N°8771 - Add Symfony form component to iTop core (#760)

- Add Symfony Form Component
- Add Symfony CSRF security component
- Add iTop default form template
- Add Twig debug extension to Twig Environment
- Add iTop abstract controller facility to get form builder
- Add Twig filter to make trans an alias of dict_s filter

lib/symfony/security-core/Authorization/AccessDecisionManager.php

@@ -0,0 +1,125 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Strategy\AccessDecisionStrategyInterface;
+use Symfony\Component\Security\Core\Authorization\Strategy\AffirmativeStrategy;
+use Symfony\Component\Security\Core\Authorization\Voter\CacheableVoterInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+use Symfony\Component\Security\Core\Exception\InvalidArgumentException;
+
+/**
+ * AccessDecisionManager is the base class for all access decision managers
+ * that use decision voters.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+final class AccessDecisionManager implements AccessDecisionManagerInterface
+{
+    private const VALID_VOTES = [
+        VoterInterface::ACCESS_GRANTED => true,
+        VoterInterface::ACCESS_DENIED => true,
+        VoterInterface::ACCESS_ABSTAIN => true,
+    ];
+
+    private iterable $voters;
+    private array $votersCacheAttributes = [];
+    private array $votersCacheObject = [];
+    private AccessDecisionStrategyInterface $strategy;
+
+    /**
+     * @param iterable<mixed, VoterInterface> $voters An array or an iterator of VoterInterface instances
+     */
+    public function __construct(iterable $voters = [], ?AccessDecisionStrategyInterface $strategy = null)
+    {
+        $this->voters = $voters;
+        $this->strategy = $strategy ?? new AffirmativeStrategy();
+    }
+
+    /**
+     * @param bool $allowMultipleAttributes Whether to allow passing multiple values to the $attributes array
+     */
+    public function decide(TokenInterface $token, array $attributes, mixed $object = null, bool $allowMultipleAttributes = false): bool
+    {
+        // Special case for AccessListener, do not remove the right side of the condition before 6.0
+        if (\count($attributes) > 1 && !$allowMultipleAttributes) {
+            throw new InvalidArgumentException(\sprintf('Passing more than one Security attribute to "%s()" is not supported.', __METHOD__));
+        }
+
+        return $this->strategy->decide(
+            $this->collectResults($token, $attributes, $object)
+        );
+    }
+
+    /**
+     * @return \Traversable<int, int>
+     */
+    private function collectResults(TokenInterface $token, array $attributes, mixed $object): \Traversable
+    {
+        foreach ($this->getVoters($attributes, $object) as $voter) {
+            $result = $voter->vote($token, $object, $attributes);
+            if (!\is_int($result) || !(self::VALID_VOTES[$result] ?? false)) {
+                throw new \LogicException(\sprintf('"%s::vote()" must return one of "%s" constants ("ACCESS_GRANTED", "ACCESS_DENIED" or "ACCESS_ABSTAIN"), "%s" returned.', get_debug_type($voter), VoterInterface::class, var_export($result, true)));
+            }
+
+            yield $result;
+        }
+    }
+
+    /**
+     * @return iterable<mixed, VoterInterface>
+     */
+    private function getVoters(array $attributes, $object = null): iterable
+    {
+        $keyAttributes = [];
+        foreach ($attributes as $attribute) {
+            $keyAttributes[] = \is_string($attribute) ? $attribute : null;
+        }
+        // use `get_class` to handle anonymous classes
+        $keyObject = \is_object($object) ? $object::class : get_debug_type($object);
+        foreach ($this->voters as $key => $voter) {
+            if (!$voter instanceof CacheableVoterInterface) {
+                yield $voter;
+                continue;
+            }
+
+            $supports = true;
+            // The voter supports the attributes if it supports at least one attribute of the list
+            foreach ($keyAttributes as $keyAttribute) {
+                if (null === $keyAttribute) {
+                    $supports = true;
+                } elseif (!isset($this->votersCacheAttributes[$keyAttribute][$key])) {
+                    $this->votersCacheAttributes[$keyAttribute][$key] = $supports = $voter->supportsAttribute($keyAttribute);
+                } else {
+                    $supports = $this->votersCacheAttributes[$keyAttribute][$key];
+                }
+                if ($supports) {
+                    break;
+                }
+            }
+            if (!$supports) {
+                continue;
+            }
+
+            if (!isset($this->votersCacheObject[$keyObject][$key])) {
+                $this->votersCacheObject[$keyObject][$key] = $supports = $voter->supportsType($keyObject);
+            } else {
+                $supports = $this->votersCacheObject[$keyObject][$key];
+            }
+            if (!$supports) {
+                continue;
+            }
+            yield $voter;
+        }
+    }
+}

