feature symfony#61204 [Security] Support union type for #[CurrentUser] attribute (VincentLanglet)

This PR was squashed before being merged into the 7.4 branch.

Discussion
----------

[Security] Support union type for `#[CurrentUser]` attribute

| Q             | A
| ------------- | ---
| Branch?       | 7.4
| Bug fix?      | no
| New feature?  | yes
| Deprecations? | no
| Issues        | Fix #...
| License       | MIT

Currently `#[CurrentUser] User1|User2 $user` doesn't work.

Commits
-------

870fa69 [Security] Support union type for `#[CurrentUser]` attribute

Author: fabpot

src/Symfony/Component/Security/Http/CHANGELOG.md

@@ -4,6 +4,7 @@ CHANGELOG
 7.4
 ---
 
+ * Add support for union types with `#[CurrentUser]`
  * Deprecate callable firewall listeners, extend `AbstractListener` or implement `FirewallListenerInterface` instead
  * Deprecate `AbstractListener::__invoke`
 

src/Symfony/Component/Security/Http/Controller/UserValueResolver.php

@@ -57,6 +57,13 @@ public function resolve(Request $request, ArgumentMetadata $argument): array
             return [$user];
         }
 
+        $types = explode('|', $argument->getType());
+        foreach ($types as $type) {
+            if ($user instanceof $type) {
+                return [$user];
+            }
+        }
+
         throw new AccessDeniedException(\sprintf('The logged-in user is an instance of "%s" but a user of type "%s" is expected.', $user::class, $argument->getType()));
     }
 }

src/Symfony/Component/Security/Http/Tests/Controller/UserValueResolverTest.php

@@ -21,6 +21,7 @@
 use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
 use Symfony\Component\Security\Core\Exception\AccessDeniedException;
 use Symfony\Component\Security\Core\User\InMemoryUser;
+use Symfony\Component\Security\Core\User\OAuth2User;
 use Symfony\Component\Security\Core\User\UserInterface;
 use Symfony\Component\Security\Http\Attribute\CurrentUser;
 use Symfony\Component\Security\Http\Controller\UserValueResolver;
@@ -109,6 +110,19 @@ public function testResolveSucceedsWithTypedAttribute()
         $this->assertSame([$user], $resolver->resolve(Request::create('/'), $metadata));
     }
 
+    public function testResolveSucceedsWithUnionTypedAttribute()
+    {
+        $user = new InMemoryUser('username', 'password');
+        $token = new UsernamePasswordToken($user, 'provider');
+        $tokenStorage = new TokenStorage();
+        $tokenStorage->setToken($token);
+
+        $resolver = new UserValueResolver($tokenStorage);
+        $metadata = new ArgumentMetadata('foo', InMemoryUser::class.'|'.OAuth2User::class, false, false, null, false, [new CurrentUser()]);
+
+        $this->assertSame([$user], $resolver->resolve(Request::create('/'), $metadata));
+    }
+
     public function testResolveThrowsAccessDeniedWithWrongUserClass()
     {
         $user = $this->createMock(UserInterface::class);