Guard against circular parent chains on AbstractPage

Adds an Assert\Callback validator that walks the parentPage/parentPageData
chain upward using a visited-ID set, blocking self-references and cycles
that mix Page and AbstractPageData parents (e.g. A→B→A across types).

Three Behat scenarios cover: self-reference, same-type cycle, mixed-type cycle.

Author: silverbackdan

features/bootstrap/DoctrineContext.php

@@ -436,6 +436,47 @@ public function theComponentGroupHasTheAllowedComponents(string $allowedComponen
         $this->manager->clear();
     }
 
+    /**
+     * @Given there is a page with parent page :parentRef
+     */
+    public function thereIsAPageWithParentPage(string $parentRef): void
+    {
+        /** @var Page $parent */
+        $parent = $this->iriConverter->getResourceFromIri($this->restContext->resources[$parentRef]);
+
+        $page = new Page();
+        $page->isTemplate = true;
+        $page->reference = 'child-page';
+        $page->setParentPage($parent);
+        $this->timestampedHelper->persistTimestampedFields($page, true);
+        $this->manager->persist($page);
+        $this->manager->flush();
+        $this->restContext->resources['child_page'] = $this->iriConverter->getIriFromResource($page);
+    }
+
+    /**
+     * @Given there is a page data with parent page :parentRef
+     */
+    public function thereIsAPageDataWithParentPage(string $parentRef): void
+    {
+        /** @var Page $parent */
+        $parent = $this->iriConverter->getResourceFromIri($this->restContext->resources[$parentRef]);
+
+        $templatePage = new Page();
+        $templatePage->isTemplate = true;
+        $templatePage->reference = 'page-data-template';
+        $this->timestampedHelper->persistTimestampedFields($templatePage, true);
+        $this->manager->persist($templatePage);
+
+        $pageData = new PageData();
+        $pageData->page = $templatePage;
+        $pageData->setParentPage($parent);
+        $this->timestampedHelper->persistTimestampedFields($pageData, true);
+        $this->manager->persist($pageData);
+        $this->manager->flush();
+        $this->restContext->resources['page_data'] = $this->iriConverter->getIriFromResource($pageData);
+    }
+
     /**
      * @Given there is a Page
      */

features/main/page.feature

@@ -48,6 +48,35 @@ Feature: Page resources
     Then the response status code should be 200
     And the JSON node "parentPage" should be equal to the IRI of the resource "page"
 
+  @loginAdmin
+  Scenario: I cannot set a page as its own parent
+    Given there is a Page
+    When I send a "PATCH" request to the resource "page" with data:
+      | parentPage     |
+      | resource[page] |
+    Then the response status code should be 422
+    And the JSON should be valid according to the schema file "validation_errors_object.schema.json"
+
+  @loginAdmin
+  Scenario: I cannot create a circular parent chain between two pages
+    Given there is a Page
+    And there is a page with parent page "page"
+    When I send a "PATCH" request to the resource "page" with data:
+      | parentPage           |
+      | resource[child_page] |
+    Then the response status code should be 422
+    And the JSON should be valid according to the schema file "validation_errors_object.schema.json"
+
+  @loginAdmin
+  Scenario: I cannot create a circular parent chain across mixed Page and PageData parents
+    Given there is a Page
+    And there is a page data with parent page "page"
+    When I send a "PATCH" request to the resource "page" with data:
+      | parentPageData      |
+      | resource[page_data] |
+    Then the response status code should be 422
+    And the JSON should be valid according to the schema file "validation_errors_object.schema.json"
+
   @loginUser
   Scenario: I cannot set both a parent Page and a parent PageData on a page
     Given there is a Layout

src/Entity/Core/AbstractPage.php

@@ -18,6 +18,7 @@
 use Symfony\Bridge\Doctrine\Validator\Constraints\UniqueEntity;
 use Symfony\Component\Serializer\Annotation\Groups;
 use Symfony\Component\Validator\Constraints as Assert;
+use Symfony\Component\Validator\Context\ExecutionContextInterface;
 
 /**
  * @author Daniel West <daniel@silverback.is>
@@ -93,6 +94,37 @@ public function setParentPageData(?AbstractPageData $parentPageData): self
         return $this;
     }
 
+    #[Assert\Callback]
+    public function validateNoCircularParent(ExecutionContextInterface $context): void
+    {
+        $parent = $this->parentPage ?? $this->parentPageData;
+        if ($parent === null) {
+            return;
+        }
+
+        $visitedIds = [];
+        if ($this->id !== null) {
+            $visitedIds[] = $this->id->toString();
+        }
+
+        while ($parent !== null) {
+            $parentId = $parent->getId();
+            if ($parentId !== null) {
+                $parentIdStr = $parentId->toString();
+                if (\in_array($parentIdStr, $visitedIds, true)) {
+                    $field = $this->parentPage !== null ? 'parentPage' : 'parentPageData';
+                    $context->buildViolation('Setting this parent would create a circular reference.')
+                        ->atPath($field)
+                        ->addViolation();
+
+                    return;
+                }
+                $visitedIds[] = $parentIdStr;
+            }
+            $parent = $parent->getParentPage() ?? $parent->getParentPageData();
+        }
+    }
+
     public function getParentPageRoute(): ?Route
     {
         return $this->parentPage?->getRoute() ?? $this->parentPageData?->getRoute();