Merge Mercure subscription scoping (#98) from worktree

Author: silverbackdan

CLAUDE.md

@@ -590,11 +590,9 @@ Related Nuxt module issue: `components-web-app/cwa-nuxt-module#151`.
 
 ---
 
-### #98 — Mercure subscriptions not secured
+### ~~#98 — Mercure subscriptions not secured~~ — COMPLETE ✓
 
-Hub subscription tokens are not currently scoped — any subscriber can receive updates for any resource. The gist linked in the issue (`soyuka/5deae36cf0fa348c4225985f6a073efe`) shows the pattern for scoping Mercure JWT tokens to specific topics.
-
-**Relevant code:** `src/Mercure/MercureAuthorization.php` and `PublishableAwareHub`. The fix requires generating subscriber tokens that include only the topic IRIs the current user is authorised to receive. Add a bundle config option (list of resource classes to secure, or a flag to secure all) and generate scoped tokens on login/auth.
+**Fixed (commit `5ec68934`):** Added `mercure.secure_subscriptions: bool` config option (default: `false`). When `true`, `MercureAuthorization.getSubscribeIrisForResource()` evaluates each resource's AP4 security expression before including it in the subscriber JWT token. Class-level expressions (e.g. `is_granted('ROLE_ADMIN')`) are evaluated against the current user. Expressions referencing `object` (item-level security) are treated as always-accessible because access cannot be determined without a concrete instance. `DummySecuredMercureResource` test entity (ROLE_ADMIN, mercure: true) and three Behat scenarios in `features/user/security.feature` cover: excluded for non-admin, included for admin, excluded for anonymous. Test config sets `secure_subscriptions: true`.
 
 ---
 

features/bootstrap/JsonContext.php

@@ -187,6 +187,48 @@ public function theMercureCookieShouldContainDraftResources()
         Assert::assertGreaterThan(0, $this->getMercureCookieDraftTopics(), 'The cookie does not allow a user to subscribe to any draft resources');
     }
 
+    private function getMercureCookieSubscribeTopics(): array
+    {
+        $responseHeaders = $this->jsonContext->getSession()->getResponseHeaders();
+        $setCookieHeaders = $responseHeaders['set-cookie'];
+        foreach ($setCookieHeaders as $setCookieHeader) {
+            $cookie = Cookie::fromString($setCookieHeader);
+            $realName = $cookie->getName();
+            if ('mercureAuthorization' === $realName) {
+                $token = $this->jwsProvider->load($cookie->getValue());
+                $payload = $token->getPayload();
+
+                return $payload['mercure']['subscribe'] ?? [];
+            }
+        }
+
+        return [];
+    }
+
+    /**
+     * @Then the mercure cookie should contain topics matching :pattern
+     */
+    public function theMercureCookieShouldContainTopicsMatching(string $pattern): void
+    {
+        $topics = $this->getMercureCookieSubscribeTopics();
+        $matched = array_filter($topics, static function ($topic) use ($pattern) {
+            return 1 === preg_match($pattern, $topic);
+        });
+        Assert::assertNotEmpty($matched, \sprintf('The mercure cookie does not contain any topics matching "%s". Topics: %s', $pattern, implode(', ', $topics)));
+    }
+
+    /**
+     * @Then the mercure cookie should not contain topics matching :pattern
+     */
+    public function theMercureCookieShouldNotContainTopicsMatching(string $pattern): void
+    {
+        $topics = $this->getMercureCookieSubscribeTopics();
+        $matched = array_filter($topics, static function ($topic) use ($pattern) {
+            return 1 === preg_match($pattern, $topic);
+        });
+        Assert::assertEmpty($matched, \sprintf('The mercure cookie contains topics matching "%s" but should not. Topics: %s', $pattern, implode(', ', $topics)));
+    }
+
     private function getCookieByName(string $name): Cookie
     {
         $responseHeaders = $this->jsonContext->getSession()->getResponseHeaders();

