Merge branch '5.0' into fix-response-descriptions

Author: adriendupuis

composer.json

@@ -44,7 +44,7 @@
         "symfony/security-csrf": "^7.4",
         "symfony/yaml": "^7.4",
         "twig/twig": "^3.0",
-        "webmozart/assert": "^1.11"
+        "webmozart/assert": "^2.3"
     },
     "require-dev": {
         "ibexa/code-style": "~2.0.0",

src/bundle/Resources/config/services.yml

@@ -422,7 +422,7 @@ services:
         arguments:
             $parsingDispatcher: '@Ibexa\Contracts\Rest\Input\ParsingDispatcher'
 
-    Ibexa\Contracts\Rest\Output\ValueObjectVisitorResolverInterface: '@Ibexa\Contracts\Rest\Output\ValueObjectVisitor'
+    Ibexa\Contracts\Rest\Output\ValueObjectVisitorResolverInterface: '@Ibexa\Contracts\Rest\Output\ValueObjectVisitorResolver'
 
     Ibexa\Contracts\Rest\Output\ValueObjectVisitorResolver: ~
 

src/lib/Server/Controller/Session/SessionBaseController.php

@@ -93,6 +93,8 @@ protected function logout(Request $request): Response
         $response->setStatusCode(Response::HTTP_NOT_FOUND);
         $requestSession->clear();
 
+        $this->securityTokenStorage->setToken(null);
+
         return $response;
     }
 }

tests/bundle/Functional/SessionTest.php

@@ -142,6 +142,55 @@ public function testLoginWithExistingFrontendSession(): void
         $this->assertHttpResponseCodeEquals($response, 201);
     }
 
+    public function testDeletedSessionCookieCannotReauthenticate(): void
+    {
+        $session = $this->login();
+
+        // Logged-in server-side session check
+        $currentSessionRequest = $this->createHttpRequest(
+            'GET',
+            '/api/ibexa/v2/user/sessions/current',
+            '',
+            'Session+json',
+            '',
+            [
+                'Cookie' => sprintf('%s=%s', $session->name, $session->identifier),
+                'X-CSRF-Token' => $session->csrfToken,
+            ]
+        );
+        $currentSessionResponse = $this->sendHttpRequest($currentSessionRequest);
+        self::assertHttpResponseCodeEquals($currentSessionResponse, 200);
+        $authenticatedData = json_decode($currentSessionResponse->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);
+        $authenticatedUserHref = $authenticatedData['Session']['User']['_href'];
+
+        // Logout
+        $deleteResponse = $this->sendHttpRequest($this->createDeleteRequest($session));
+        self::assertHttpResponseCodeEquals($deleteResponse, 204);
+
+        // Re-use the old cookie — the server-side session must no longer be authenticated as the original user
+        $reusedResponse = $this->sendHttpRequest(
+            $this->createHttpRequest(
+                'GET',
+                '/api/ibexa/v2/user/sessions/current',
+                '',
+                'Session+json',
+                '',
+                ['Cookie' => sprintf('%s=%s', $session->name, $session->identifier)]
+            )
+        );
+
+        $reusedData = json_decode($reusedResponse->getBody()->getContents(), true, 512, JSON_THROW_ON_ERROR);
+        self::assertNotEquals(
+            $authenticatedUserHref,
+            $reusedData['Session']['User']['_href'],
+            'Old session cookie must not re-authenticate as the original user after logout'
+        );
+        self::assertEquals(
+            '/api/ibexa/v2/user/users/10',
+            $reusedData['Session']['User']['_href']
+        );
+    }
+
     public function testDeleteSessionExpired(): void
     {
         $session = $this->login();
@@ -195,7 +244,7 @@ public function testCheckSession(): void
         $this->assertHttpResponseCodeEquals($response, 200);
 
         $contents = $response->getBody()->getContents();
-        $data = json_decode($contents, true, JSON_THROW_ON_ERROR);
+        $data = json_decode($contents, true, 512, JSON_THROW_ON_ERROR);
         self::assertArrayHasKey('Session', $data);
     }
 

tests/bundle/Functional/TestCase.php

@@ -352,7 +352,7 @@ protected function login(): \stdClass
         $response = $this->sendHttpRequest($request);
         self::assertHttpResponseCodeEquals($response, 201);
 
-        return json_decode($response->getBody()->getContents(), false, JSON_THROW_ON_ERROR)->Session;
+        return json_decode($response->getBody()->getContents(), false, 512, JSON_THROW_ON_ERROR)->Session;
     }
 
     /**