lib/symfony/security-core/Authorization/AccessDecisionManagerInterface.php

@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+/**
+ * AccessDecisionManagerInterface makes authorization decisions.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+interface AccessDecisionManagerInterface
+{
+    /**
+     * Decides whether the access is possible or not.
+     *
+     * @param array $attributes An array of attributes associated with the method being invoked
+     * @param mixed $object     The object to secure
+     */
+    public function decide(TokenInterface $token, array $attributes, mixed $object = null): bool;
+}

lib/symfony/security-core/Authorization/AuthorizationChecker.php

@@ -0,0 +1,50 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\Security\Core\Authentication\Token\NullToken;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+
+/**
+ * AuthorizationChecker is the main authorization point of the Security component.
+ *
+ * It gives access to the token representing the current user authentication.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+class AuthorizationChecker implements AuthorizationCheckerInterface
+{
+    private TokenStorageInterface $tokenStorage;
+    private AccessDecisionManagerInterface $accessDecisionManager;
+
+    public function __construct(TokenStorageInterface $tokenStorage, AccessDecisionManagerInterface $accessDecisionManager, bool $exceptionOnNoToken = false)
+    {
+        if ($exceptionOnNoToken) {
+            throw new \LogicException(\sprintf('Argument $exceptionOnNoToken of "%s()" must be set to "false".', __METHOD__));
+        }
+
+        $this->tokenStorage = $tokenStorage;
+        $this->accessDecisionManager = $accessDecisionManager;
+    }
+
+    final public function isGranted(mixed $attribute, mixed $subject = null): bool
+    {
+        $token = $this->tokenStorage->getToken();
+
+        if (!$token || !$token->getUser()) {
+            $token = new NullToken();
+        }
+
+        return $this->accessDecisionManager->decide($token, [$attribute], $subject);
+    }
+}

lib/symfony/security-core/Authorization/AuthorizationCheckerInterface.php

@@ -0,0 +1,27 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+/**
+ * The AuthorizationCheckerInterface.
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+interface AuthorizationCheckerInterface
+{
+    /**
+     * Checks if the attribute is granted against the current authentication token and optionally supplied subject.
+     *
+     * @param mixed $attribute A single attribute to vote on (can be of any type, string and instance of Expression are supported by the core)
+     */
+    public function isGranted(mixed $attribute, mixed $subject = null): bool;
+}

lib/symfony/security-core/Authorization/ExpressionLanguage.php

@@ -0,0 +1,40 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Psr\Cache\CacheItemPoolInterface;
+use Symfony\Component\ExpressionLanguage\ExpressionLanguage as BaseExpressionLanguage;
+
+if (!class_exists(BaseExpressionLanguage::class)) {
+    throw new \LogicException(\sprintf('The "%s" class requires the "ExpressionLanguage" component. Try running "composer require symfony/expression-language".', ExpressionLanguage::class));
+} else {
+    // Help opcache.preload discover always-needed symbols
+    class_exists(ExpressionLanguageProvider::class);
+
+    /**
+     * Adds some function to the default ExpressionLanguage.
+     *
+     * @author Fabien Potencier <fabien@symfony.com>
+     *
+     * @see ExpressionLanguageProvider
+     */
+    class ExpressionLanguage extends BaseExpressionLanguage
+    {
+        public function __construct(?CacheItemPoolInterface $cache = null, array $providers = [])
+        {
+            // prepend the default provider to let users override it easily
+            array_unshift($providers, new ExpressionLanguageProvider());
+
+            parent::__construct($cache, $providers);
+        }
+    }
+}

