fix(flow-php/symfony-telemetry-bundle): read the security token without marking the session as used

composer.json

@@ -79,6 +79,7 @@
         "symfony/property-access": "^6.4 || ^7.4 || ^8.0",
         "symfony/property-info": "^6.4 || ^7.4 || ^8.0",
         "symfony/routing": "^6.4 || ^7.4 || ^8.0",
+        "symfony/security-bundle": "^6.4 || ^7.4 || ^8.0",
         "symfony/security-core": "^6.4 || ^7.4 || ^8.0",
         "symfony/security-http": "^6.4 || ^7.4 || ^8.0",
         "symfony/serializer": "^6.4 || ^7.4 || ^8.0",

documentation/components/bridges/symfony-telemetry-bundle.md

@@ -1274,6 +1274,10 @@ already-authenticated requests and mid-request logins are covered. Each field is
 configurable; `email` is taken from the configured getter and skipped when the method is missing or returns a
 non-scalar. Anonymous requests are left untouched.
 
+The token is read from `security.untracked_token_storage` and only when the request carries a span, so instrumentation
+never marks the session as used and never turns a cacheable response into `Cache-Control: private` behind a lazy
+firewall.
+
 To attach application-specific attributes, implement `UserSpanAttributeProvider` and tag the service (the tag is
 autoconfigured). Returned attributes are merged onto the request span and win on key collision:
 

src/bridge/symfony/telemetry-bundle/composer.json

@@ -37,6 +37,7 @@
         "symfony/framework-bundle": "^6.4 || ^7.4 || ^8.0",
         "symfony/messenger": "^6.4 || ^7.4 || ^8.0",
         "symfony/routing": "^6.4 || ^7.4 || ^8.0",
+        "symfony/security-bundle": "^6.4 || ^7.4 || ^8.0",
         "symfony/security-core": "^6.4 || ^7.4 || ^8.0",
         "symfony/security-http": "^6.4 || ^7.4 || ^8.0",
         "symfony/serializer": "^6.4 || ^7.4 || ^8.0",

src/bridge/symfony/telemetry-bundle/src/Flow/Bridge/Symfony/TelemetryBundle/Instrumentation/Security/SecuritySpanSubscriber.php

@@ -8,7 +8,6 @@
 use Flow\Telemetry\Tracer\Span;
 use SensitiveParameter;
 use Symfony\Component\EventDispatcher\EventSubscriberInterface;
-use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Event\ControllerEvent;
 use Symfony\Component\HttpKernel\KernelEvents;
 use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
@@ -39,27 +38,36 @@ public static function getSubscribedEvents(): array
 
     public function onController(ControllerEvent $event): void
     {
+        // @mago-expect analysis:mixed-assignment
+        if (
+            !($span = $event->getRequest()->attributes->get(HttpKernelSpanSubscriber::SPAN_ATTRIBUTE)) instanceof Span
+        ) {
+            return;
+        }
+
         $token = $this->tokenStorage->getToken();
 
         if ($token === null) {
             return;
         }
 
-        $this->decorate($event->getRequest(), $token);
+        $this->decorate($span, $token);
     }
 
     public function onLoginSuccess(LoginSuccessEvent $event): void
-    {
-        $this->decorate($event->getRequest(), $event->getAuthenticatedToken());
-    }
-
-    private function decorate(Request $request, #[SensitiveParameter] TokenInterface $token): void
     {
         // @mago-expect analysis:mixed-assignment
-        if (!($span = $request->attributes->get(HttpKernelSpanSubscriber::SPAN_ATTRIBUTE)) instanceof Span) {
+        if (
+            !($span = $event->getRequest()->attributes->get(HttpKernelSpanSubscriber::SPAN_ATTRIBUTE)) instanceof Span
+        ) {
             return;
         }
 
+        $this->decorate($span, $event->getAuthenticatedToken());
+    }
+
+    private function decorate(Span $span, #[SensitiveParameter] TokenInterface $token): void
+    {
         foreach ($this->resolver->resolve($token) as $key => $value) {
             $span->setAttribute($key, $value);
         }

src/bridge/symfony/telemetry-bundle/src/Flow/Bridge/Symfony/TelemetryBundle/Resources/config/instrumentation/security.php

@@ -23,7 +23,7 @@
     $services
         ->set('flow.telemetry.security.span_subscriber', SecuritySpanSubscriber::class)
         ->args([
-            service('security.token_storage'),
+            service('security.untracked_token_storage'),
             service('flow.telemetry.security.user_attribute_resolver'),
         ])
         ->tag('kernel.event_subscriber');

src/bridge/symfony/telemetry-bundle/tests/Flow/Bridge/Symfony/TelemetryBundle/Tests/Fixtures/Controller/TestController.php

@@ -11,6 +11,15 @@
 
 final class TestController
 {
+    public function cacheable(): Response
+    {
+        $response = new JsonResponse(['status' => 'ok']);
+        $response->setPublic();
+        $response->setMaxAge(3600);
+
+        return $response;
+    }
+
     public function error(): Response
     {
         return new JsonResponse(['error' => 'not found'], 404);

src/bridge/symfony/telemetry-bundle/tests/Flow/Bridge/Symfony/TelemetryBundle/Tests/Fixtures/Security/SpyTokenStorage.php

@@ -0,0 +1,36 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Flow\Bridge\Symfony\TelemetryBundle\Tests\Fixtures\Security;
+
+use SensitiveParameter;
+use Symfony\Component\Security\Core\Authentication\Token\Storage\TokenStorageInterface;
+use Symfony\Component\Security\Core\Authentication\Token\TokenInterface;
+
+final class SpyTokenStorage implements TokenStorageInterface
+{
+    private int $reads = 0;
+
+    public function __construct(
+        #[SensitiveParameter]
+        private ?TokenInterface $token = null,
+    ) {}
+
+    public function getToken(): ?TokenInterface
+    {
+        $this->reads++;
+
+        return $this->token;
+    }
+
+    public function reads(): int
+    {
+        return $this->reads;
+    }
+
+    public function setToken(#[SensitiveParameter] ?TokenInterface $token): void
+    {
+        $this->token = $token;
+    }
+}