Merge main into fix/574-trim-identifier

Author: silverbackdan

CHANGELOG.md

@@ -4,7 +4,12 @@ Every change that reaches `main` adds a line under **Unreleased**. When a versio
 
 ## Unreleased
 
+### Added
+- `emails.logo` (a Twig path, default the bundle's logo) and `emails.logo_width` (pixels, optional) set the logo at the top of every email the bundle sends, whose alt text is now the `website_name` instead of `Logo` ([#576](https://github.com/components-web-app/api-components-bundle/pull/576))
+
 ### Fixed
+- A user referenced by IRI from another resource's write is no longer processed as a new registration, which reset their `emailAddressVerified` ([#575](https://github.com/components-web-app/api-components-bundle/pull/575))
+- A `plainPassword` set through the API is validated (6 to 4096 characters, 422 on `plainPassword`) before it is hashed, and setting a password no longer marks the email address verified; only a password reset does ([#577](https://github.com/components-web-app/api-components-bundle/pull/577))
 - User lookups trim the identifier, so a username or email address with a trailing space (a mobile keyboard's) still signs in and still finds the user for password reset and resend verification ([#578](https://github.com/components-web-app/api-components-bundle/pull/578))
 
 ## [2.0.0-alpha.39](https://github.com/components-web-app/api-components-bundle/compare/2.0.0-alpha.38...2.0.0-alpha.39) - 2026-10-30

CLAUDE.md

@@ -295,9 +295,12 @@ Resources are fetched and cached **individually**. Never embed related data outs
 ### Security and users
 
