N°8771 - Add Symfony form component to iTop core (#760)

- Add Symfony Form Component
- Add Symfony CSRF security component
- Add iTop default form template
- Add Twig debug extension to Twig Environment
- Add iTop abstract controller facility to get form builder
- Add Twig filter to make trans an alias of dict_s filter

lib/symfony/security-core/User/AttributesBasedUserProviderInterface.php

@@ -0,0 +1,36 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+
+/**
+ * Overrides UserProviderInterface to add an "attributes" argument on loadUserByIdentifier.
+ * This is particularly useful with self-contained access tokens.
+ *
+ * @template-covariant TUser of UserInterface
+ *
+ * @template-extends UserProviderInterface<TUser>
+ */
+interface AttributesBasedUserProviderInterface extends UserProviderInterface
+{
+    /**
+     * Loads the user for the given user identifier (e.g. username or email) and attributes.
+     *
+     * This method must throw UserNotFoundException if the user is not found.
+     *
+     * @return TUser
+     *
+     * @throws UserNotFoundException
+     */
+    public function loadUserByIdentifier(string $identifier, array $attributes = []): UserInterface;
+}

lib/symfony/security-core/User/ChainUserChecker.php

@@ -0,0 +1,36 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+final class ChainUserChecker implements UserCheckerInterface
+{
+    /**
+     * @param iterable<UserCheckerInterface> $checkers
+     */
+    public function __construct(private readonly iterable $checkers)
+    {
+    }
+
+    public function checkPreAuth(UserInterface $user): void
+    {
+        foreach ($this->checkers as $checker) {
+            $checker->checkPreAuth($user);
+        }
+    }
+
+    public function checkPostAuth(UserInterface $user): void
+    {
+        foreach ($this->checkers as $checker) {
+            $checker->checkPostAuth($user);
+        }
+    }
+}

lib/symfony/security-core/User/ChainUserProvider.php

@@ -0,0 +1,134 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+
+/**
+ * Chain User Provider.
+ *
+ * This provider calls several leaf providers in a chain until one is able to
+ * handle the request.
+ *
+ * @author Johannes M. Schmitt <schmittjoh@gmail.com>
+ *
+ * @template-implements UserProviderInterface<UserInterface>
+ */
+class ChainUserProvider implements UserProviderInterface, PasswordUpgraderInterface
+{
+    private iterable $providers;
+
+    /**
+     * @param iterable<array-key, UserProviderInterface> $providers
+     */
+    public function __construct(iterable $providers)
+    {
+        $this->providers = $providers;
+    }
+
+    /**
+     * @return UserProviderInterface[]
+     */
+    public function getProviders(): array
+    {
+        if ($this->providers instanceof \Traversable) {
+            return iterator_to_array($this->providers);
+        }
+
+        return $this->providers;
+    }
+
+    /**
+     * @internal for compatibility with Symfony 5.4
+     */
+    public function loadUserByUsername(string $username): UserInterface
+    {
+        return $this->loadUserByIdentifier($username);
+    }
+
+    /**
+     * @param array $attributes
+     */
+    public function loadUserByIdentifier(string $identifier/* , array $attributes = [] */): UserInterface
+    {
+        $attributes = \func_num_args() > 1 ? func_get_arg(1) : [];
+        foreach ($this->providers as $provider) {
+            try {
+                if ($provider instanceof AttributesBasedUserProviderInterface || $provider instanceof self) {
+                    return $provider->loadUserByIdentifier($identifier, $attributes);
+                }
+
+                return $provider->loadUserByIdentifier($identifier);
+            } catch (UserNotFoundException) {
+                // try next one
+            }
+        }
+
+        $ex = new UserNotFoundException(\sprintf('There is no user with identifier "%s".', $identifier));
+        $ex->setUserIdentifier($identifier);
+        throw $ex;
+    }
+
+    public function refreshUser(UserInterface $user): UserInterface
+    {
+        $supportedUserFound = false;
+
+        foreach ($this->providers as $provider) {
+            try {
+                if (!$provider->supportsClass(get_debug_type($user))) {
+                    continue;
+                }
+
+                return $provider->refreshUser($user);
+            } catch (UnsupportedUserException) {
+                // try next one
+            } catch (UserNotFoundException) {
+                $supportedUserFound = true;
+                // try next one
+            }
+        }
+
+        if ($supportedUserFound) {
+            $username = $user->getUserIdentifier();
+            $e = new UserNotFoundException(\sprintf('There is no user with name "%s".', $username));
+            $e->setUserIdentifier($username);
+            throw $e;
+        } else {
+            throw new UnsupportedUserException(\sprintf('There is no user provider for user "%s". Shouldn\'t the "supportsClass()" method of your user provider return true for this classname?', get_debug_type($user)));
+        }
+    }
+
+    public function supportsClass(string $class): bool
+    {
+        foreach ($this->providers as $provider) {
+            if ($provider->supportsClass($class)) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public function upgradePassword(PasswordAuthenticatedUserInterface $user, string $newHashedPassword): void
+    {
+        foreach ($this->providers as $provider) {
+            if ($provider instanceof PasswordUpgraderInterface) {
+                try {
+                    $provider->upgradePassword($user, $newHashedPassword);
+                } catch (UnsupportedUserException) {
+                    // ignore: password upgrades are opportunistic
+                }
+            }
+        }
+    }
+}

