[Security][Ldap] Remove deprecated eraseCredentials() from (User|Token)Interface

Author: chalasr

UPGRADE-8.0.md

@@ -87,6 +87,11 @@ HttpClient
  * Remove support for amphp/http-client < 5
  * Remove setLogger() methods on decorators; configure the logger on the wrapped client directly instead
 
+Ldap
+----
+
+ * Remove `LdapUser::eraseCredentials()` in favor of `__serialize()`
+
 OptionsResolver
 ---------------
 
@@ -207,6 +212,38 @@ PropertyInfo
    }
    ```
 
+Security
+--------
+
+ * Remove `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`;
+   erase credentials e.g. using `__serialize()` instead
+
+  Before:
+
+  ```php
+  public function eraseCredentials(): void
+  {
+  }
+  ```
+
+  After:
+
+  ```php
+  #[\Deprecated]
+  public function eraseCredentials(): void
+  {
+  }
+
+  // If your eraseCredentials() method was used to empty a "password" property:
+  public function __serialize(): array
+  {
+      $data = (array) $this;
+      unset($data["\0".self::class."\0password"]);
+
+      return $data;
+  }
+  ```
+
 TwigBridge
 ----------
 

src/Symfony/Bridge/Doctrine/Tests/Fixtures/User.php

@@ -45,11 +45,6 @@ public function getUserIdentifier(): string
         return $this->name;
     }
 
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function equals(UserInterface $user)
     {
     }

src/Symfony/Bundle/SecurityBundle/Tests/Functional/SecurityTest.php

@@ -249,11 +249,6 @@ public function isEnabled(): bool
     {
         return $this->enabled;
     }
-
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
 }
 
 class ForceLoginController

src/Symfony/Component/Ldap/CHANGELOG.md

@@ -1,6 +1,11 @@
 CHANGELOG
 =========
 
+8.0
+---
+
+ * Remove `LdapUser::eraseCredentials()` in favor of `__serialize()`
+
 7.3
 ---
 

src/Symfony/Component/Ldap/Security/LdapUser.php

@@ -60,15 +60,6 @@ public function getUserIdentifier(): string
         return $this->identifier;
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/ldap 7.3')]
-    public function eraseCredentials(): void
-    {
-        $this->password = null;
-    }
-
     public function getExtraFields(): array
     {
         return $this->extraFields;

src/Symfony/Component/PasswordHasher/Tests/Fixtures/TestLegacyPasswordAuthenticatedUser.php

@@ -35,11 +35,6 @@ public function getRoles(): array
         return $this->roles;
     }
 
-    #[\Deprecated]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getUserIdentifier(): string
     {
         return $this->username;

src/Symfony/Component/Security/Core/Authentication/Token/AbstractToken.php

@@ -55,20 +55,6 @@ public function setUser(UserInterface $user): void
         $this->user = $user;
     }
 
-    /**
-     * Removes sensitive information from the token.
-     *
-     * @deprecated since Symfony 7.3, erase credentials using the "__serialize()" method instead
-     */
-    public function eraseCredentials(): void
-    {
-        trigger_deprecation('symfony/security-core', '7.3', \sprintf('The "%s::eraseCredentials()" method is deprecated and will be removed in 8.0, erase credentials using the "__serialize()" method instead.', TokenInterface::class));
-
-        if ($this->getUser() instanceof UserInterface) {
-            $this->getUser()->eraseCredentials();
-        }
-    }
-
     /**
      * Returns all the necessary state of the object for serialization purposes.
      *

src/Symfony/Component/Security/Core/Authentication/Token/NullToken.php

@@ -43,14 +43,6 @@ public function getUserIdentifier(): string
         return '';
     }
 
-    /**
-     * @deprecated since Symfony 7.3
-     */
-    #[\Deprecated(since: 'symfony/security-core 7.3')]
-    public function eraseCredentials(): void
-    {
-    }
-
     public function getAttributes(): array
     {
         return [];

src/Symfony/Component/Security/Core/Authentication/Token/TokenInterface.php

@@ -57,13 +57,6 @@ public function getUser(): ?UserInterface;
      */
     public function setUser(UserInterface $user): void;
 
-    /**
-     * Removes sensitive information from the token.
-     *
-     * @deprecated since Symfony 7.3; erase credentials using the "__serialize()" method instead
-     */
-    public function eraseCredentials(): void;
-
     public function getAttributes(): array;
 
     /**

src/Symfony/Component/Security/Core/CHANGELOG.md

@@ -1,6 +1,12 @@
 CHANGELOG
 =========
 
+8.0
+---
+
+ * Remove `UserInterface::eraseCredentials()` and `TokenInterface::eraseCredentials()`,
+  erase credentials e.g. using `__serialize()` instead
+
 7.3
 ---