refactor: make PublicKeyCredentialSource extend CredentialRecord (#804)

This change improves backward compatibility by using inheritance instead
of union types. PublicKeyCredentialSource now extends CredentialRecord,
allowing code that type-hints CredentialRecord to automatically accept
both types.

Key changes:
- PublicKeyCredentialSource is now an empty class extending CredentialRecord
- Repository interfaces use CredentialRecord instead of union types
- Deprecated interfaces (PublicKeyCredentialSourceRepositoryInterface,
  CanSaveCredentialSource) now extend their new counterparts
- All ceremony steps and validators updated to use CredentialRecord only
- CredentialRecordConverter utility updated to handle inheritance

This resolves the concern raised in discussion #803 where downstream
packages needed union types to support both v5.2 and v5.3.

Author: Spomky

.ci-tools/phpstan-baseline.neon

@@ -4,7 +4,9 @@
 
 namespace Webauthn\Bundle\CredentialOptionsBuilder;
 
+use function count;
 use InvalidArgumentException;
+use function is_array;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\Serializer\Encoder\JsonEncoder;
@@ -19,10 +21,7 @@
 use Webauthn\CredentialRecord;
 use Webauthn\PublicKeyCredentialCreationOptions;
 use Webauthn\PublicKeyCredentialDescriptor;
-use Webauthn\PublicKeyCredentialSource;
 use Webauthn\PublicKeyCredentialUserEntity;
-use function count;
-use function is_array;
 
 final readonly class ProfileBasedCreationOptionsBuilder implements PublicKeyCredentialCreationOptionsBuilder
 {
@@ -83,7 +82,7 @@ private function getCredentials(PublicKeyCredentialUserEntity $userEntity): arra
         $credentialSources = $this->credentialSourceRepository->findAllForUserEntity($userEntity);
 
         return array_map(
-            static fn (CredentialRecord|PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
+            static fn (CredentialRecord $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
             $credentialSources
         );
     }

src/symfony/src/CredentialOptionsBuilder/ProfileBasedCreationOptionsBuilder.php

@@ -4,6 +4,8 @@
 
 namespace Webauthn\Bundle\CredentialOptionsBuilder;
 
+use function count;
+use function is_array;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Exception\BadRequestHttpException;
 use Symfony\Component\Serializer\Encoder\JsonEncoder;
@@ -20,10 +22,7 @@
 use Webauthn\FakeCredentialGenerator;
 use Webauthn\PublicKeyCredentialDescriptor;
 use Webauthn\PublicKeyCredentialRequestOptions;
-use Webauthn\PublicKeyCredentialSource;
 use Webauthn\PublicKeyCredentialUserEntity;
-use function count;
-use function is_array;
 
 final readonly class ProfileBasedRequestOptionsBuilder implements PublicKeyCredentialRequestOptionsBuilder
 {
@@ -86,7 +85,7 @@ private function getCredentials(PublicKeyCredentialUserEntity $userEntity): arra
         $credentialSources = $this->credentialSourceRepository->findAllForUserEntity($userEntity);
 
         return array_map(
-            static fn (CredentialRecord|PublicKeyCredentialSource $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
+            static fn (CredentialRecord $credential): PublicKeyCredentialDescriptor => $credential->getPublicKeyCredentialDescriptor(),
             $credentialSources
         );
     }

src/symfony/src/CredentialOptionsBuilder/ProfileBasedRequestOptionsBuilder.php

@@ -4,6 +4,8 @@
 
 namespace Webauthn\Bundle\DataCollector;
 
+use const JSON_PRETTY_PRINT;
+use const JSON_THROW_ON_ERROR;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
@@ -21,8 +23,6 @@
 use Webauthn\Event\AuthenticatorAssertionResponseValidationSucceededEvent;
 use Webauthn\Event\AuthenticatorAttestationResponseValidationFailedEvent;
 use Webauthn\Event\AuthenticatorAttestationResponseValidationSucceededEvent;
-use const JSON_PRETTY_PRINT;
-use const JSON_THROW_ON_ERROR;
 
 class WebauthnCollector extends DataCollector implements EventSubscriberInterface
 {

src/symfony/src/DataCollector/WebauthnCollector.php

@@ -4,6 +4,8 @@
 
 namespace Webauthn\Bundle\DependencyInjection\Compiler;
 