features/user/security.feature

@@ -161,3 +161,35 @@ Feature: Prevent disabled users from logging in
     }
     """
     Then the response status code should be 404
+
+  Scenario: With secure_subscriptions enabled, a non-admin user's mercure cookie excludes admin-only resource topics
+    Given there is a user with the username "user" password "password" and role "ROLE_USER"
+    When I send a "POST" request to "/login" with body:
+    """
+    {
+      "username": "user",
+      "password": "password"
+    }
+    """
+    Then the response status code should be 204
+    And the response should have a "mercureAuthorization" cookie
+    And the mercure cookie should not contain topics matching "/dummy_secured_mercure_resource/"
+
+  Scenario: With secure_subscriptions enabled, an admin user's mercure cookie includes admin-only resource topics
+    Given there is a user with the username "admin" password "password" and role "ROLE_ADMIN"
+    When I send a "POST" request to "/login" with body:
+    """
+    {
+      "username": "admin",
+      "password": "password"
+    }
+    """
+    Then the response status code should be 204
+    And the response should have a "mercureAuthorization" cookie
+    And the mercure cookie should contain topics matching "/dummy_secured_mercure_resource/"
+
+  Scenario: With secure_subscriptions enabled, an anonymous user's mercure cookie excludes admin-only resource topics
+    When I send a "GET" request to "/me"
+    Then the response status code should be 401
+    And the response should have a "mercureAuthorization" cookie
+    And the mercure cookie should not contain topics matching "/dummy_secured_mercure_resource/"

src/DependencyInjection/Configuration.php

@@ -51,6 +51,10 @@ private function addMercureNode(ArrayNodeDefinition $rootNode): void
                     ->addDefaultsIfNotSet()
                     ->children()
                         ->scalarNode('hub_name')->defaultNull()->end()
+                        ->booleanNode('secure_subscriptions')
+                            ->defaultFalse()
+                            ->info('When true, subscriber JWT tokens only include topics for resources the current user can access. Requires class-level security expressions (i.e. no "object" variable) on API operations to be evaluated at subscription time.')
+                        ->end()
                         ->arrayNode('cookie')
                             ->addDefaultsIfNotSet()
                             ->children()

src/DependencyInjection/SilverbackApiComponentsExtension.php

@@ -162,6 +162,7 @@ public function load(array $configs, ContainerBuilder $container): void
         $definition = $container->findDefinition(MercureAuthorization::class);
         $definition->setArgument('$cookieSameSite', $config['mercure']['cookie']['samesite']);
         $definition->setArgument('$hubName', $config['mercure']['hub_name']);
+        $definition->setArgument('$secureSubscriptions', $config['mercure']['secure_subscriptions']);
     }
 
     private function setEmailVerificationArguments(ContainerBuilder $container, array $emailVerificationConfig, int $passwordRepeatTtl): void

src/Mercure/MercureAuthorization.php

@@ -18,10 +18,13 @@
 use ApiPlatform\Metadata\Resource\Factory\ResourceNameCollectionFactoryInterface;
 use Silverback\ApiComponentsBundle\Annotation\Publishable;
 use Silverback\ApiComponentsBundle\Helper\Publishable\PublishableStatusChecker;
+use Symfony\Component\ExpressionLanguage\Expression;
 use Symfony\Component\HttpFoundation\Cookie;
 use Symfony\Component\HttpFoundation\RequestStack;
 use Symfony\Component\Mercure\Authorization;
 use Symfony\Component\Routing\RequestContext;
+use Symfony\Component\Security\Core\Authorization\AuthorizationCheckerInterface;
+use Symfony\Component\Security\Core\Exception\AuthenticationCredentialsNotFoundException;
 
 class MercureAuthorization
 {
@@ -32,8 +35,10 @@ public function __construct(
         private readonly RequestContext $requestContext,
         private readonly Authorization $mercureAuthorization,
         private readonly RequestStack $requestStack,
+        private readonly AuthorizationCheckerInterface $authorizationChecker,
         private readonly string $cookieSameSite = Cookie::SAMESITE_STRICT,
         private readonly ?string $hubName = null,
+        private readonly bool $secureSubscriptions = false,
     ) {
     }
 
