[Security] Add argument $exceptionCode to #[IsGranted]

Author: Maximilian Zumbansen

Attribute/IsGranted.php

@@ -42,6 +42,11 @@ public function __construct(
          * If null, Security\Core's AccessDeniedException will be used.
          */
         public ?int $statusCode = null,
+
+        /**
+         * If set, will add the exception code to thrown exception.
+         */
+        public ?int $exceptionCode = null,
     ) {
     }
 }

CHANGELOG.md

@@ -5,6 +5,7 @@ CHANGELOG
 ---
 
  * Add `RememberMeBadge` to `JsonLoginAuthenticator` and enable reading parameter in JSON request body
+ * Add argument `$exceptionCode` to `#[IsGranted]`
 
 6.2
 ---

EventListener/IsGrantedAttributeListener.php

@@ -66,10 +66,10 @@ public function onKernelControllerArguments(ControllerArgumentsEvent $event)
                 $message = $attribute->message ?: sprintf('Access Denied by #[IsGranted(%s)] on controller', $this->getIsGrantedString($attribute));
 
                 if ($statusCode = $attribute->statusCode) {
-                    throw new HttpException($statusCode, $message);
+                    throw new HttpException($statusCode, $message, code: $attribute->exceptionCode ?? 0);
                 }
 
-                $accessDeniedException = new AccessDeniedException($message);
+                $accessDeniedException = new AccessDeniedException($message, code: $attribute->exceptionCode ?? 403);
                 $accessDeniedException->setAttributes($attribute->attribute);
                 $accessDeniedException->setSubject($subject);
 

Tests/EventListener/IsGrantedAttributeListenerTest.php

@@ -384,4 +384,50 @@ public function testIsGrantedWithRequestAsSubject()
         $listener = new IsGrantedAttributeListener($authChecker, new ExpressionLanguage());
         $listener->onKernelControllerArguments($event);
     }
+
+    public function testHttpExceptionWithExceptionCode()
+    {
+        $this->expectException(HttpException::class);
+        $this->expectExceptionMessage('Exception Code');
+        $this->expectExceptionCode(10010);
+
+        $authChecker = $this->createMock(AuthorizationCheckerInterface::class);
+        $authChecker->expects($this->any())
+            ->method('isGranted')
+            ->willReturn(false);
+
+        $event = new ControllerArgumentsEvent(
+            $this->createMock(HttpKernelInterface::class),
+            [new IsGrantedAttributeMethodsController(), 'exceptionCodeInHttpException'],
+            [],
+            new Request(),
+            null
+        );
+
+        $listener = new IsGrantedAttributeListener($authChecker);
+        $listener->onKernelControllerArguments($event);
+    }
+
+    public function testAccessDeniedExceptionWithExceptionCode()
+    {
+        $this->expectException(AccessDeniedException::class);
+        $this->expectExceptionMessage('Exception Code');
+        $this->expectExceptionCode(10010);
+
+        $authChecker = $this->createMock(AuthorizationCheckerInterface::class);
+        $authChecker->expects($this->any())
+            ->method('isGranted')
+            ->willReturn(false);
+
+        $event = new ControllerArgumentsEvent(
+            $this->createMock(HttpKernelInterface::class),
+            [new IsGrantedAttributeMethodsController(), 'exceptionCodeInAccessDeniedException'],
+            [],
+            new Request(),
+            null
+        );
+
+        $listener = new IsGrantedAttributeListener($authChecker);
+        $listener->onKernelControllerArguments($event);
+    }
 }

Tests/Fixtures/IsGrantedAttributeMethodsController.php

@@ -45,6 +45,16 @@ public function notFound()
     {
     }
 
+    #[IsGranted(attribute: 'ROLE_ADMIN', message: 'Exception Code Http', statusCode: 404, exceptionCode: 10010)]
+    public function exceptionCodeInHttpException()
+    {
+    }
+
+    #[IsGranted(attribute: 'ROLE_ADMIN', message: 'Exception Code Access Denied', exceptionCode: 10010)]
+    public function exceptionCodeInAccessDeniedException()
+    {
+    }
+
     #[IsGranted(attribute: new Expression('"ROLE_ADMIN" in role_names or is_granted("POST_VIEW", subject)'), subject: 'post')]
     public function withExpressionInAttribute($post)
     {