 - **A `PUT` on a user merges, never replaces** (#426). API Platform's `standard_put` defaults to `true` on 4.x and 5.x: the body is denormalized into a new object and every property is copied onto the stored one, including those nobody can write (password hash, tokens), so they took the constructor's defaults. `UserResourceMetadataCollectionFactory` sets `standard_put: false` on every `Put` of an `AbstractUser`, over any application default. `User\UserPutTest` pins it.
+- **`UserNormalizer` handles only a user payload (an array)** (#572). A user referenced by IRI from another resource's write reaches the serializer as a string; running `processChanges()` on it treated the stored user as a new registration and reset `emailAddressVerified`. `User\UserReferenceTest` pins it.
+- **A plain password is hashed only after validation, and never verifies the email address** (#570). `UserDataProcessor::processChanges()` does not hash: the API hashes in `UserPasswordStateProcessor` (on `state_processor.locator`, before the persist) and the form listener after `processChanges()`, so the `plainPassword` `Length` (in `Default` as well as `User:password:create`) sees the value on API writes; hashed during denormalization, it was already erased. Only a password reset, which proves the inbox, sets `emailAddressVerified`. `User\UserPasswordTest` pins it.
 - **User email links** (#316): `RefererUrlResolver` uses `Origin`, else `Referer`, reduced to `scheme://host[:port]`, only if it matches `user.email_links.allowed_origins` (anchored by the bundle as `{\A(?:p)\z}i`), else `default_origin`, else the link is refused. The request host is not implicitly trusted. Request input may only be a `RelativeUrlPath`. **Never build an outbound link from a request header without an allow-list.**
 - **A refused email link depends on which kind of email it is** (#326). Where the email is the job (password reset, both resends), the request is a 400 that changes nothing: build and send the email before flushing the token it carries. After a completed write (every email from `UserWriteNotifier::notify()`), the write keeps its status and `UserMailer::afterWrite()` logs the refusal at error; the verify and change-email emails serve both kinds, so the notifier must call their `…AfterWrite` variants. Only `UnparseableRequestHeaderException` is caught.
 - **A throttled email request is a 429 with `Retry-After`** (#331), never a 200 that sends nothing. `UserDataProcessor` throws `RequestLimitReachedException` carrying the seconds remaining; the action returns it with nothing sent or changed. Each flow has its own `repeat_ttl_seconds`: `password_reset` (86400), `new_email_confirmation` (300) and `email_verification` (300). Never share one throttle between flows.
+- **Every bundle email extends `emails/_template.html.twig`, so every sender's context carries `website_name`, `email_logo` and `email_logo_width`** (`SilverbackApiComponentsExtension::emailContext()`, #573). `emails.logo` is a Twig path, because `email.image()` loads it through the Twig loader; a filesystem path fails. **Find an embedded image from the `<img>`, never by attachment name**: twig-bridge 7.3 (the lowest-dependency legs) names the part with the whole Twig path and writes `cid:<that path>`, 7.4+ uses the basename and a generated content id, and the lowest CSS inliner puts the element's own `style` before the inlined rules. `Email\EmailLogoTest` follows the `src` to the part whose content id or filename it names.
 - **A failed send returns false whether or not a logger is wired** (#340): the logger is optional in `UserMailer`'s service locator, so check `has('logger')`; `get()` on a missing id throws.
 - **The `…RequestedAt` timestamp starts the throttle, so `UserMailer` sets it only after `send()` succeeds**, and flushes it with the token then. A failed send (503) saves nothing: the action refreshes the user, so the token is not replaced by one nobody received.
 - Actions calling `UserDataProcessor::findUserByUsername()` must catch its `InvalidArgumentException` and return 404; it throws rather than returning null.
@@ -466,7 +469,7 @@ The bundle does not set `use_symfony_listeners`. API Platform's default (`false`
 | `api_platform.state_provider.read`, negative priority, so it wraps the `security` access checkers (0, 10) | `POST_READ`, `PRE_DESERIALIZE` | deny access (-20), publishable merge (-30), component usage (-40), upload and download (-50), resource version (-60) |
 | `api_platform.state_provider.deserialize` | `POST_DESERIALIZE` | publication date guard (-10) |
 | `api_platform.state_provider.validate` | `POST_VALIDATE` | route generation (-10) |
-| `api_platform.state_processor.locator`, the persist/remove call | `PRE_WRITE` before the inner call, `POST_WRITE` after it | version conflict (5), publishable (10), user emails (15), uploadable (20), delete cascade (30), position removal (40), route redirects (50), position placement (60) |
+| `api_platform.state_processor.locator`, the persist/remove call | `PRE_WRITE` before the inner call, `POST_WRITE` after it | version conflict (5), publishable (10), user emails (15), user password hash (16), uploadable (20), delete cascade (30), position removal (40), route redirects (50), position placement (60) |
 | `api_platform.state_processor.serialize` | `PRE_SERIALIZE` | form (10), collection (20) |
 
 - **Never decorate `state_processor.write` or `state_*.main`.** In controller mode, `write`'s inner call is serialize and respond, so its "after" runs after serialization. The `main` services do not exist in listener mode.

src/DataProcessor/StateProcessor/UserPasswordStateProcessor.php

@@ -0,0 +1,42 @@
+<?php
+
+/*
+ * This file is part of the Silverback API Components Bundle Project
+ *
+ * (c) Daniel West <daniel@silverback.is>
+ *
+ * For the full copyright and license information, please view the LICENSE
+ * file that was distributed with this source code.
+ */
+
+namespace Silverback\ApiComponentsBundle\DataProcessor\StateProcessor;
+
+use ApiPlatform\Metadata\HttpOperation;
+use ApiPlatform\Metadata\Operation;
+use ApiPlatform\State\ProcessorInterface;
+use Silverback\ApiComponentsBundle\Entity\User\AbstractUser;
+use Silverback\ApiComponentsBundle\Helper\User\UserDataProcessor;
+
+/**
+ * @implements ProcessorInterface<mixed, mixed>
+ */
+final readonly class UserPasswordStateProcessor implements ProcessorInterface
+{
+    /**
+     * @param ProcessorInterface<mixed, mixed> $decorated
+     */
+    public function __construct(
+        private ProcessorInterface $decorated,
+        private UserDataProcessor $userDataProcessor,
+    ) {
+    }
+
+    public function process(mixed $data, Operation $operation, array $uriVariables = [], array $context = []): mixed
+    {
+        if ($data instanceof AbstractUser && $operation instanceof HttpOperation) {
+            $this->userDataProcessor->hashPassword($data);
+        }
+
+        return $this->decorated->process($data, $operation, $uriVariables, $context);
+    }
+}

