fix: don't show 'access denied' flash message to anonymous users

src/EventListener/AccessDeniedListener.php

@@ -2,6 +2,7 @@
 
 namespace App\EventListener;
 
+use App\Entity\User;
 use Psr\Log\LoggerInterface;
 use Symfony\Bundle\SecurityBundle\Security;
 use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
@@ -30,18 +31,24 @@ class AccessDeniedListener
 
         $request = $event->getRequest();
 
+        // Ignore ajax requests
         if ($request->isXmlHttpRequest()) {
             return;
         }
 
-        $request->getSession()->getFlashBag()->add('error', 'Zugriff verweigert');
-
         $this->logger->warning('Access denied', [
             'uri' => $request->getRequestUri(),
         ]);
 
+        $redirectRoute = 'app_index';
+
         $user = $this->security->getUser();
-        $redirectRoute = $user ? $user->getDefaultRoute() : 'app_index';
+
+        // Show flash message to authenticated users only
+        if ($user instanceof User) {
+            $request->getSession()->getFlashBag()->add('error', 'Zugriff verweigert');
+            $redirectRoute = $user->getDefaultRoute();
+        }
 
         $event->setResponse(new RedirectResponse($this->urlGenerator->generate($redirectRoute)));
     }