user->isAdmin()) { throw new Forbidden(); } return parent::getActionList($request, $response); } }