chore(dead-code): #[CurrentUser] instead of three private currentUser() helpers

HappeningSoonController, InviteController and InsightPaneController each
carried the same getUser()-instanceof-User helper, used only inside
actions. The attribute's resolver does the same narrowing and throws
AccessDenied the same way. Controllers whose private stream/render
helpers also need the user keep theirs for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Controller/Calendar/HappeningSoonController.php

@@ -12,6 +12,7 @@ use DateTimeZone;
 use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\CurrentUser;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
@@ -80,10 +81,9 @@ final class HappeningSoonController extends AbstractController
      * prefix is all the two have in common, and that is what the prefix is for.
      */
     #[Route('/soon', name: 'soon', methods: ['GET'])]
-    public function panel(): Response
+    public function panel(#[CurrentUser] User $user): Response
     {
-        $user = $this->currentUser();
-        $now  = new DateTimeImmutable('now', new DateTimeZone('UTC'));
+        $now = new DateTimeImmutable('now', new DateTimeZone('UTC'));
 
         // The radar reads straight off MailInsightRepository rather than
         // growing a reader of its own or moving into HappeningSoonReader. That
@@ -101,15 +101,4 @@ final class HappeningSoonController extends AbstractController
             'undatedInsights' => $this->insights->recentUndatedForUser($user, $now),
         ]);
     }
-
-    private function currentUser(): User
-    {
-        $user = $this->getUser();
-
-        if (false === $user instanceof User) {
-            throw $this->createAccessDeniedException();
-        }
-
-        return $user;
-    }
 }

src/Controller/Calendar/InviteController.php

@@ -15,6 +15,7 @@ use Symfony\Bundle\FrameworkBundle\Controller\AbstractController;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\CurrentUser;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
@@ -42,13 +43,12 @@ final class InviteController extends AbstractController
     }
 
     #[Route('/{id}/respond', name: 'respond', requirements: ['id' => '\d+'], methods: ['POST'])]
-    public function respond(Request $request, Message $message): Response
+    public function respond(Request $request, Message $message, #[CurrentUser] User $user): Response
     {
         if (false === $this->isCsrfTokenValid('calendar_invite' . $message->id, (string) $request->request->get('_token'))) {
             throw $this->createAccessDeniedException();
         }
 
-        $user   = $this->currentUser();
         $status = ParticipationStatus::tryFrom($request->request->getString('status'));
 
         // needs-action is a real case of the enum and not a real answer: it is
@@ -96,15 +96,4 @@ final class InviteController extends AbstractController
 
         return $this->invites->forMessage($message, $user);
     }
-
-    private function currentUser(): User
-    {
-        $user = $this->getUser();
-
-        if (false === $user instanceof User) {
-            throw $this->createAccessDeniedException();
-        }
-
-        return $user;
-    }
 }

src/Controller/Insight/InsightPaneController.php

@@ -15,6 +15,7 @@ use Symfony\Component\HttpFoundation\JsonResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\Routing\Attribute\Route;
+use Symfony\Component\Security\Http\Attribute\CurrentUser;
 use Symfony\Component\Security\Http\Attribute\IsGranted;
 
 /**
@@ -67,12 +68,12 @@ final class InsightPaneController extends AbstractController
      * UserTimezoneResolver's job, in Twig, not this controller's.
      */
     #[Route('/pane', name: 'pane', methods: ['GET'])]
-    public function pane(): Response
+    public function pane(#[CurrentUser] User $user): Response
     {
         $now = new DateTimeImmutable('now', new DateTimeZone('UTC'));
 
         return $this->render('insight/_pane.html.twig', [
-            'rows' => $this->pane->rowsFor($this->currentUser(), $now),
+            'rows' => $this->pane->rowsFor($user, $now),
         ]);
     }
 
@@ -95,13 +96,13 @@ final class InsightPaneController extends AbstractController
      * is wrong, so guarding it would only be a branch that never pays.
      */
     #[Route('/pane/dismiss', name: 'pane_dismiss', methods: ['POST'])]
-    public function dismiss(Request $request, EntityManagerInterface $em): JsonResponse
+    public function dismiss(Request $request, EntityManagerInterface $em, #[CurrentUser] User $user): JsonResponse
     {
         $this->assertCsrf($request, 'insight-pane-dismiss');
 
         $dismissedAt = new DateTimeImmutable('now', new DateTimeZone('UTC'));
 
-        $this->currentUser()->setSetting(
+        $user->setSetting(
             User::SETTING_INSIGHT_PANE_DISMISSED_AT,
             $dismissedAt->format(DateTimeImmutable::ATOM),
         );
@@ -110,16 +111,4 @@ final class InsightPaneController extends AbstractController
 
         return $this->json(['ok' => true]);
     }
-
-    /** Narrowed the way HappeningSoonController narrows it — IS_AUTHENTICATED is not a type. */
-    private function currentUser(): User
-    {
-        $user = $this->getUser();
-
-        if (false === $user instanceof User) {
-            throw $this->createAccessDeniedException();
-        }
-
-        return $user;
-    }
 }

src/Controller/Mail/LabelController.php

@@ -248,9 +248,9 @@ final class LabelController extends AbstractController
     }
 
     /**
-     * Narrowed the way InsightPaneController narrows it — IS_AUTHENTICATED is
-     * not a type, and the topic a label change is published on is built from
-     * this user's id.
+     * Narrowed to User — IS_AUTHENTICATED is not a type, and the topic a label
+     * change is published on is built from this user's id. A helper rather
+     * than #[CurrentUser] because the private stream builder needs it too.
      */
     private function currentUser(): User
     {