symfony · nicolas-grekas · May 23, 2021 · May 23, 2021
@@ -0,0 +1,48 @@
+<?php
+
+namespace Symfony\Component\Security\Core\Tests\Authentication\Token\Fixtures;
+
+use Symfony\Component\Security\Core\User\UserInterface;
+
+final class CustomUser implements UserInterface
+{
+    /** @var string */
+    private $username;
+    /** @var array */
+    private $roles;
+
+    public function __construct(string $username, array $roles)
+    {
+        $this->username = $username;
+        $this->roles = $roles;
+    }
+
+    public function getUsername(): string
+    {
+        return $this->username;
+    }
+
+    public function getUserIdentifier(): string
+    {
+        return $this->username;
+    }
+
+    public function getRoles(): array
+    {
+        return $this->roles;
+    }
+
+    public function getPassword(): ?string
+    {
+        return null;
+    }
+
+    public function getSalt(): ?string
+    {
+        return null;
+    }
+
+    public function eraseCredentials(): void
+    {
+    }
+}
@@ -14,6 +14,7 @@
 use PHPUnit\Framework\TestCase;
 use Symfony\Component\Security\Core\Authentication\Token\SwitchUserToken;
 use Symfony\Component\Security\Core\Authentication\Token\UsernamePasswordToken;
+use Symfony\Component\Security\Core\Tests\Authentication\Token\Fixtures\CustomUser;
 use Symfony\Component\Security\Core\User\UserInterface;
 
 class SwitchUserTokenTest extends TestCase
@@ -90,13 +91,33 @@ public function testSerializeNullImpersonateUrl()
         $this->assertNull($unserializedToken->getOriginatedFromUri());
     }
 
+    /**
+     * Tests if an old version of SwitchUserToken can still be unserialized.
+     *
+     * The fixture was generated by running the following code with Symfony 4.4 and PHP 7.2.
+     *
+     * serialize(
+     *     new SwitchUserToken(
+     *         new CustomUser('john', ['ROLE_USER']),
+     *         ['foo' => 'bar'],
+     *         'main', ['ROLE_USER'],
+     *         new UsernamePasswordToken(
+     *             new CustomUser('jane', ['ROLE_USER']),
+     *             ['foo' => 'bar'],
+     *             'main',
+     *             ['ROLE_USER']
+     *         )
+     *     )
+     * )
+     */
     public function testUnserializeOldToken()
     {
         /** @var SwitchUserToken $token */
         $token = unserialize(file_get_contents(__DIR__.'/Fixtures/switch-user-token-4.4.txt'));
 
         self::assertInstanceOf(SwitchUserToken::class, $token);
         self::assertInstanceOf(UsernamePasswordToken::class, $token->getOriginalToken());
+        self::assertInstanceOf(CustomUser::class, $token->getUser());
         self::assertSame('john', $token->getUserIdentifier());
         self::assertSame(['foo' => 'bar'], $token->getCredentials());
         self::assertSame('main', $token->getFirewallName());