lib/symfony/security-core/User/EquatableInterface.php

@@ -0,0 +1,30 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * EquatableInterface used to test if two objects are equal in security
+ * and re-authentication context.
+ *
+ * @author Dariusz Górecki <darek.krk@gmail.com>
+ */
+interface EquatableInterface
+{
+    /**
+     * The equality comparison should neither be done by referential equality
+     * nor by comparing identities (i.e. getId() === getId()).
+     *
+     * However, you do not need to compare every attribute, but only those that
+     * are relevant for assessing whether re-authentication is required.
+     */
+    public function isEqualTo(UserInterface $user): bool;
+}

lib/symfony/security-core/User/InMemoryUser.php

@@ -0,0 +1,110 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * UserInterface implementation used by the in-memory user provider.
+ *
+ * This should not be used for anything else.
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+final class InMemoryUser implements UserInterface, PasswordAuthenticatedUserInterface, EquatableInterface, \Stringable
+{
+    private string $username;
+    private ?string $password;
+    private bool $enabled;
+    private array $roles;
+
+    public function __construct(?string $username, ?string $password, array $roles = [], bool $enabled = true)
+    {
+        if ('' === $username || null === $username) {
+            throw new \InvalidArgumentException('The username cannot be empty.');
+        }
+
+        $this->username = $username;
+        $this->password = $password;
+        $this->enabled = $enabled;
+        $this->roles = $roles;
+    }
+
+    public function __toString(): string
+    {
+        return $this->getUserIdentifier();
+    }
+
+    public function getRoles(): array
+    {
+        return $this->roles;
+    }
+
+    public function getPassword(): ?string
+    {
+        return $this->password;
+    }
+
+    /**
+     * Returns the identifier for this user (e.g. its username or email address).
+     */
+    public function getUserIdentifier(): string
+    {
+        return $this->username;
+    }
+
+    /**
+     * Checks whether the user is enabled.
+     *
+     * Internally, if this method returns false, the authentication system
+     * will throw a DisabledException and prevent login.
+     *
+     * @return bool true if the user is enabled, false otherwise
+     *
+     * @see DisabledException
+     */
+    public function isEnabled(): bool
+    {
+        return $this->enabled;
+    }
+
+    public function eraseCredentials(): void
+    {
+    }
+
+    public function isEqualTo(UserInterface $user): bool
+    {
+        if (!$user instanceof self) {
+            return false;
+        }
+
+        if ($this->getPassword() !== $user->getPassword()) {
+            return false;
+        }
+
+        $currentRoles = array_map('strval', (array) $this->getRoles());
+        $newRoles = array_map('strval', (array) $user->getRoles());
+        $rolesChanged = \count($currentRoles) !== \count($newRoles) || \count($currentRoles) !== \count(array_intersect($currentRoles, $newRoles));
+        if ($rolesChanged) {
+            return false;
+        }
+
+        if ($this->getUserIdentifier() !== $user->getUserIdentifier()) {
+            return false;
+        }
+
+        if ($this->isEnabled() !== $user->isEnabled()) {
+            return false;
+        }
+
+        return true;
+    }
+}