+use function count;
+use function is_array;
 use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
 use Symfony\Component\DependencyInjection\Definition;
@@ -17,8 +19,6 @@
 use Webauthn\MetadataService\CertificateChain\CertificateChainValidator;
 use Webauthn\MetadataService\MetadataStatementRepository;
 use Webauthn\MetadataService\StatusReportRepository;
-use function count;
-use function is_array;
 
 final class CeremonyStepManagerFactoryCompilerPass implements CompilerPassInterface
 {

src/symfony/src/DependencyInjection/Compiler/CeremonyStepManagerFactoryCompilerPass.php

@@ -4,12 +4,12 @@
 
 namespace Webauthn\Bundle\DependencyInjection\Compiler;
 
+use function array_key_exists;
 use InvalidArgumentException;
+use function sprintf;
 use Symfony\Component\DependencyInjection\Compiler\CompilerPassInterface;
 use Symfony\Component\DependencyInjection\ContainerBuilder;
 use Webauthn\Bundle\Routing\Loader;
-use function array_key_exists;
-use function sprintf;
 
 final readonly class DynamicRouteCompilerPass implements CompilerPassInterface
 {

src/symfony/src/DependencyInjection/Compiler/DynamicRouteCompilerPass.php

@@ -4,6 +4,7 @@
 
 namespace Webauthn\Bundle\DependencyInjection;
 
+use function assert;
 use Psr\EventDispatcher\EventDispatcherInterface;
 use Symfony\Component\Config\Definition\Builder\ArrayNodeDefinition;
 use Symfony\Component\Config\Definition\Builder\TreeBuilder;
@@ -21,7 +22,6 @@
 use Webauthn\MetadataService\CertificateChain\PhpCertificateChainValidator;
 use Webauthn\PublicKeyCredentialCreationOptions;
 use Webauthn\SimpleFakeCredentialGenerator;
-use function assert;
 
 final readonly class Configuration implements ConfigurationInterface
 {

src/symfony/src/DependencyInjection/Configuration.php

@@ -4,6 +4,9 @@
 
 namespace Webauthn\Bundle\DependencyInjection\Factory\Security;
 
+use function array_key_exists;
+use function assert;
+use function sprintf;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\AuthenticatorFactoryInterface;
 use Symfony\Bundle\SecurityBundle\DependencyInjection\Security\Factory\FirewallListenerFactoryInterface;
 use Symfony\Component\Config\Definition\Builder\NodeDefinition;
@@ -38,9 +41,6 @@
 use Webauthn\Bundle\Service\PublicKeyCredentialRequestOptionsFactory;
 use Webauthn\Denormalizer\WebauthnSerializerFactory;
 use Webauthn\FakeCredentialGenerator;
-use function array_key_exists;
-use function assert;
-use function sprintf;
 
 final readonly class WebauthnFactory implements FirewallListenerFactoryInterface, AuthenticatorFactoryInterface
 {

src/symfony/src/DependencyInjection/Factory/Security/WebauthnFactory.php

@@ -4,7 +4,11 @@
 
 namespace Webauthn\Bundle\DependencyInjection;
 
+use function array_key_exists;
 use Cose\Algorithm\Algorithm;
+use function count;
+use function is_array;
+use function sprintf;
 use Symfony\Component\Config\Definition\ConfigurationInterface;
 use Symfony\Component\Config\Definition\Processor;
 use Symfony\Component\Config\FileLocator;
@@ -52,10 +56,6 @@
 use Webauthn\MetadataService\CertificateChain\CertificateChainValidator;
 use Webauthn\MetadataService\MetadataStatementRepository;
 use Webauthn\MetadataService\StatusReportRepository;
-use function array_key_exists;
-use function count;
-use function is_array;
-use function sprintf;
 
 final class WebauthnExtension extends Extension implements PrependExtensionInterface
 {

src/symfony/src/DependencyInjection/WebauthnExtension.php

@@ -6,8 +6,8 @@
 
 use Doctrine\DBAL\Platforms\AbstractPlatform;
 use Doctrine\DBAL\Types\Type;
-use Symfony\Component\Uid\Uuid;
 use function is_string;
+use Symfony\Component\Uid\Uuid;
 
 final class AAGUIDDataType extends Type
 {