[Symfony 7.3] Replace AuthorizationChecker with AccessDecisionManager…

[meddrh]

Adds a Symfony 7.3 Rector rule that replaces AuthorizationCheckerInterface
with AccessDecisionManagerInterface in voters.

The rule updates injected services, renames properties, and converts
isGranted() calls to decide().

Tests and fixtures are included.

[samsonasik]

Please register the rule to

https://github.com/rectorphp/rector-symfony/blob/main/config/sets/symfony/symfony7/symfony73/symfony73-security-core.php

[TomasVotruba]

Thank you 👍

[trsteel88]

I'm using AuthorisationCheckerInterface in a voter and AuthorizationCheckerToAccessDecisionManagerInVoterRector is completely stripping out the injection of this service. We then have code failing as $this->authorizationChecker is no longer available. @TomasVotruba, looks like the actual upgrade is working to replace the variable and use the new signature with $token as the first parameter?

[trsteel88]

Here is the breaking code.

Original:

final class FooVoter extends Voter
{
    public const string EDIT = 'edit';

    public function __construct(
        private readonly AuthorizationCheckerInterface $authorizationChecker,
    ) {
    }

    protected function supports(string $attribute, mixed $subject): bool
    {
        if (!$subject instanceof Foo) {
            return false;
        }

        return \in_array($attribute, [self::EDIT], true);
    }

    /**
     * @param Foo $subject
     */
    protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token, ?Vote $vote = null): bool
    {
        $currentUser = $token->getUser();

        // the user must be logged in; if not, deny permission
        if (!$currentUser instanceof User) {
            return false;
        }

        return match ($attribute) {
            self::EDIT => $this->isEditable($currentUser, $subject),
            default => false,
        };
    }
    
    private function isEditable(User $currentUser, Foo $subject): bool
    {
        if ($this->authorizationChecker->isGranted('ROLE_SUPER_ADMIN')) {
            // Super admin always has access
            return true;
        }

        return $subject->getOwner() === $currentUser;
    }
}

And the change:

Additionally, I thought it be because I didn't have a Token on my private method for isEditable but adding that didn't resolve it either. I don't think this is a safe rule to be implemented in Rector?