lib/symfony/security-core/User/InMemoryUserChecker.php

@@ -0,0 +1,45 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\DisabledException;
+
+/**
+ * Checks the state of the in-memory user account.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+class InMemoryUserChecker implements UserCheckerInterface
+{
+    /**
+     * @return void
+     */
+    public function checkPreAuth(UserInterface $user)
+    {
+        if (!$user instanceof InMemoryUser) {
+            return;
+        }
+
+        if (!$user->isEnabled()) {
+            $ex = new DisabledException('User account is disabled.');
+            $ex->setUser($user);
+            throw $ex;
+        }
+    }
+
+    /**
+     * @return void
+     */
+    public function checkPostAuth(UserInterface $user)
+    {
+    }
+}

lib/symfony/security-core/User/InMemoryUserProvider.php

@@ -0,0 +1,115 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+
+/**
+ * InMemoryUserProvider is a simple non persistent user provider.
+ *
+ * Useful for testing, demonstration, prototyping, and for simple needs
+ * (a backend with a unique admin for instance)
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ *
+ * @template-implements UserProviderInterface<InMemoryUser>
+ */
+class InMemoryUserProvider implements UserProviderInterface
+{
+    /**
+     * @var array<string, UserInterface>
+     */
+    private array $users = [];
+
+    /**
+     * The user array is a hash where the keys are usernames and the values are
+     * an array of attributes: 'password', 'enabled', and 'roles'.
+     *
+     * @param array<string, array{password?: string, enabled?: bool, roles?: list<string>}> $users An array of users
+     */
+    public function __construct(array $users = [])
+    {
+        foreach ($users as $username => $attributes) {
+            $password = $attributes['password'] ?? null;
+            $enabled = $attributes['enabled'] ?? true;
+            $roles = $attributes['roles'] ?? [];
+            $user = new InMemoryUser($username, $password, $roles, $enabled);
+
+            $this->createUser($user);
+        }
+    }
+
+    /**
+     * Adds a new User to the provider.
+     *
+     * @return void
+     *
+     * @throws \LogicException
+     */
+    public function createUser(UserInterface $user)
+    {
+        if (!$user instanceof InMemoryUser) {
+            trigger_deprecation('symfony/security-core', '6.3', 'Passing users that are not instance of "%s" to "%s" is deprecated, "%s" given.', InMemoryUser::class, __METHOD__, get_debug_type($user));
+        }
+
+        $userIdentifier = strtolower($user->getUserIdentifier());
+        if (isset($this->users[$userIdentifier])) {
+            throw new \LogicException('Another user with the same username already exists.');
+        }
+
+        $this->users[$userIdentifier] = $user;
+    }
+
+    public function loadUserByIdentifier(string $identifier): UserInterface
+    {
+        $user = $this->getUser($identifier);
+
+        return new InMemoryUser($user->getUserIdentifier(), $user->getPassword(), $user->getRoles(), $user->isEnabled());
+    }
+
+    public function refreshUser(UserInterface $user): UserInterface
+    {
+        if (!$user instanceof InMemoryUser) {
+            throw new UnsupportedUserException(\sprintf('Instances of "%s" are not supported.', get_debug_type($user)));
+        }
+
+        $storedUser = $this->getUser($user->getUserIdentifier());
+        $userIdentifier = $storedUser->getUserIdentifier();
+
+        return new InMemoryUser($userIdentifier, $storedUser->getPassword(), $storedUser->getRoles(), $storedUser->isEnabled());
+    }
+
+    public function supportsClass(string $class): bool
+    {
+        return InMemoryUser::class == $class;
+    }
+
+    /**
+     * Returns the user by given username.
+     *
+     * @return InMemoryUser change return type on 7.0
+     *
+     * @throws UserNotFoundException if user whose given username does not exist
+     */
+    private function getUser(string $username): UserInterface
+    {
+        if (!isset($this->users[strtolower($username)])) {
+            $ex = new UserNotFoundException(\sprintf('Username "%s" does not exist.', $username));
+            $ex->setUserIdentifier($username);
+
+            throw $ex;
+        }
+
+        return $this->users[strtolower($username)];
+    }
+}

