[SecurityBundle] Set UserValueResolver's priority higher than EntityValueResolver

[kbond]

Q	A
Branch?	6.2
Bug fix?	no
New feature?	no
Deprecations?	no
Tickets	n/a
License	MIT
Doc PR	n/a

UserValueResolver's priority is currently 40 and EntityValueResolver's priority is 110 (configured in doctrine-bundle).

Currently, to use the CurrentUser attribute and MapEntity (when auto_mapping is enabled), you need to do the following to have it work:

public function postAction(
  #[CurrentUser]
  #[MapEntity(disabled: true)]
  User $user,
  Post $post
)

This removes this need for #[MapEntity(disabled: true)] but I'm not sure the larger impact of increasing the priority of UserValueResolver. Here is some context as to why the priorities are they way they are:

• Wire EntityArgumentResolver when available doctrine/DoctrineBundle#1554 (comment)
• Added a SecurityUserValueResolver for controllers #18510

[carsonbot]

Hey!

I think @johnkrovitch has recently worked with this code. Maybe they can help review this?

Cheers!

Carsonbot

[nicolas-grekas]

Related to doctrine/DoctrineBundle#1578

[stof]

The impact would be that if you have a parameter typehinted as UserInterface or tagged as CurrentUser that has the same name than a request attribute, the UserValueResolver would now apply instead of the RequestAttributeResolver. But this is more likely to fix bugs (or at least fix DX confusion) than to introduce it (if you tag as CurrentUser, you make the intent clear that you expect the current user and not the request attribute named user)

[nicolas-grekas]

Thank you @kbond.