lib/symfony/security-core/Authorization/ExpressionLanguageProvider.php

@@ -0,0 +1,36 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\ExpressionLanguage\ExpressionFunction;
+use Symfony\Component\ExpressionLanguage\ExpressionFunctionProviderInterface;
+
+/**
+ * Define some ExpressionLanguage functions.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+class ExpressionLanguageProvider implements ExpressionFunctionProviderInterface
+{
+    public function getFunctions(): array
+    {
+        return [
+            new ExpressionFunction('is_authenticated', fn () => '$auth_checker->isGranted("IS_AUTHENTICATED")', fn (array $variables) => $variables['auth_checker']->isGranted('IS_AUTHENTICATED')),
+
+            new ExpressionFunction('is_fully_authenticated', fn () => '$token && $auth_checker->isGranted("IS_AUTHENTICATED_FULLY")', fn (array $variables) => $variables['token'] && $variables['auth_checker']->isGranted('IS_AUTHENTICATED_FULLY')),
+
+            new ExpressionFunction('is_granted', fn ($attributes, $object = 'null') => \sprintf('$auth_checker->isGranted(%s, %s)', $attributes, $object), fn (array $variables, $attributes, $object = null) => $variables['auth_checker']->isGranted($attributes, $object)),
+
+            new ExpressionFunction('is_remember_me', fn () => '$token && $auth_checker->isGranted("IS_REMEMBERED")', fn (array $variables) => $variables['token'] && $variables['auth_checker']->isGranted('IS_REMEMBERED')),
+        ];
+    }
+}

lib/symfony/security-core/Authorization/Strategy/AccessDecisionStrategyInterface.php

@@ -0,0 +1,25 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Strategy;
+
+/**
+ * A strategy for turning a stream of votes into a final decision.
+ *
+ * @author Alexander M. Turek <me@derrabus.de>
+ */
+interface AccessDecisionStrategyInterface
+{
+    /**
+     * @param \Traversable<int> $results
+     */
+    public function decide(\Traversable $results): bool;
+}

lib/symfony/security-core/Authorization/Strategy/AffirmativeStrategy.php

@@ -0,0 +1,58 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Strategy;
+
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * Grants access if any voter returns an affirmative response.
+ *
+ * If all voters abstained from voting, the decision will be based on the
+ * allowIfAllAbstainDecisions property value (defaults to false).
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Alexander M. Turek <me@derrabus.de>
+ */
+final class AffirmativeStrategy implements AccessDecisionStrategyInterface, \Stringable
+{
+    private bool $allowIfAllAbstainDecisions;
+
+    public function __construct(bool $allowIfAllAbstainDecisions = false)
+    {
+        $this->allowIfAllAbstainDecisions = $allowIfAllAbstainDecisions;
+    }
+
+    public function decide(\Traversable $results): bool
+    {
+        $deny = 0;
+        foreach ($results as $result) {
+            if (VoterInterface::ACCESS_GRANTED === $result) {
+                return true;
+            }
+
+            if (VoterInterface::ACCESS_DENIED === $result) {
+                ++$deny;
+            }
+        }
+
+        if ($deny > 0) {
+            return false;
+        }
+
+        return $this->allowIfAllAbstainDecisions;
+    }
+
+    public function __toString(): string
+    {
+        return 'affirmative';
+    }
+}

lib/symfony/security-core/Authorization/Strategy/ConsensusStrategy.php

@@ -0,0 +1,75 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Strategy;
+
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * Grants access if there is consensus of granted against denied responses.
+ *
+ * Consensus means majority-rule (ignoring abstains) rather than unanimous
+ * agreement (ignoring abstains). If you require unanimity, see
+ * UnanimousBased.
+ *
+ * If there were an equal number of grant and deny votes, the decision will
+ * be based on the allowIfEqualGrantedDeniedDecisions property value
+ * (defaults to true).
+ *
+ * If all voters abstained from voting, the decision will be based on the
+ * allowIfAllAbstainDecisions property value (defaults to false).
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Alexander M. Turek <me@derrabus.de>
+ */
+final class ConsensusStrategy implements AccessDecisionStrategyInterface, \Stringable
+{
+    private bool $allowIfAllAbstainDecisions;
+    private bool $allowIfEqualGrantedDeniedDecisions;
+
+    public function __construct(bool $allowIfAllAbstainDecisions = false, bool $allowIfEqualGrantedDeniedDecisions = true)
+    {
+        $this->allowIfAllAbstainDecisions = $allowIfAllAbstainDecisions;
+        $this->allowIfEqualGrantedDeniedDecisions = $allowIfEqualGrantedDeniedDecisions;
+    }
+
+    public function decide(\Traversable $results): bool
+    {
+        $grant = 0;
+        $deny = 0;
+        foreach ($results as $result) {
+            if (VoterInterface::ACCESS_GRANTED === $result) {
+                ++$grant;
+            } elseif (VoterInterface::ACCESS_DENIED === $result) {
+                ++$deny;
+            }
+        }
+
+        if ($grant > $deny) {
+            return true;
+        }
+
+        if ($deny > $grant) {
+            return false;
+        }
+
+        if ($grant > 0) {
+            return $this->allowIfEqualGrantedDeniedDecisions;
+        }
+
+        return $this->allowIfAllAbstainDecisions;
+    }
+
+    public function __toString(): string
+    {
+        return 'consensus';
+    }
+}

