Fix fatal error when using PHP 8.1+ union/intersection types in ACL callbacks and Model Binder

[Copilot]

• Type: bug fix
• Link to issue: Upgrade from 4.2 to 5.1.3 get error The 'keepSnapshots' option must be enabled to track changes #16261

In raising this pull request, I confirm the following:

• I have read and understood the Contributing Guidelines
• I have checked that another pull request for this purpose does not exist
• I wrote some tests for this PR
• I have updated the relevant CHANGELOG
• I have created a PR for the documentation about this change

ReflectionParameter::getClass() was deprecated in PHP 8.0 and both Acl\Adapter\Memory and Mvc\Model\Binder were already updated to use getType(). However, getType() in PHP 8.0+ can return ReflectionUnionType or ReflectionIntersectionType, neither of which has a getName() method — causing a fatal error when union or intersection types appear in ACL callbacks or controller action parameters.

// Previously caused a fatal error in isAllowed()
$acl->allow('Admin', 'User', ['update'], function (int|string $parameter) {
    return $parameter === 1;
});
$acl->isAllowed('Admin', 'User', 'update', ['parameter' => 1]);

// Also affected Model\Binder when action parameters used union types
public function indexAction(MyModel|null $model) { ... }

Changes

• Acl/Adapter/Memory.zep: Add use ReflectionNamedType and guard getName() call with instanceof ReflectionNamedType check. Union/intersection type parameters fall through to the user-supplied parameters array as before.
• Mvc/Model/Binder.zep: Add use ReflectionNamedType and skip model binding (continue) for non-named types — correct behavior since we cannot determine which model class to bind for a union type.
• tests/unit/Acl/Adapter/Memory/IsAllowedCest.php: Add test verifying union type parameters in ACL callbacks work without fatal errors.
• CHANGELOG-5.0.md: Entry added to the unreleased 5.11.0 version section.

Thanks

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[BUG]: Method ReflectionParameter::getClass() is deprecated</issue_title>
<issue_description>Sorry for not using the template.

I'm upgrading my project from phalcon 4 (php 7.4) to phalcon 5 (php 8.1) and I'm getting this deprecation message
Method ReflectionParameter::getClass() is deprecated in ....

I checked my code and I'm not using the reflection, I also checked the dependencies, then I dug into phalcon code and I found the following line in phalcon/Acl/Adapter/Memory.zep:705:
let reflectionClass = reflectionParameter->getClass(),.

ReflectionParameter::getClass with some other reflection methods have been deprecated since php 8: https://www.php.net/manual/en/reflectionparameter.getclass.php

Is that something you are aware of?

I forgot, I call AclList::isAllowed at the line I have the deprecation message.</issue_description>

<agent_instructions>Please find the instances in the code and propose fixes</agent_instructions>

Comments on the Issue (you are @copilot in this section)

@niden Thanks for the report. I will take a look at this as soon as I can. @niden This has been resolved in https://github.com//pull/16257 @niden Hello,

Phalcon\Mvc\Model\Binder class seems to have the same problem.

let reflectionClass = methodParam->getClass();</comment_new>

• Fixes [BUG]: Method ReflectionParameter::getClass() is deprecated #16255

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[niden]

Please move the entry in the CHANGELOG-5.0 to the unreleased version

[Copilot]

Please move the entry in the CHANGELOG-5.0 to the unreleased version

Done — moved the entry to the 5.11.0 unreleased section in commit 2db361b.