view or actions→menus (no page-level privilege gain)
• Strips retired keys from policy JSON and removes matching modAccessPermission rows
• Ensures menu_media and menu_access exist on AdministratorTemplate

Left unchanged on purpose: menu_site, components, menu_trash (already parent-specific / live). No menu_content / menu_packages / trash_view renames from #16595.

How to test

1. core/vendor/bin/phpunit -c _build/test/phpunit.xml --filter TopMenuAccessPolicyTest → exit 0 (13 tests)
2. php -l on touched PHP files
3. After upgrade or fresh install:
   • Deny error_log_view → Error Log menu and ?a=system/event both fail
   • Deny menus → Menus menu, ?a=system/action, and Menu processors fail
   • Deny settings, keep menu_system → Gear visible, System Settings blocked
   • Deny file_manager, keep menu_media → Media visible, Browser blocked; Sources still use sources
   • Deny menu_access → Access parent hidden even with view_user
   • User without logout can still leave the manager
4. Custom policy with only view_eventlog or actions does not gain error_log_view / menus after upgrade

Related issue(s)/PR(s)

Refs #14498 (2026 suggested shape). Does not close the full 2019 umbrella.

Related: #16595 (earlier parent/dead-key attempt), #17010 (Media ACL), #14467 (Trash).

Compatibility notes

Existing installs need the 3.3.0-pl upgrade path. Extras that call hasPermission('actions') or hasPermission('view_eventlog') must switch to menus / error_log_view.

If another open PR also adds setup/includes/upgrades/mysql/3.3.0-pl.php, merge both include lines on land.

Breaking change assessment

Yes. Retired ACL keys and new parent keys change default policy data and menu gates. Upgrade preserves parent visibility for users who had the old shared keys. It does not grant page access from menu-only aliases.

Test coverage

_build/test/Tests/Controllers/TopMenuAccessPolicyTest.php — transport map, controllers/processors, dead/parent keys, upgrade helpers (composite tokens, parent grants, explicit parent deny).

Contributors

@Ruslan-Aleev — original report and #16595 shape.

AI tool use

Cursor agent used for implementation, review, and PR drafting.