lib/symfony/security-core/Authorization/Strategy/PriorityStrategy.php

@@ -0,0 +1,54 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Strategy;
+
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * Grant or deny access depending on the first voter that does not abstain.
+ * The priority of voters can be used to overrule a decision.
+ *
+ * If all voters abstained from voting, the decision will be based on the
+ * allowIfAllAbstainDecisions property value (defaults to false).
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Alexander M. Turek <me@derrabus.de>
+ */
+final class PriorityStrategy implements AccessDecisionStrategyInterface, \Stringable
+{
+    private bool $allowIfAllAbstainDecisions;
+
+    public function __construct(bool $allowIfAllAbstainDecisions = false)
+    {
+        $this->allowIfAllAbstainDecisions = $allowIfAllAbstainDecisions;
+    }
+
+    public function decide(\Traversable $results): bool
+    {
+        foreach ($results as $result) {
+            if (VoterInterface::ACCESS_GRANTED === $result) {
+                return true;
+            }
+
+            if (VoterInterface::ACCESS_DENIED === $result) {
+                return false;
+            }
+        }
+
+        return $this->allowIfAllAbstainDecisions;
+    }
+
+    public function __toString(): string
+    {
+        return 'priority';
+    }
+}

lib/symfony/security-core/Authorization/Strategy/UnanimousStrategy.php

@@ -0,0 +1,59 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Strategy;
+
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * Grants access if only grant (or abstain) votes were received.
+ *
+ * If all voters abstained from voting, the decision will be based on the
+ * allowIfAllAbstainDecisions property value (defaults to false).
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Alexander M. Turek <me@derrabus.de>
+ */
+final class UnanimousStrategy implements AccessDecisionStrategyInterface, \Stringable
+{
+    private bool $allowIfAllAbstainDecisions;
+
+    public function __construct(bool $allowIfAllAbstainDecisions = false)
+    {
+        $this->allowIfAllAbstainDecisions = $allowIfAllAbstainDecisions;
+    }
+
+    public function decide(\Traversable $results): bool
+    {
+        $grant = 0;
+        foreach ($results as $result) {
+            if (VoterInterface::ACCESS_DENIED === $result) {
+                return false;
+            }
+
+            if (VoterInterface::ACCESS_GRANTED === $result) {
+                ++$grant;
+            }
+        }
+
+        // no deny votes
+        if ($grant > 0) {
+            return true;
+        }
+
+        return $this->allowIfAllAbstainDecisions;
+    }
+
+    public function __toString(): string
+    {
+        return 'unanimous';
+    }
+}