src/DependencyInjection/Configuration.php

@@ -50,6 +50,21 @@ public function getConfigTreeBuilder(): TreeBuilder
                 ->scalarNode('website_name')->isRequired()->end()
                 ->scalarNode('table_prefix')->defaultValue('_acb_')->end()
                 ->scalarNode('metadata_key')->defaultValue('_metadata')->end()
+                ->arrayNode('emails')
+                    ->addDefaultsIfNotSet()
+                    ->children()
+                        ->scalarNode('logo')
+                            ->info('The Twig path of the logo at the top of every email the bundle sends.')
+                            ->cannotBeEmpty()
+                            ->defaultValue('@SilverbackApiComponents/assets/images/email_logo.png')
+                        ->end()
+                        ->integerNode('logo_width')
+                            ->info('The width in pixels the logo is shown at, so a 2x image renders sharp. Null shows it at its own width.')
+                            ->defaultNull()
+                            ->min(1)
+                        ->end()
+                    ->end()
+                ->end()
             ->end();
 
         $this->addMercureNode($rootNode);

src/DependencyInjection/SilverbackApiComponentsExtension.php

@@ -178,7 +178,7 @@ public function load(array $configs, ContainerBuilder $container): void
 
         $definition = $container->findDefinition(OrphanedResourcesChangedEmailFactory::class);
         $definition->setArgument('$subject', $config['orphaned_resources']['notify']['subject']);
-        $definition->setArgument('$context', ['website_name' => $config['website_name']]);
+        $definition->setArgument('$context', self::emailContext($config));
 
         $definition = $container->findDefinition(UploadableCacheControl::class);
         $definition->setArgument('$original', $config['uploadable']['cache_control']['original']);
@@ -319,15 +319,19 @@ private function setUserClassArguments(ContainerBuilder $container, string $user
         $definition->setArgument('$userClass', $userClass);
     }
 
+    private static function emailContext(array $config): array
+    {
+        return [
+            'website_name' => $config['website_name'],
+            'email_logo' => $config['emails']['logo'],
+            'email_logo_width' => $config['emails']['logo_width'],
+        ];
+    }
+
     private function setMailerServiceArguments(ContainerBuilder $container, array $config): void
     {
         $definition = $container->findDefinition(UserMailer::class);
-        $definition->setArgument(
-            '$context',
-            [
-                'website_name' => $config['website_name'],
-            ]
-        );
+        $definition->setArgument('$context', self::emailContext($config));
 
         $mapping = [
             PasswordChangedEmailFactory::class => 'password_changed',

src/Entity/User/AbstractUser.php

@@ -67,7 +67,7 @@ abstract class AbstractUser implements SymfonyUserInterface, PasswordAuthenticat
     protected string $password;
 
     #[Assert\NotBlank(message: 'Please enter your desired password.', groups: ['User:password:create'])]
-    #[Assert\Length(min: 6, max: 4096, minMessage: 'Your password must be more than 6 characters long.', maxMessage: 'Your password cannot be over 4096 characters', groups: ['User:password:create'])]
+    #[Assert\Length(min: 6, max: 4096, minMessage: 'Your password must be more than 6 characters long.', maxMessage: 'Your password cannot be over 4096 characters', groups: ['Default', 'User:password:create'])]
     #[ApiProperty(readable: false)]
     #[Groups(['User:input'])]
     protected ?string $plainPassword = null;
@@ -225,7 +225,6 @@ public function setPlainPassword(?string $plainPassword): self
     {
         $this->plainPassword = $plainPassword;
         if ($plainPassword) {
-            // Needs to update mapped field to trigger update event which will encode the plain password
             $this->passwordUpdatedAt = new \DateTime();
         }
 

src/EventListener/Form/EntityPersistFormListener.php

@@ -102,6 +102,7 @@ public function __invoke(FormSuccessEvent $event): void
             }
 
