From d312f9f6953558584126082fc003139ba4c56d83 Mon Sep 17 00:00:00 2001 From: NICOLAU Bastien Date: Thu, 26 Mar 2026 13:15:02 +0100 Subject: [PATCH 1/4] fix: remove deprecated eraseCredentials() usage `eraseCredentials()` was deprecated in Symfony 7.3 and removed in 8.0. - Remove empty `eraseCredentials()` from `CasUser` - Remove `$security->getToken()?->eraseCredentials()` call from `Logout` controller - Remove unused `Security` dependency from `Logout` controller Ref: https://symfony.com/blog/new-in-symfony-7-3-security-improvements#deprecate-erasecredentials-method --- src/Controller/Logout.php | 3 --- src/Security/Core/User/CasUser.php | 2 -- 2 files changed, 5 deletions(-) diff --git a/src/Controller/Logout.php b/src/Controller/Logout.php index f3a76e4..c0cee68 100644 --- a/src/Controller/Logout.php +++ b/src/Controller/Logout.php @@ -14,7 +14,6 @@ use EcPhp\CasLib\Contract\CasInterface; use Psr\Http\Message\ResponseInterface; use Psr\Http\Message\ServerRequestInterface; -use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\RedirectResponse; use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; use Throwable; @@ -24,7 +23,6 @@ final class Logout public function __invoke( ServerRequestInterface $request, CasInterface $cas, - Security $security, TokenStorageInterface $tokenStorage ): RedirectResponse|ResponseInterface { try { @@ -36,7 +34,6 @@ public function __invoke( return new RedirectResponse('/'); } - $security->getToken()?->eraseCredentials(); $tokenStorage->setToken(null); return $response; diff --git a/src/Security/Core/User/CasUser.php b/src/Security/Core/User/CasUser.php index e0fdfe4..f82e8c9 100644 --- a/src/Security/Core/User/CasUser.php +++ b/src/Security/Core/User/CasUser.php @@ -25,8 +25,6 @@ public function __toString(): string return (string) $this->get('user'); } - public function eraseCredentials(): void {} - public function get(string $key, mixed $default = null): mixed { return $this->payload[$key] ?? $default; From d7cd9b1bb2b8112294e082bb22fd3877b9f9d54c Mon Sep 17 00:00:00 2001 From: NICOLAU Bastien Date: Fri, 14 Aug 2026 05:29:52 +0200 Subject: [PATCH 2/4] fix: restore eraseCredentials() on CasUser for Symfony 6.4/7 compat UserInterface still requires eraseCredentials() on Symfony 6.4 and 7 (deprecated in 7.3, removed in 8.0). The empty method is harmless on Symfony 8 since it's no longer part of the interface. --- src/Security/Core/User/CasUser.php | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/Security/Core/User/CasUser.php b/src/Security/Core/User/CasUser.php index f82e8c9..19a31b5 100644 --- a/src/Security/Core/User/CasUser.php +++ b/src/Security/Core/User/CasUser.php @@ -25,6 +25,15 @@ public function __toString(): string return (string) $this->get('user'); } + /** + * `eraseCredentials()` is still required by `UserInterface` on Symfony + * 6.4 and 7 (deprecated since 7.3, removed in 8.0). Keeping this empty + * method is harmless on Symfony 8, where it's no longer part of the + * interface. It can be removed once support for Symfony 6.4 and 7 is + * dropped. + */ + public function eraseCredentials(): void {} + public function get(string $key, mixed $default = null): mixed { return $this->payload[$key] ?? $default; From aac3bb4c020621a451452ad5841f7fccac1dd2dc Mon Sep 17 00:00:00 2001 From: NICOLAU Bastien Date: Fri, 14 Aug 2026 06:03:49 +0200 Subject: [PATCH 3/4] test: update LogoutSpec after Logout signature change The Security collaborator was removed from Logout::__invoke() but the spec still passed it, sending a Security double where a TokenStorageInterface was expected (TypeError on the 3 examples). --- spec/EcPhp/CasBundle/Controller/LogoutSpec.php | 10 +++------- 1 file changed, 3 insertions(+), 7 deletions(-) diff --git a/spec/EcPhp/CasBundle/Controller/LogoutSpec.php b/spec/EcPhp/CasBundle/Controller/LogoutSpec.php index 5956f63..89ef742 100644 --- a/spec/EcPhp/CasBundle/Controller/LogoutSpec.php +++ b/spec/EcPhp/CasBundle/Controller/LogoutSpec.php @@ -17,7 +17,6 @@ use Nyholm\Psr7\ServerRequest; use PhpSpec\ObjectBehavior; use