lib/symfony/security-core/Authorization/TraceableAccessDecisionManager.php

@@ -0,0 +1,109 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\Strategy\AccessDecisionStrategyInterface;
+use Symfony\Component\Security\Core\Authorization\Voter\VoterInterface;
+
+/**
+ * Decorates the original AccessDecisionManager class to log information
+ * about the security voters and the decisions made by them.
+ *
+ * @author Javier Eguiluz <javier.eguiluz@gmail.com>
+ *
+ * @internal
+ */
+class TraceableAccessDecisionManager implements AccessDecisionManagerInterface
+{
+    private AccessDecisionManagerInterface $manager;
+    private ?AccessDecisionStrategyInterface $strategy = null;
+    /** @var iterable<mixed, VoterInterface> */
+    private iterable $voters = [];
+    private array $decisionLog = []; // All decision logs
+    private array $currentLog = [];  // Logs being filled in
+
+    public function __construct(AccessDecisionManagerInterface $manager)
+    {
+        $this->manager = $manager;
+
+        // The strategy and voters are stored in a private properties of the decorated service
+        if (property_exists($manager, 'strategy')) {
+            $reflection = new \ReflectionProperty($manager::class, 'strategy');
+            $this->strategy = $reflection->getValue($manager);
+        }
+        if (property_exists($manager, 'voters')) {
+            $reflection = new \ReflectionProperty($manager::class, 'voters');
+            $this->voters = $reflection->getValue($manager);
+        }
+    }
+
+    public function decide(TokenInterface $token, array $attributes, mixed $object = null, bool $allowMultipleAttributes = false): bool
+    {
+        $currentDecisionLog = [
+            'attributes' => $attributes,
+            'object' => $object,
+            'voterDetails' => [],
+        ];
+
+        $this->currentLog[] = &$currentDecisionLog;
+
+        $result = $this->manager->decide($token, $attributes, $object, $allowMultipleAttributes);
+
+        $currentDecisionLog['result'] = $result;
+
+        $this->decisionLog[] = array_pop($this->currentLog); // Using a stack since decide can be called by voters
+
+        return $result;
+    }
+
+    /**
+     * Adds voter vote and class to the voter details.
+     *
+     * @param array $attributes attributes used for the vote
+     * @param int   $vote       vote of the voter
+     */
+    public function addVoterVote(VoterInterface $voter, array $attributes, int $vote): void
+    {
+        $currentLogIndex = \count($this->currentLog) - 1;
+        $this->currentLog[$currentLogIndex]['voterDetails'][] = [
+            'voter' => $voter,
+            'attributes' => $attributes,
+            'vote' => $vote,
+        ];
+    }
+
+    public function getStrategy(): string
+    {
+        if (null === $this->strategy) {
+            return '-';
+        }
+        if (method_exists($this->strategy, '__toString')) {
+            return (string) $this->strategy;
+        }
+
+        return get_debug_type($this->strategy);
+    }
+
+    /**
+     * @return iterable<mixed, VoterInterface>
+     */
+    public function getVoters(): iterable
+    {
+        return $this->voters;
+    }
+
+    public function getDecisionLog(): array
+    {
+        return $this->decisionLog;
+    }
+}

lib/symfony/security-core/Authorization/Voter/AuthenticatedVoter.php

@@ -0,0 +1,104 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
+use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+/**
+ * AuthenticatedVoter votes if an attribute like IS_AUTHENTICATED_FULLY,
+ * IS_AUTHENTICATED_REMEMBERED, IS_AUTHENTICATED is present.
+ *
+ * This list is most restrictive to least restrictive checking.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ */
+class AuthenticatedVoter implements CacheableVoterInterface
+{
+    public const IS_AUTHENTICATED_FULLY = 'IS_AUTHENTICATED_FULLY';
+    public const IS_AUTHENTICATED_REMEMBERED = 'IS_AUTHENTICATED_REMEMBERED';
+    public const IS_AUTHENTICATED = 'IS_AUTHENTICATED';
+    public const IS_IMPERSONATOR = 'IS_IMPERSONATOR';
+    public const IS_REMEMBERED = 'IS_REMEMBERED';
+    public const PUBLIC_ACCESS = 'PUBLIC_ACCESS';
+
+    private AuthenticationTrustResolverInterface $authenticationTrustResolver;
+
+    public function __construct(AuthenticationTrustResolverInterface $authenticationTrustResolver)
+    {
+        $this->authenticationTrustResolver = $authenticationTrustResolver;
+    }
+
+    public function vote(TokenInterface $token, mixed $subject, array $attributes): int
+    {
+        if ($attributes === [self::PUBLIC_ACCESS]) {
+            return VoterInterface::ACCESS_GRANTED;
+        }
+
+        $result = VoterInterface::ACCESS_ABSTAIN;
+        foreach ($attributes as $attribute) {
+            if (null === $attribute || (self::IS_AUTHENTICATED_FULLY !== $attribute
+                    && self::IS_AUTHENTICATED_REMEMBERED !== $attribute
+                    && self::IS_AUTHENTICATED !== $attribute
+                    && self::IS_IMPERSONATOR !== $attribute
+                    && self::IS_REMEMBERED !== $attribute)) {
+                continue;
+            }
+
+            $result = VoterInterface::ACCESS_DENIED;
+
+            if (self::IS_AUTHENTICATED_FULLY === $attribute
+                && $this->authenticationTrustResolver->isFullFledged($token)) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+
+            if (self::IS_AUTHENTICATED_REMEMBERED === $attribute
+                && ($this->authenticationTrustResolver->isRememberMe($token)
+                    || $this->authenticationTrustResolver->isFullFledged($token))) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+
+            if (self::IS_AUTHENTICATED === $attribute && $this->authenticationTrustResolver->isAuthenticated($token)) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+
+            if (self::IS_REMEMBERED === $attribute && $this->authenticationTrustResolver->isRememberMe($token)) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+
+            if (self::IS_IMPERSONATOR === $attribute && $token instanceof SwitchUserToken) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+        }
+
+        return $result;
+    }
+
+    public function supportsAttribute(string $attribute): bool
+    {
+        return \in_array($attribute, [
+            self::IS_AUTHENTICATED_FULLY,
+            self::IS_AUTHENTICATED_REMEMBERED,
+            self::IS_AUTHENTICATED,
+            self::IS_IMPERSONATOR,
+            self::IS_REMEMBERED,
+            self::PUBLIC_ACCESS,
+        ], true);
+    }
+
+    public function supportsType(string $subjectType): bool
+    {
+        return true;
+    }
+}