@@ -71,6 +76,10 @@ private function getSubscribeIrisForResource(string $resourceClass): ?array
             return null;
         }
 
+        if ($this->secureSubscriptions && !$this->isOperationAccessible($operation)) {
+            return null;
+        }
+
         $refl = new \ReflectionClass($operation->getClass());
         $isPublishable = \count($refl->getAttributes(Publishable::class));
 
@@ -89,6 +98,42 @@ private function getSubscribeIrisForResource(string $resourceClass): ?array
         return $subscribeIris;
     }
 
+    /**
+     * Evaluates the operation's security expression at the class level (no object context).
+     * Returns true if accessible, false if denied.
+     * Returns true when no security expression is set (resource is publicly accessible).
+     * Returns true when the expression references the `object` variable — these are item-level
+     * security expressions that cannot be evaluated without a concrete instance. Since some items
+     * of the resource may be accessible, the subscription topic is included.
+     */
+    private function isOperationAccessible(HttpOperation $operation): bool
+    {
+        $security = $operation->getSecurity();
+
+        if (null === $security) {
+            return true;
+        }
+
+        $securityStr = (string) $security;
+
+        // Item-level security expressions reference `object` (the specific entity instance).
+        // At subscription time we have no instance, so we cannot determine class-level access.
+        // Include the topic: some instances of this resource may be accessible.
+        if (preg_match('/\bobject\b/', $securityStr)) {
+            return true;
+        }
+
+        try {
+            return $this->authorizationChecker->isGranted(new Expression($securityStr));
+        } catch (AuthenticationCredentialsNotFoundException) {
+            return false;
+        } catch (\Throwable) {
+            // Expression evaluation failed for an unexpected reason.
+            // Treat as accessible to avoid accidentally blocking legitimate subscribers.
+            return true;
+        }
+    }
+
     private function getMercureResourceOperation(string $resourceClass): ?HttpOperation
     {
         $resourceMetadataCollection = $this->resourceMetadataCollectionFactory->create($resourceClass);

src/Resources/config/services.php

@@ -760,7 +760,10 @@
                 new Reference('router.request_context'),
                 new Reference(Authorization::class),
                 new Reference('request_stack'),
-                '', // injected with dependency injection
+                new Reference(AuthorizationCheckerInterface::class),
+                '', // $cookieSameSite — injected via DI
+                null, // $hubName — injected via DI
+                false, // $secureSubscriptions — injected via DI
             ]
         );
     $services->alias(MercureAuthorization::class, 'silverback.api_components.mercure.authorization');

tests/Functional/TestBundle/Entity/DummySecuredMercureResource.php

@@ -0,0 +1,28 @@
+<?php
+
+/*
+ * This file is part of the Silverback API Components Bundle Project
+ *
+ * (c) Daniel West <daniel@silverback.is>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Silverback\ApiComponentsBundle\Tests\Functional\TestBundle\Entity;
+
+use ApiPlatform\Metadata\ApiResource;
+use Doctrine\ORM\Mapping as ORM;
+use Silverback\ApiComponentsBundle\Entity\Utility\IdTrait;
+
+/**
+ * A mercure-enabled resource with ROLE_ADMIN security, used to test secure_subscriptions.
+ *
+ * @author Daniel West <daniel@silverback.is>
+ */
+#[ApiResource(mercure: true, security: "is_granted('ROLE_ADMIN')")]
+#[ORM\Entity]
+class DummySecuredMercureResource
+{
+    use IdTrait;
+}

tests/Functional/app/config/packages/silverback_api_components.yaml

@@ -27,6 +27,8 @@ silverback_api_components:
                 default_redirect_path: /confirm-new-email/{{ username }}/{{ new_email }}/{{ token }}
     publishable:
         permission: "is_granted('ROLE_ADMIN')"
+    mercure:
+        secure_subscriptions: true
     route_security:
         - { route: "/user-area*", security: "is_granted('ROLE_USER')" }
     routable_security: "is_granted('ROLE_ADMIN')"