I had a case in one of my apps where I have some shared logic for user checkers across multiple firewalls (API and traditional web login) while also needing extra logic for the API. Instead of duplicating the checker for each firewall or using a decorator, I thought a chained user checker would be nice to have and that it might be useful to users of the framework.

This will add a ChainUserChecker class to the security-core component, and the SecurityBundle will create a security.user_checker.chain.<firewall> service for each firewall. User checkers can then be tagged with a security.user_checker.<firewall> tag for each firewall the checker applies to, and users would set this chain service as the user checker for their firewall.

<?php

namespace App\Security\User;

use Symfony\Component\DependencyInjection\Attribute\Autoconfigure;
use Symfony\Component\Security\Core\User\UserCheckerInterface;

#[Autoconfigure(tags: [['security.user_checker.main' => ['priority' => 10]]])]
#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 10]]])]
final class DisabledAccountUserChecker implements UserCheckerInterface {}

#[Autoconfigure(tags: [['security.user_checker.api' => ['priority' => 5]]])]
final class ApiAccessAllowedUserChecker implements UserCheckerInterface {}