lib/symfony/security-core/Authorization/Voter/CacheableVoterInterface.php

@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+/**
+ * Let voters expose the attributes and types they care about.
+ *
+ * By returning false to either `supportsAttribute` or `supportsType`, the
+ * voter will never be called for the specified attribute or subject.
+ *
+ * @author Jérémy Derussé <jeremy@derusse.com>
+ */
+interface CacheableVoterInterface extends VoterInterface
+{
+    public function supportsAttribute(string $attribute): bool;
+
+    /**
+     * @param string $subjectType The type of the subject inferred by `get_class` or `get_debug_type`
+     */
+    public function supportsType(string $subjectType): bool;
+}

lib/symfony/security-core/Authorization/Voter/ExpressionVoter.php

@@ -0,0 +1,99 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\ExpressionLanguage\Expression;
+use Symfony\Component\HttpFoundation\Request;
+use Symfony\Component\Security\Core\Authentication\AuthenticationTrustResolverInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+use Symfony\Component\Security\Core\Authorization\ExpressionLanguage;
+use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
+
+/**
+ * ExpressionVoter votes based on the evaluation of an expression.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+class ExpressionVoter implements CacheableVoterInterface
+{
+    private ExpressionLanguage $expressionLanguage;
+    private AuthenticationTrustResolverInterface $trustResolver;
+    private AuthorizationCheckerInterface $authChecker;
+    private ?RoleHierarchyInterface $roleHierarchy;
+
+    public function __construct(ExpressionLanguage $expressionLanguage, AuthenticationTrustResolverInterface $trustResolver, AuthorizationCheckerInterface $authChecker, ?RoleHierarchyInterface $roleHierarchy = null)
+    {
+        $this->expressionLanguage = $expressionLanguage;
+        $this->trustResolver = $trustResolver;
+        $this->authChecker = $authChecker;
+        $this->roleHierarchy = $roleHierarchy;
+    }
+
+    public function supportsAttribute(string $attribute): bool
+    {
+        return false;
+    }
+
+    public function supportsType(string $subjectType): bool
+    {
+        return true;
+    }
+
+    public function vote(TokenInterface $token, mixed $subject, array $attributes): int
+    {
+        $result = VoterInterface::ACCESS_ABSTAIN;
+        $variables = null;
+        foreach ($attributes as $attribute) {
+            if (!$attribute instanceof Expression) {
+                continue;
+            }
+
+            $variables ??= $this->getVariables($token, $subject);
+
+            $result = VoterInterface::ACCESS_DENIED;
+            if ($this->expressionLanguage->evaluate($attribute, $variables)) {
+                return VoterInterface::ACCESS_GRANTED;
+            }
+        }
+
+        return $result;
+    }
+
+    private function getVariables(TokenInterface $token, mixed $subject): array
+    {
+        $roleNames = $token->getRoleNames();
+
+        if (null !== $this->roleHierarchy) {
+            $roleNames = $this->roleHierarchy->getReachableRoleNames($roleNames);
+        }
+
+        $variables = [
+            'token' => $token,
+            'user' => $token->getUser(),
+            'object' => $subject,
+            'subject' => $subject,
+            'role_names' => $roleNames,
+            'trust_resolver' => $this->trustResolver,
+            'auth_checker' => $this->authChecker,
+        ];
+
+        // this is mainly to propose a better experience when the expression is used
+        // in an access control rule, as the developer does not know that it's going
+        // to be handled by this voter
+        if ($subject instanceof Request) {
+            $variables['request'] = $subject;
+        }
+
+        return $variables;
+    }
+}