lib/symfony/security-core/User/LegacyPasswordAuthenticatedUserInterface.php

@@ -0,0 +1,28 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * For users that can be authenticated using a password/salt couple.
+ *
+ * Once all password hashes have been upgraded to a modern algorithm via password migrations,
+ * implement {@see PasswordAuthenticatedUserInterface} instead.
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ */
+interface LegacyPasswordAuthenticatedUserInterface extends PasswordAuthenticatedUserInterface
+{
+    /**
+     * Returns the salt that was originally used to hash the password.
+     */
+    public function getSalt(): ?string;
+}

lib/symfony/security-core/User/MissingUserProvider.php

@@ -0,0 +1,53 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Config\Definition\Exception\InvalidConfigurationException;
+
+/**
+ * MissingUserProvider is a dummy user provider used to throw proper exception
+ * when a firewall requires a user provider but none was defined.
+ *
+ * @internal
+ *
+ * @template-implements UserProviderInterface<never>
+ */
+class MissingUserProvider implements UserProviderInterface
+{
+    /**
+     * @param string $firewall the firewall missing a provider
+     */
+    public function __construct(string $firewall)
+    {
+        throw new InvalidConfigurationException(\sprintf('"%s" firewall requires a user provider but none was defined.', $firewall));
+    }
+
+    public function loadUserByUsername(string $username): UserInterface
+    {
+        throw new \BadMethodCallException();
+    }
+
+    public function loadUserByIdentifier(string $identifier): UserInterface
+    {
+        throw new \BadMethodCallException();
+    }
+
+    public function refreshUser(UserInterface $user): UserInterface
+    {
+        throw new \BadMethodCallException();
+    }
+
+    public function supportsClass(string $class): bool
+    {
+        throw new \BadMethodCallException();
+    }
+}

