fix: remove deprecated eraseCredentials() — breaks logout on Symfony 8

spec/EcPhp/CasBundle/Controller/LoginSpec.php

@@ -17,7 +17,6 @@
 use Nyholm\Psr7\ServerRequest;
 use PhpSpec\ObjectBehavior;
 use Psr\Http\Message\ResponseInterface;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 
 class LoginSpec extends ObjectBehavior
@@ -29,7 +28,6 @@ public function it_is_initializable()
 
     public function it_return_a_psr_response_in_case_of_success(
         CasInterface $cas,
-        Security $security,
         ResponseInterface $casResponse,
     ) {
         $request = new ServerRequest('GET', '/');
@@ -42,22 +40,21 @@ public function it_return_a_psr_response_in_case_of_success(
             ->getHeaderLine('location')
             ->willReturn('https://foo.com');
 
-        $response = $this->__invoke($request, $cas, $security);
+        $response = $this->__invoke($request, $cas);
         $response->shouldBeAnInstanceOf(ResponseInterface::class);
         $response->getHeaderLine('location')->shouldBe('https://foo.com');
     }
 
     public function it_return_a_symfony_redirection_in_case_of_exception(
         CasInterface $cas,
-        Security $security,
     ) {
         $request = new ServerRequest('GET', '/');
 
         $cas
             ->login($request)
             ->willThrow(new Exception('Unable to login'));
 
-        $response = $this->__invoke($request, $cas, $security);
+        $response = $this->__invoke($request, $cas);
         $response->shouldBeAnInstanceOf(RedirectResponse::class);
         $response->headers->get('location')->shouldBe('/');
     }

spec/EcPhp/CasBundle/Controller/LogoutSpec.php

@@ -17,7 +17,6 @@
 use Nyholm\Psr7\ServerRequest;
 use PhpSpec\ObjectBehavior;
 use Psr\Http\Message\ResponseInterface;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 
@@ -30,19 +29,17 @@ public function it_is_initializable()
 
     public function it_redirects_to_index(
         CasInterface $cas,
-        Security $security,
         TokenStorageInterface $tokenStorage
     ) {
         $request = new ServerRequest('GET', '/');
 
-        $response = $this->__invoke($request, $cas, $security, $tokenStorage);
+        $response = $this->__invoke($request, $cas, $tokenStorage);
         $response->shouldBeAnInstanceOf(RedirectResponse::class);
         $response->headers->get('location')->shouldReturn('/');
     }
 
     public function it_return_a_psr_response_in_case_of_success(
         CasInterface $cas,
-        Security $security,
         TokenStorageInterface $tokenStorage,
         ResponseInterface $casResponse,
     ) {
@@ -56,7 +53,7 @@ public function it_return_a_psr_response_in_case_of_success(
             ->getHeaderLine('location')
             ->willReturn('http://local/cas/logout');
 
-        $response = $this->__invoke($request, $cas, $security, $tokenStorage);
+        $response = $this->__invoke($request, $cas, $tokenStorage);
         $response->shouldBeAnInstanceOf(ResponseInterface::class);
         $response->getHeaderLine('location')->shouldBe('http://local/cas/logout');
         $tokenStorage
@@ -66,7 +63,6 @@ public function it_return_a_psr_response_in_case_of_success(
 
     public function it_return_a_symfony_redirection_in_case_of_exception(
         CasInterface $cas,
-        Security $security,
         TokenStorageInterface $tokenStorage
     ) {
         $request = new ServerRequest('GET', '/');
@@ -75,7 +71,7 @@ public function it_return_a_symfony_redirection_in_case_of_exception(
             ->logout($request)
             ->willThrow(new Exception('Unable to login'));
 
-        $response = $this->__invoke($request, $cas, $security, $tokenStorage);
+        $response = $this->__invoke($request, $cas, $tokenStorage);
         $response->shouldBeAnInstanceOf(RedirectResponse::class);
         $response->headers->get('location')->shouldBe('/');
     }

src/Controller/Logout.php

@@ -14,7 +14,6 @@
 use EcPhp\CasLib\Contract\CasInterface;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
-use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\HttpFoundation\RedirectResponse;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
 use Throwable;
@@ -24,7 +23,6 @@ final class Logout
     public function __invoke(
         ServerRequestInterface $request,
         CasInterface $cas,
-        Security $security,
         TokenStorageInterface $tokenStorage
     ): RedirectResponse|ResponseInterface {
         try {
@@ -36,7 +34,6 @@ public function __invoke(
             return new RedirectResponse('/');
         }
 
-        $security->getToken()?->eraseCredentials();
         $tokenStorage->setToken(null);
 
         return $response;

src/Security/Core/User/CasUser.php

@@ -25,6 +25,13 @@ public function __toString(): string
         return (string) $this->get('user');
     }
 
+    /**
+     * `eraseCredentials()` is still required by `UserInterface` on Symfony
+     * 6.4 and 7 (deprecated since 7.3, removed in 8.0). Keeping this empty
+     * method is harmless on Symfony 8, where it's no longer part of the
+     * interface. It can be removed once support for Symfony 6.4 and 7 is
+     * dropped.
+     */
     public function eraseCredentials(): void {}
 
     public function get(string $key, mixed $default = null): mixed