lib/symfony/security-core/Authorization/Voter/RoleHierarchyVoter.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Role\RoleHierarchyInterface;
+
+/**
+ * RoleHierarchyVoter uses a RoleHierarchy to determine the roles granted to
+ * the user before voting.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+class RoleHierarchyVoter extends RoleVoter
+{
+    private RoleHierarchyInterface $roleHierarchy;
+
+    public function __construct(RoleHierarchyInterface $roleHierarchy, string $prefix = 'ROLE_')
+    {
+        $this->roleHierarchy = $roleHierarchy;
+
+        parent::__construct($prefix);
+    }
+
+    /**
+     * @return array
+     */
+    protected function extractRoles(TokenInterface $token)
+    {
+        return $this->roleHierarchy->getReachableRoleNames($token->getRoleNames());
+    }
+}

lib/symfony/security-core/Authorization/Voter/RoleVoter.php

@@ -0,0 +1,68 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+/**
+ * RoleVoter votes if any attribute starts with a given prefix.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+class RoleVoter implements CacheableVoterInterface
+{
+    private string $prefix;
+
+    public function __construct(string $prefix = 'ROLE_')
+    {
+        $this->prefix = $prefix;
+    }
+
+    public function vote(TokenInterface $token, mixed $subject, array $attributes): int
+    {
+        $result = VoterInterface::ACCESS_ABSTAIN;
+        $roles = $this->extractRoles($token);
+
+        foreach ($attributes as $attribute) {
+            if (!\is_string($attribute) || !str_starts_with($attribute, $this->prefix)) {
+                continue;
+            }
+
+            $result = VoterInterface::ACCESS_DENIED;
+            foreach ($roles as $role) {
+                if ($attribute === $role) {
+                    return VoterInterface::ACCESS_GRANTED;
+                }
+            }
+        }
+
+        return $result;
+    }
+
+    public function supportsAttribute(string $attribute): bool
+    {
+        return str_starts_with($attribute, $this->prefix);
+    }
+
+    public function supportsType(string $subjectType): bool
+    {
+        return true;
+    }
+
+    /**
+     * @return array
+     */
+    protected function extractRoles(TokenInterface $token)
+    {
+        return $token->getRoleNames();
+    }
+}

lib/symfony/security-core/Authorization/Voter/TraceableVoter.php

@@ -0,0 +1,59 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+use Symfony\Component\Security\Core\Event\VoteEvent;
+use Symfony\Contracts\EventDispatcher\EventDispatcherInterface;
+
+/**
+ * Decorates voter classes to send result events.
+ *
+ * @author Laurent VOULLEMIER <laurent.voullemier@gmail.com>
+ *
+ * @internal
+ */
+class TraceableVoter implements CacheableVoterInterface
+{
+    private VoterInterface $voter;
+    private EventDispatcherInterface $eventDispatcher;
+
+    public function __construct(VoterInterface $voter, EventDispatcherInterface $eventDispatcher)
+    {
+        $this->voter = $voter;
+        $this->eventDispatcher = $eventDispatcher;
+    }
+
+    public function vote(TokenInterface $token, mixed $subject, array $attributes): int
+    {
+        $result = $this->voter->vote($token, $subject, $attributes);
+
+        $this->eventDispatcher->dispatch(new VoteEvent($this->voter, $subject, $attributes, $result), 'debug.security.authorization.vote');
+
+        return $result;
+    }
+
+    public function getDecoratedVoter(): VoterInterface
+    {
+        return $this->voter;
+    }
+
+    public function supportsAttribute(string $attribute): bool
+    {
+        return !$this->voter instanceof CacheableVoterInterface || $this->voter->supportsAttribute($attribute);
+    }
+
+    public function supportsType(string $subjectType): bool
+    {
+        return !$this->voter instanceof CacheableVoterInterface || $this->voter->supportsType($subjectType);
+    }
+}

