Fix isAnonymous() always returning false on Symfony 6.x

[mfaivre-simplis]

Summary

Fixes #1205

BaseSecurity::isAnonymous() calls isGranted('IS_AUTHENTICATED_ANONYMOUSLY'), which was removed from AuthenticatedVoter in Symfony 6.x (deprecated since 5.4) : https://github.com/symfony/symfony/blob/6.0/UPGRADE-6.0.md#security:~:text=Remove%20AuthenticatedVoter%3A%3AIS_AUTHENTICATED_ANONYMOUSLY%20and%20AuthenticatedVoter%3A%3AIS_ANONYMOUS%2C%20use%20AuthenticatedVoter%3A%3APUBLIC_ACCESS%20instead.

The access decision manager does not work and returns false. Every field annotated with #[GQL\Access('isAnonymous()')] gets "Access denied to this field" for all requests.

The fix uses PUBLIC_ACCESS on Symfony 6.x, which has the same behavior (IS_AUTHENTICATED_ANONYMOUSLY and PUBLIC_ACCESS both always grant access) and is the official replacement.

Changes

• src/Security/Security.php: use PUBLIC_ACCESS on Symfony >= 6.0, keep IS_AUTHENTICATED_ANONYMOUSLY for 5.x

Reproduction

A minimal reproduction repo is available at: https://github.com/mfaivre-simplis/graphqlbundle-issue-1205

#[GQL\Provider]
#[GQL\Access('isAnonymous()')]
final readonly class ConnectedUserQuery
{
    #[GQL\Query(name: 'connectedUser', type: 'Boolean!')]
    #[GQL\Access('isAnonymous()')]
    public function __invoke(): bool
    {
        return true;
    }
}

With Symfony 6.x, querying { connectedUser } always returns "Access denied to this field" before this fix.

[Nyholm]

Great. Thank you. But let's drop IS_AUTHENTICATED_ANONYMOUSLY completely.