lib/symfony/security-core/User/OidcUser.php

@@ -0,0 +1,182 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * UserInterface implementation used by the access-token security workflow with an OIDC server.
+ */
+class OidcUser implements UserInterface
+{
+    private array $additionalClaims = [];
+
+    public function __construct(
+        private ?string $userIdentifier = null,
+        private array $roles = ['ROLE_USER'],
+
+        // Standard Claims (https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims)
+        private ?string $sub = null,
+        private ?string $name = null,
+        private ?string $givenName = null,
+        private ?string $familyName = null,
+        private ?string $middleName = null,
+        private ?string $nickname = null,
+        private ?string $preferredUsername = null,
+        private ?string $profile = null,
+        private ?string $picture = null,
+        private ?string $website = null,
+        private ?string $email = null,
+        private ?bool $emailVerified = null,
+        private ?string $gender = null,
+        private ?string $birthdate = null,
+        private ?string $zoneinfo = null,
+        private ?string $locale = null,
+        private ?string $phoneNumber = null,
+        private ?bool $phoneNumberVerified = null,
+        private ?array $address = null,
+        private ?\DateTimeInterface $updatedAt = null,
+
+        // Additional Claims (https://openid.net/specs/openid-connect-core-1_0.html#AdditionalClaims)
+        ...$additionalClaims,
+    ) {
+        if (null === $sub || '' === $sub) {
+            throw new \InvalidArgumentException('The "sub" claim cannot be empty.');
+        }
+
+        $this->additionalClaims = $additionalClaims['additionalClaims'] ?? $additionalClaims;
+    }
+
+    /**
+     * OIDC or OAuth specs don't have any "role" notion.
+     *
+     * If you want to implement "roles" from your OIDC server,
+     * send a "roles" constructor argument to this object
+     * (e.g.: using a custom UserProvider).
+     */
+    public function getRoles(): array
+    {
+        return $this->roles;
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return (string) ($this->userIdentifier ?? $this->getSub());
+    }
+
+    public function eraseCredentials(): void
+    {
+    }
+
+    public function getSub(): ?string
+    {
+        return $this->sub;
+    }
+
+    public function getName(): ?string
+    {
+        return $this->name;
+    }
+
+    public function getGivenName(): ?string
+    {
+        return $this->givenName;
+    }
+
+    public function getFamilyName(): ?string
+    {
+        return $this->familyName;
+    }
+
+    public function getMiddleName(): ?string
+    {
+        return $this->middleName;
+    }
+
+    public function getNickname(): ?string
+    {
+        return $this->nickname;
+    }
+
+    public function getPreferredUsername(): ?string
+    {
+        return $this->preferredUsername;
+    }
+
+    public function getProfile(): ?string
+    {
+        return $this->profile;
+    }
+
+    public function getPicture(): ?string
+    {
+        return $this->picture;
+    }
+
+    public function getWebsite(): ?string
+    {
+        return $this->website;
+    }
+
+    public function getEmail(): ?string
+    {
+        return $this->email;
+    }
+
+    public function getEmailVerified(): ?bool
+    {
+        return $this->emailVerified;
+    }
+
+    public function getGender(): ?string
+    {
+        return $this->gender;
+    }
+
+    public function getBirthdate(): ?string
+    {
+        return $this->birthdate;
+    }
+
+    public function getZoneinfo(): ?string
+    {
+        return $this->zoneinfo;
+    }
+
+    public function getLocale(): ?string
+    {
+        return $this->locale;
+    }
+
+    public function getPhoneNumber(): ?string
+    {
+        return $this->phoneNumber;
+    }
+
+    public function getphoneNumberVerified(): ?bool
+    {
+        return $this->phoneNumberVerified;
+    }
+
+    public function getAddress(): ?array
+    {
+        return $this->address;
+    }
+
+    public function getUpdatedAt(): ?\DateTimeInterface
+    {
+        return $this->updatedAt;
+    }
+
+    public function getAdditionalClaims(): array
+    {
+        return $this->additionalClaims;
+    }
+}

lib/symfony/security-core/User/PasswordAuthenticatedUserInterface.php

@@ -0,0 +1,28 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * For users that can be authenticated using a password.
+ *
+ * @author Robin Chalas <robin.chalas@gmail.com>
+ * @author Wouter de Jong <wouter@wouterj.nl>
+ */
+interface PasswordAuthenticatedUserInterface
+{
+    /**
+     * Returns the hashed password used to authenticate the user.
+     *
+     * Usually on authentication, a plain-text password will be compared to this value.
+     */
+    public function getPassword(): ?string;
+}

lib/symfony/security-core/User/PasswordUpgraderInterface.php

@@ -0,0 +1,27 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * @author Nicolas Grekas <p@tchwork.com>
+ */
+interface PasswordUpgraderInterface
+{
+    /**
+     * Upgrades the hashed password of a user, typically for using a better hash algorithm.
+     *
+     * This method should persist the new password in the user storage and update the $user object accordingly.
+     * Because you don't want your users not being able to log in, this method should be opportunistic:
+     * it's fine if it does nothing or if it fails without throwing any exception.
+     */
+    public function upgradePassword(PasswordAuthenticatedUserInterface $user, string $newHashedPassword): void;
+}

