Symfony version(s) affected

7.1.1

Description

#[MapEntity] is "handled" before #[IsGranted].

How to reproduce

1. Clone Symfony Demo Application
2. In src/Controller/Admin/BlogController.php, replace index() function by

...
use Symfony\Bridge\Doctrine\Attribute\MapEntity;
...

#[Route('/', name: 'admin_index', methods: ['GET'])]
#[Route('/', name: 'admin_post_index', methods: ['GET'])]
public function index(
    #[MapEntity(class: Post::class, expr: 'repository.findBy({"author": 13}, {"publishedAt": "DESC"})')]
    iterable $authorPosts
): Response {

    return $this->render('admin/blog/index.html.twig', ['posts' => $authorPosts]);
}

3. Go to https://127.0.0.1:8000/fr/admin/post.
4. The application redirects the user to the login form so that's ok. But when we look at the profiler, there is the Doctrine tab which informs us that a query has been executed and it is indeed the query linked to MapEntity because there is the 13 which is in the query.

Possible Solution

No response

Additional Context

No response