Avoid hard BC break with anonymous role

Author: acrobat

Domain/SecurityIdentityRetrievalStrategy.php

@@ -62,17 +62,16 @@ public function getSecurityIdentities(?TokenInterface $token)
             }
         }
 
-        $anonymousRole = \defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS') ? AuthenticatedVoter::PUBLIC_ACCESS : AuthenticatedVoter::IS_AUTHENTICATED_ANONYMOUSLY;
         // add built-in special roles
         if ($this->authenticationTrustResolver->isFullFledged($token)) {
             $sids[] = new RoleSecurityIdentity(AuthenticatedVoter::IS_AUTHENTICATED_FULLY);
             $sids[] = new RoleSecurityIdentity(AuthenticatedVoter::IS_AUTHENTICATED_REMEMBERED);
-            $sids[] = new RoleSecurityIdentity($anonymousRole);
+            $this->addAnonymousRoles($sids);
         } elseif ($this->authenticationTrustResolver->isRememberMe($token)) {
             $sids[] = new RoleSecurityIdentity(AuthenticatedVoter::IS_AUTHENTICATED_REMEMBERED);
-            $sids[] = new RoleSecurityIdentity($anonymousRole);
+            $this->addAnonymousRoles($sids);
         } elseif ($this->isNotAuthenticated($token)) {
-            $sids[] = new RoleSecurityIdentity($anonymousRole);
+            $this->addAnonymousRoles($sids);
         }
 
         return $sids;
@@ -86,4 +85,12 @@ private function isNotAuthenticated(?TokenInterface $token): bool
 
         return $this->authenticationTrustResolver->isAnonymous($token);
     }
+
+    private function addAnonymousRoles(array &$sids)
+    {
+        $sids[] = new RoleSecurityIdentity('IS_AUTHENTICATED_ANONYMOUSLY');
+        if (\defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS')) {
+            $sids[] = new RoleSecurityIdentity(AuthenticatedVoter::PUBLIC_ACCESS);
+        }
+    }
 }

Tests/Domain/SecurityIdentityRetrievalStrategyTest.php

@@ -130,52 +130,51 @@ public function testDeprecatedGetSecurityIdentities($user, array $roles, string
 
     public function getSecurityIdentityRetrievalTests(): array
     {
-        $anonymousRole = \defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS') ? AuthenticatedVoter::PUBLIC_ACCESS : AuthenticatedVoter::IS_AUTHENTICATED_ANONYMOUSLY;
+        $anonymousRoles = [new RoleSecurityIdentity('IS_AUTHENTICATED_ANONYMOUSLY')];
+        if (\defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS')) {
+            $anonymousRoles[] = new RoleSecurityIdentity(AuthenticatedVoter::PUBLIC_ACCESS);
+        }
 
         return [
-            [new Account('johannes'), ['ROLE_USER', 'ROLE_SUPERADMIN'], 'fullFledged', [
+            [new Account('johannes'), ['ROLE_USER', 'ROLE_SUPERADMIN'], 'fullFledged', array_merge([
                 new UserSecurityIdentity('johannes', Account::class),
                 new RoleSecurityIdentity('ROLE_USER'),
                 new RoleSecurityIdentity('ROLE_SUPERADMIN'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_FULLY'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_REMEMBERED'),
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
-            [new CustomUserImpl('johannes'), ['ROLE_FOO'], 'fullFledged', [
+            ], $anonymousRoles)],
+            [new CustomUserImpl('johannes'), ['ROLE_FOO'], 'fullFledged', array_merge([
                 new UserSecurityIdentity('johannes', CustomUserImpl::class),
                 new RoleSecurityIdentity('ROLE_FOO'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_FULLY'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_REMEMBERED'),
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
-            [new Account('foo'), ['ROLE_FOO'], 'rememberMe', [
+            ], $anonymousRoles)],
+            [new Account('foo'), ['ROLE_FOO'], 'rememberMe', array_merge([
                 new UserSecurityIdentity('foo', Account::class),
                 new RoleSecurityIdentity('ROLE_FOO'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_REMEMBERED'),
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
-            ['guest', [], 'anonymous', [
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
+            ], $anonymousRoles)],
+            ['guest', [], 'anonymous', $anonymousRoles],
         ];
     }
 
     public function getDeprecatedSecurityIdentityRetrievalTests()
     {
-        $anonymousRole = \defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS') ? AuthenticatedVoter::PUBLIC_ACCESS : AuthenticatedVoter::IS_AUTHENTICATED_ANONYMOUSLY;
+        $anonymousRoles = [new RoleSecurityIdentity('IS_AUTHENTICATED_ANONYMOUSLY')];
+        if (\defined('\Symfony\Component\Security\Core\Authorization\Voter\AuthenticatedVoter::PUBLIC_ACCESS')) {
+            $anonymousRoles[] = new RoleSecurityIdentity(AuthenticatedVoter::PUBLIC_ACCESS);
+        }
 
         return [
-            ['johannes', ['ROLE_FOO'], 'fullFledged', [
+            ['johannes', ['ROLE_FOO'], 'fullFledged', array_merge([
                 new UserSecurityIdentity('johannes', 'MyCustomTokenImpl'),
                 new RoleSecurityIdentity('ROLE_FOO'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_FULLY'),
                 new RoleSecurityIdentity('IS_AUTHENTICATED_REMEMBERED'),
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
-            ['guest', ['ROLE_FOO'], 'anonymous', [
+            ], $anonymousRoles)],
+            ['guest', ['ROLE_FOO'], 'anonymous', array_merge([
                 new RoleSecurityIdentity('ROLE_FOO'),
-                new RoleSecurityIdentity($anonymousRole),
-            ]],
+            ], $anonymousRoles)],
         ];
     }