Authorization checks for editing attributes of a task
Just like you say, you are hiding dependencies if you have new or call a non-pure function with the x::y($z) syntax.

One way to go around this, is to acknowledge the dependency and take it as a constructor argument, so that the current object doesn't care where it gets its user from, but it knows that it can call isCreator() or such. Some would advice you to take dependencies through setUser(User $u)-like methods, but that would make the object useless between its constructor is called, and until the setUser() method is called, because getEditableStateForMessage() and friends will fail in the meantime.

You should consider attacking problems like this from a TDD point of view: how do I test the current code without having to resort to real data?