Psr\Http\Message\ResponseInterface; -use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\RedirectResponse; use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface; @@ -30,19 +29,17 @@ public function it_is_initializable() public function it_redirects_to_index( CasInterface $cas, - Security $security, TokenStorageInterface $tokenStorage ) { $request = new ServerRequest('GET', '/'); - $response = $this->__invoke($request, $cas, $security, $tokenStorage); + $response = $this->__invoke($request, $cas, $tokenStorage); $response->shouldBeAnInstanceOf(RedirectResponse::class); $response->headers->get('location')->shouldReturn('/'); } public function it_return_a_psr_response_in_case_of_success( CasInterface $cas, - Security $security, TokenStorageInterface $tokenStorage, ResponseInterface $casResponse, ) { @@ -56,7 +53,7 @@ public function it_return_a_psr_response_in_case_of_success( ->getHeaderLine('location') ->willReturn('http://local/cas/logout'); - $response = $this->__invoke($request, $cas, $security, $tokenStorage); + $response = $this->__invoke($request, $cas, $tokenStorage); $response->shouldBeAnInstanceOf(ResponseInterface::class); $response->getHeaderLine('location')->shouldBe('http://local/cas/logout'); $tokenStorage @@ -66,7 +63,6 @@ public function it_return_a_psr_response_in_case_of_success( public function it_return_a_symfony_redirection_in_case_of_exception( CasInterface $cas, - Security $security, TokenStorageInterface $tokenStorage ) { $request = new ServerRequest('GET', '/'); @@ -75,7 +71,7 @@ public function it_return_a_symfony_redirection_in_case_of_exception( ->logout($request) ->willThrow(new Exception('Unable to login')); - $response = $this->__invoke($request, $cas, $security, $tokenStorage); + $response = $this->__invoke($request, $cas, $tokenStorage); $response->shouldBeAnInstanceOf(RedirectResponse::class); $response->headers->get('location')->shouldBe('/'); } From 9604b28053c10fc241edf8b6eca0748d7c3ea5a7 Mon Sep 17 00:00:00 2001 From: NICOLAU Bastien Date: Fri, 14 Aug 2026 06:06:34 +0200 Subject: [PATCH 4/4] test: drop stale Security collaborator from LoginSpec Login::__invoke() has not taken a Security argument for a while, but the spec still declared and passed one. PHP silently ignores the extra trailing argument, so this was dead weight rather than a failure. --- spec/EcPhp/CasBundle/Controller/LoginSpec.php | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/spec/EcPhp/CasBundle/Controller/LoginSpec.php b/spec/EcPhp/CasBundle/Controller/LoginSpec.php index 011b9b9..6fe97fe 100644 --- a/spec/EcPhp/CasBundle/Controller/LoginSpec.php +++ b/spec/EcPhp/CasBundle/Controller/LoginSpec.php @@ -17,7 +17,6 @@ use Nyholm\Psr7\ServerRequest; use PhpSpec\ObjectBehavior; use Psr\Http\Message\ResponseInterface; -use Symfony\Bundle\SecurityBundle\Security; use Symfony\Component\HttpFoundation\RedirectResponse; class LoginSpec extends ObjectBehavior @@ -29,7 +28,6 @@ public function it_is_initializable() public function it_return_a_psr_response_in_case_of_success( CasInterface $cas, - Security $security, ResponseInterface $casResponse, ) { $request = new ServerRequest('GET', '/'); @@ -42,14 +40,13 @@ public function it_return_a_psr_response_in_case_of_success( ->getHeaderLine('location') ->willReturn('https://foo.com'); - $response = $this->__invoke($request, $cas, $security); + $response = $this->__invoke($request, $cas); $response->shouldBeAnInstanceOf(ResponseInterface::class); $response->getHeaderLine('location')->shouldBe('https://foo.com'); } public function it_return_a_symfony_redirection_in_case_of_exception( CasInterface $cas, - Security $security, ) { $request = new ServerRequest('GET', '/'); @@ -57,7 +54,7 @@ public function it_return_a_symfony_redirection_in_case_of_exception( ->login($request) ->willThrow(new Exception('Unable to login')); - $response = $this->__invoke($request, $cas, $security); + $response = $this->__invoke($request, $cas); $response->shouldBeAnInstanceOf(RedirectResponse::class); $response->headers->get('location')->shouldBe('/'); }