             $this->userDataProcessor->processChanges($data, $oldUser);
+            $this->userDataProcessor->hashPassword($data);
             $this->userWriteNotifier->notify($data, $oldUser);
         }
 

src/Helper/User/UserDataProcessor.php

@@ -67,14 +67,14 @@ public function passwordReset(string $username, string $token, string $newPasswo
         $user->setPlainPassword($newPassword);
         $user->setNewPasswordConfirmationToken(null);
         $user->setPasswordRequestedAt(null);
+        $user->setEmailAddressVerified(true);
         $this->hashPassword($user);
 
         return $user;
     }
 
     public function processChanges(AbstractUser $user, ?AbstractUser $previousUser): void
     {
-        $this->hashPassword($user);
         if (!$previousUser) {
             $user->setEmailAddressVerified($this->initialEmailVerifiedState);
             if (!$this->initialEmailVerifiedState && $this->verifyEmailOnRegister) {
@@ -151,14 +151,13 @@ private function setEmailAddressVerifyToken(AbstractUser $user): void
         $user->plainEmailAddressVerifyToken = $token;
     }
 
-    private function hashPassword(AbstractUser $entity): void
+    public function hashPassword(AbstractUser $entity): void
     {
         if (!$entity->getPlainPassword()) {
             return;
         }
         $encoded = $this->passwordHasher->hashPassword($entity, $entity->getPlainPassword());
         $entity->setPassword($encoded);
-        $entity->setEmailAddressVerified(true);
         $entity->eraseCredentials();
     }
 }

src/Resources/config/services.php

@@ -66,6 +66,7 @@
 use Silverback\ApiComponentsBundle\DataProcessor\StateProcessor\RouteRedirectStateProcessor;
 use Silverback\ApiComponentsBundle\DataProcessor\StateProcessor\UploadableWriteStateProcessor;
 use Silverback\ApiComponentsBundle\DataProcessor\StateProcessor\UserNotificationStateProcessor;
+use Silverback\ApiComponentsBundle\DataProcessor\StateProcessor\UserPasswordStateProcessor;
 use Silverback\ApiComponentsBundle\DataProvider\PageDataProvider;
 use Silverback\ApiComponentsBundle\DataProvider\StateProvider\ComponentGroupOrderStateProvider;
 use Silverback\ApiComponentsBundle\DataProvider\StateProvider\ComponentGroupStateProvider;
@@ -1915,6 +1916,18 @@
         );
     $services->alias(UserNotificationStateProcessor::class, 'silverback.api_components.api_platform.state_processor.user_notification');
 
+    $services
+        ->set('silverback.api_components.api_platform.state_processor.user_password')
+        ->class(UserPasswordStateProcessor::class)
+        ->decorate('api_platform.state_processor.locator', null, 16)
+        ->args(
+            [
+                new Reference('silverback.api_components.api_platform.state_processor.user_password.inner'),
+                new Reference(UserDataProcessor::class),
+            ]
+        );
+    $services->alias(UserPasswordStateProcessor::class, 'silverback.api_components.api_platform.state_processor.user_password');
+
     $services
         ->set('silverback.api_components.factory.user')
         ->class(UserFactory::class)

src/Resources/views/emails/_template.html.twig

@@ -6,7 +6,7 @@
                 <spacer size="16"></spacer>
 
                 <center>
-                    <img src="{{ email.image('@SilverbackApiComponents/assets/images/email_logo.png') }}" alt="Logo" class="logo">
+                    <img src="{{ email.image(email_logo) }}" alt="{{ website_name }}" class="logo"{% if email_logo_width %} width="{{ email_logo_width }}" style="width: {{ email_logo_width }}px"{% endif %}>
                 </center>
             </columns>
         </row>