Fix allowedComponents check blocking components loaded as Doctrine proxies

When PageData is loaded from DB, its component associations are lazy-loaded
as Doctrine proxy instances. ComponentPositionNormalizer.normalizeForPageData()
called \$component::class on the proxy, returning the proxy class name
(Proxies\\__CG__\\...) rather than the real entity class. This caused
getIriFromResource() to produce the wrong collection IRI, so the in_array()
check against allowedComponents always failed — blocking all pageDataProperty
components for anonymous users (any request that cold-loaded PageData from DB).

Fix: detect Doctrine Proxy via instanceof and use get_parent_class() to
recover the real class name, matching the pattern used in PropagateUpdatesListener.

Adds Behat tests covering both the direct position fetch (path header) and
the manifest endpoint, with manager->clear() to force proxy loading.

Author: silverbackdan

CLAUDE.md

@@ -672,4 +672,4 @@ A custom Symfony profiler panel showing how the bundle handled a request — sec
 
 When a component has a file uploaded to S3 with private ACL, accessing the file requires a pre-signed temporary URL. The bundle's uploadable system doesn't currently handle the pre-signed URL lifecycle — the URL returned may be permanent and publicly accessible (or inaccessible).
 
-**Fix direction:** The `Flysystem temporary URL` generator (`silverback.api_components.uploadable.url_generator.temporary`) likely generates pre-signed URLs already. Tests for this path with a real (or mock) S3 adapter are missing. Also: the download endpoint (`src/Action/Uploadable/DownloadAction.php`) can gate access — apps can hook into events — but this isn't documented or tested.
+**Fix direction:** The `Flysystem temporary URL` generator (`silverback.api_components.uploadable.url_generator.temporary`) likely generates pre-signed URLs already. Tests for this path with a real (or mock) S3 adapter are missing. Also: the download endpoint (`src/Action/Uploadable/DownloadAction.php`) can gate access — apps can hook into events — but this isn't documented or tested.

features/bootstrap/DoctrineContext.php

@@ -879,6 +879,53 @@ public function thereIsAPageDataPropertyPositionWithDisallowedComponentType(stri
         $this->manager->flush();
     }
 
+    /**
+     * @Given there is a pageDataProperty position with an allowed component type in a restricted group with route :path
+     */
+    public function thereIsAPageDataPropertyPositionWithAllowedComponentType(string $path): void
+    {
+        $componentGroup = new ComponentGroup();
+        $componentGroup->reference = 'test';
+        $componentGroup->location = 'test';
+        $componentGroup->allowedComponents = ['/component/dummy_components'];
+        $this->timestampedHelper->persistTimestampedFields($componentGroup, true);
+        $this->manager->persist($componentGroup);
+        $this->restContext->resources['component_group'] = $this->iriConverter->getIriFromResource($componentGroup);
+
+        $componentPosition = new ComponentPosition();
+        $componentPosition->pageDataProperty = 'component';
+        $componentPosition->componentGroup = $componentGroup;
+        $componentPosition->sortValue = 0;
+        $this->timestampedHelper->persistTimestampedFields($componentPosition, true);
+        $this->manager->persist($componentPosition);
+        $this->restContext->resources['position_0'] = $this->iriConverter->getIriFromResource($componentPosition);
+
+        $page = new Page();
+        $page->isTemplate = true;
+        $page->reference = 'test page';
+        $page->addComponentGroup($componentGroup);
+        $this->timestampedHelper->persistTimestampedFields($page, true);
+        $this->manager->persist($page);
+
+        $dummyComponent = $this->thereIsADummyComponent();
+
+        $pageData = new PageDataWithComponent();
+        $pageData->component = $dummyComponent;
+        $pageData->page = $page;
+        $this->timestampedHelper->persistTimestampedFields($pageData, true);
+        $this->manager->persist($pageData);
+        $this->restContext->resources['page_data'] = $this->iriConverter->getIriFromResource($pageData);
+
+        $route = new Route();
+        $route->setPath($path)->setName($path)->setPageData($pageData);
+        $this->timestampedHelper->persistTimestampedFields($route, true);
+        $this->manager->persist($route);
+        $this->restContext->resources['page_data_route'] = $this->iriConverter->getIriFromResource($route);
+
+        $this->manager->flush();
+        $this->manager->clear();
+    }
+
     /**
      * @Given there is a PageData resource with the route path :childPath nested within the route :parentPath
      */

features/main/component_groups.feature

@@ -134,6 +134,13 @@ Feature: ComponentGroup resource
     Then the response status code should be 200
     And the JSON node "component" should be null
 
+  Scenario: An allowed pageDataProperty position in a restricted group returns the component for anonymous users
+    Given there is a pageDataProperty position with an allowed component type in a restricted group with route "/test-page"
+    And I add "path" header equal to "/test-page"
+    When I send a "GET" request to the resource "position_0"
+    Then the response status code should be 200
+    And the JSON node "component" should match the regex "/\/component\/dummy_components\/[a-z0-9\-]+/"
+
   @loginAdmin
   Scenario: Sending a PHP class name as allowedComponents is normalised to a collection IRI
     Given there is a ComponentGroup with 0 components

features/main/route.feature

@@ -214,6 +214,12 @@ Feature: Route resources
     Then the response status code should be 200
     And the JSON node "resource_iris[0][5]" should match the regex "/\/component\/dummy_components\/[a-z0-9\-]+/"
 
+  Scenario: The manifest includes component IRIs from allowedComponents-restricted pageDataProperty positions for anonymous users
+    Given there is a pageDataProperty position with an allowed component type in a restricted group with route "/my-route"
+    When I send a "GET" request to "/_/resource_manifest//my-route"
+    Then the response status code should be 200
+    And the JSON node "resource_iris[0][5]" should match the regex "/\/component\/dummy_components\/[a-z0-9\-]+/"
+
   Scenario: The manifest for a nested PageData route includes parent resource IRIs grouped by depth
     Given there is a PageData resource with the route path "/conference/programme" nested within the route "/conference"
     When I send a "GET" request to "/_/resource_manifest//conference/programme"

src/Serializer/Normalizer/ComponentPositionNormalizer.php

@@ -16,6 +16,7 @@
 use ApiPlatform\Metadata\UrlGeneratorInterface;
 use Doctrine\ORM\Mapping\ClassMetadata;
 use Doctrine\Persistence\ManagerRegistry;
+use Doctrine\Persistence\Proxy;
 use Silverback\ApiComponentsBundle\DataProvider\PageDataProvider;
 use Silverback\ApiComponentsBundle\Entity\Core\AbstractComponent;
 use Silverback\ApiComponentsBundle\Entity\Core\ComponentPosition;
@@ -194,7 +195,7 @@ private function normalizeForPageData(ComponentPosition $object, array $context)
 
         // skip if the resolved component type is not in the group's allowedComponents
         if ($object->componentGroup && null !== $object->componentGroup->allowedComponents) {
-            $resourceClass = $component::class;
+            $resourceClass = $component instanceof Proxy ? get_parent_class($component) : $component::class;
             $iri = $this->iriConverter->getIriFromResource(
                 $resourceClass,
                 UrlGeneratorInterface::ABS_PATH,