feat(symfony): deprecate Symfony Security AccessDeniedException (#8318)

Author: soyuka

src/Symfony/Security/Exception/AccessDeniedException.php

@@ -13,14 +13,24 @@
 
 namespace ApiPlatform\Symfony\Security\Exception;
 
+use ApiPlatform\Metadata\Exception\AccessDeniedException as MetadataAccessDeniedException;
 use ApiPlatform\Metadata\Exception\HttpExceptionInterface;
 use Symfony\Component\Security\Core\Exception\AccessDeniedException as ExceptionAccessDeniedException;
 
 /**
- * TODO: deprecate in favor of Metadata.
+ * @deprecated since API Platform 4.4, use {@see MetadataAccessDeniedException} instead
  */
 final class AccessDeniedException extends ExceptionAccessDeniedException implements HttpExceptionInterface
 {
+    public function __construct(string $message = 'Access Denied.', ?\Throwable $previous = null, int $code = 403, bool $triggerDeprecation = true)
+    {
+        if ($triggerDeprecation) {
+            trigger_deprecation('api-platform/core', '4.4', 'The "%s" class is deprecated, use "%s" instead.', self::class, MetadataAccessDeniedException::class);
+        }
+
+        parent::__construct($message, $previous, $code);
+    }
+
     public function getStatusCode(): int
     {
         return 403;

src/Symfony/Security/State/AccessCheckerProvider.php

@@ -98,7 +98,7 @@ public function provide(Operation $operation, array $uriVariables = [], array $c
         }
 
         if (!$this->resourceAccessChecker->isGranted($operation->getClass(), $isGranted, $resourceAccessCheckerContext)) {
-            $operation instanceof GraphQlOperation ? throw new AccessDeniedHttpException($message ?? 'Access Denied.') : throw new AccessDeniedException($message ?? 'Access Denied.');
+            $operation instanceof GraphQlOperation ? throw new AccessDeniedHttpException($message ?? 'Access Denied.') : throw new AccessDeniedException($message ?? 'Access Denied.', null, 403, false);
         }
 
         return 'pre_read' === $this->event ? $this->decorated->provide($operation, $uriVariables, $context) : $body;

src/Symfony/Tests/Security/Exception/AccessDeniedExceptionTest.php

@@ -0,0 +1,41 @@
+<?php
+
+/*
+ * This file is part of the API Platform project.
+ *
+ * (c) Kévin Dunglas <dunglas@gmail.com>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+declare(strict_types=1);
+
+namespace ApiPlatform\Tests\Symfony\Security\Exception;
+
+use ApiPlatform\Symfony\Security\Exception\AccessDeniedException;
+use PHPUnit\Framework\Attributes\IgnoreDeprecations;
+use PHPUnit\Framework\TestCase;
+
+class AccessDeniedExceptionTest extends TestCase
+{
+    #[IgnoreDeprecations]
+    public function testInstantiationTriggersDeprecation(): void
+    {
+        $this->expectUserDeprecationMessage('Since api-platform/core 4.4: The "ApiPlatform\Symfony\Security\Exception\AccessDeniedException" class is deprecated, use "ApiPlatform\Metadata\Exception\AccessDeniedException" instead.');
+
+        new AccessDeniedException();
+    }
+
+    #[IgnoreDeprecations]
+    public function testKeepsBaseExceptionBehavior(): void
+    {
+        $previous = new \RuntimeException('previous');
+        $exception = new AccessDeniedException('Custom message', $previous, 403);
+
+        $this->assertSame('Custom message', $exception->getMessage());
+        $this->assertSame($previous, $exception->getPrevious());
+        $this->assertSame(403, $exception->getStatusCode());
+        $this->assertSame([], $exception->getHeaders());
+    }
+}