lib/symfony/security-core/Authorization/Voter/Voter.php

@@ -0,0 +1,95 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+/**
+ * Voter is an abstract default implementation of a voter.
+ *
+ * @author Roman Marintšenko <inoryy@gmail.com>
+ * @author Grégoire Pineau <lyrixx@lyrixx.info>
+ *
+ * @template TAttribute of string
+ * @template TSubject of mixed
+ */
+abstract class Voter implements VoterInterface, CacheableVoterInterface
+{
+    public function vote(TokenInterface $token, mixed $subject, array $attributes): int
+    {
+        // abstain vote by default in case none of the attributes are supported
+        $vote = self::ACCESS_ABSTAIN;
+
+        foreach ($attributes as $attribute) {
+            try {
+                if (!$this->supports($attribute, $subject)) {
+                    continue;
+                }
+            } catch (\TypeError $e) {
+                if (str_contains($e->getMessage(), 'supports(): Argument #1')) {
+                    continue;
+                }
+
+                throw $e;
+            }
+
+            // as soon as at least one attribute is supported, default is to deny access
+            $vote = self::ACCESS_DENIED;
+
+            if ($this->voteOnAttribute($attribute, $subject, $token)) {
+                // grant access as soon as at least one attribute returns a positive response
+                return self::ACCESS_GRANTED;
+            }
+        }
+
+        return $vote;
+    }
+
+    /**
+     * Return false if your voter doesn't support the given attribute. Symfony will cache
+     * that decision and won't call your voter again for that attribute.
+     */
+    public function supportsAttribute(string $attribute): bool
+    {
+        return true;
+    }
+
+    /**
+     * Return false if your voter doesn't support the given subject type. Symfony will cache
+     * that decision and won't call your voter again for that subject type.
+     *
+     * @param string $subjectType The type of the subject inferred by `get_class()` or `get_debug_type()`
+     */
+    public function supportsType(string $subjectType): bool
+    {
+        return true;
+    }
+
+    /**
+     * Determines if the attribute and subject are supported by this voter.
+     *
+     * @param mixed $subject The subject to secure, e.g. an object the user wants to access or any other PHP type
+     *
+     * @psalm-assert-if-true TSubject $subject
+     * @psalm-assert-if-true TAttribute $attribute
+     */
+    abstract protected function supports(string $attribute, mixed $subject): bool;
+
+    /**
+     * Perform a single access check operation on a given attribute, subject and token.
+     * It is safe to assume that $attribute and $subject already passed the "supports()" method check.
+     *
+     * @param TAttribute $attribute
+     * @param TSubject   $subject
+     */
+    abstract protected function voteOnAttribute(string $attribute, mixed $subject, TokenInterface $token): bool;
+}

lib/symfony/security-core/Authorization/Voter/VoterInterface.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\Authorization\Voter;
+
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+/**
+ * VoterInterface is the interface implemented by all voters.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+interface VoterInterface
+{
+    public const ACCESS_GRANTED = 1;
+    public const ACCESS_ABSTAIN = 0;
+    public const ACCESS_DENIED = -1;
+
+    /**
+     * Returns the vote for the given parameters.
+     *
+     * This method must return one of the following constants:
+     * ACCESS_GRANTED, ACCESS_DENIED, or ACCESS_ABSTAIN.
+     *
+     * @param mixed $subject    The subject to secure
+     * @param array $attributes An array of attributes associated with the method being invoked
+     *
+     * @return int either ACCESS_GRANTED, ACCESS_ABSTAIN, or ACCESS_DENIED
+     *
+     * @psalm-return self::ACCESS_* must be transformed into @return on Symfony 7
+     */
+    public function vote(TokenInterface $token, mixed $subject, array $attributes);
+}