Currently DefaultPreferencesFactory and GlobalPreferencesFactory are using PermissionManager to do the permission checks. Both should be converted to using Authority instead.

The permissionManager in both classes is only used for PermissionManager::userHasRight calls, which has a 1-1 replacement as 'Authority::isAllowed'. The authority should be taken from IContextSource passed into the public methods, not from the User.

One complication here is that DefaultPreferencesFactory::saveFormData does not get User object, but instead gets it from the target of the form. Technically, it's correct since the preferences factory target user should always be the current user, but it's ugly. Instead the method signature should be changed to pass in the Authority. The method is overridden in GlobalPreferencesFactory, so we'd need to do some complex dance:

1. Introduce a new method with authority in DefaultPreferencesFactory
2. Override the new method in GlobalPreferencesFactory
3. Switch the call, remove the original method in DefaultPreferencesFactory
4. Remove the original method in GlobalPreferencesFactory

With the rest of the private/protected methods, User is passed and it probably can just be changed to Authority. The target user in the form object can probably be changed to be UserIdentity.