lib/symfony/security-core/User/UserCheckerInterface.php

@@ -0,0 +1,43 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\AccountStatusException;
+
+/**
+ * Implement to throw AccountStatusException during the authentication process.
+ *
+ * Can be used when you want to check the account status, e.g when the account is
+ * disabled or blocked. This should not be used to make authentication decisions.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+interface UserCheckerInterface
+{
+    /**
+     * Checks the user account before authentication.
+     *
+     * @return void
+     *
+     * @throws AccountStatusException
+     */
+    public function checkPreAuth(UserInterface $user);
+
+    /**
+     * Checks the user account after authentication.
+     *
+     * @return void
+     *
+     * @throws AccountStatusException
+     */
+    public function checkPostAuth(UserInterface $user);
+}

lib/symfony/security-core/User/UserInterface.php

@@ -0,0 +1,61 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+/**
+ * Represents the interface that all user classes must implement.
+ *
+ * This interface is useful because the authentication layer can deal with
+ * the object through its lifecycle, assigning roles and so on.
+ *
+ * Regardless of how your users are loaded or where they come from (a database,
+ * configuration, web service, etc.), you will have a class that implements
+ * this interface. Objects that implement this interface are created and
+ * loaded by different objects that implement UserProviderInterface.
+ *
+ * @see UserProviderInterface
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ */
+interface UserInterface
+{
+    /**
+     * Returns the roles granted to the user.
+     *
+     *     public function getRoles()
+     *     {
+     *         return ['ROLE_USER'];
+     *     }
+     *
+     * Alternatively, the roles might be stored in a ``roles`` property,
+     * and populated in any number of different ways when the user object
+     * is created.
+     *
+     * @return string[]
+     */
+    public function getRoles(): array;
+
+    /**
+     * Removes sensitive data from the user.
+     *
+     * This is important if, at any given point, sensitive information like
+     * the plain-text password is stored on this object.
+     *
+     * @return void
+     */
+    public function eraseCredentials();
+
+    /**
+     * Returns the identifier for this user (e.g. username or email address).
+     */
+    public function getUserIdentifier(): string;
+}

lib/symfony/security-core/User/UserProviderInterface.php

@@ -0,0 +1,70 @@
+<?php
+
+/*
+ * This file is part of the Symfony package.
+ *
+ * (c) Fabien Potencier <fabien@symfony.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Symfony\Component\Security\Core\User;
+
+use Symfony\Component\Security\Core\Exception\UnsupportedUserException;
+use Symfony\Component\Security\Core\Exception\UserNotFoundException;
+
+/**
+ * Represents a class that loads UserInterface objects from some source for the authentication system.
+ *
+ * In a typical authentication configuration, a user identifier (e.g. a
+ * username or email address) credential enters the system (via form login, or
+ * any method). The user provider that is configured with that authentication
+ * method is asked to load the UserInterface object for the given identifier (via
+ * loadUserByIdentifier) so that the rest of the process can continue.
+ *
+ * Internally, a user provider can load users from any source (databases,
+ * configuration, web service). This is totally independent of how the authentication
+ * information is submitted or what the UserInterface object looks like.
+ *
+ * @author Fabien Potencier <fabien@symfony.com>
+ *
+ * @template-covariant TUser of UserInterface
+ */
+interface UserProviderInterface
+{
+    /**
+     * Refreshes the user.
+     *
+     * It is up to the implementation to decide if the user data should be
+     * totally reloaded (e.g. from the database), or if the UserInterface
+     * object can just be merged into some internal array of users / identity
+     * map.
+     *
+     * @return UserInterface
+     *
+     * @psalm-return TUser
+     *
+     * @throws UnsupportedUserException if the user is not supported
+     * @throws UserNotFoundException    if the user is not found
+     */
+    public function refreshUser(UserInterface $user);
+
+    /**
+     * Whether this provider supports the given user class.
+     *
+     * @return bool
+     */
+    public function supportsClass(string $class);
+
+    /**
+     * Loads the user for the given user identifier (e.g. username or email).
+     *
+     * This method must throw UserNotFoundException if the user is not found.
+     *
+     * @return TUser
+     *
+     * @throws UserNotFoundException
+     */
+    public function loadUserByIdentifier(string $identifier): UserInterface;
+}