From 9971798be32b9c27ef551028f40c8086b8c67433 Mon Sep 17 00:00:00 2001
From: Florent Morselli <florent.morselli@spomky-labs.com>
Date: Thu, 6 Aug 2026 23:17:18 +0200
Subject: [PATCH] fix(bundle): alias the nested token services with their own
 class

The nested token sources registered their autowiring alias against the
class of the configuration source itself instead of the class of the
service they create, so nothing could ever be autowired through
`Jose\Component\NestedToken\NestedTokenLoader $<name>NestedTokenLoader`
or its builder counterpart.

A test walks every autowiring alias the bundle registers and checks that
the aliased service is an instance of the aliased type, so the twelve
other sources are covered as well.
---
 .../Source/NestedToken/NestedTokenBuilder.php |  6 +-
 .../Source/NestedToken/NestedTokenLoader.php  |  6 +-
 .../Functional/AutowiringAliasesTest.php      | 83 +++++++++++++++++++
 .../NestedToken/NestedTokenBuilderTest.php    | 18 ++++
 .../NestedToken/NestedTokenLoaderTest.php     | 18 ++++
 .../TestBundle/Resources/config/services.php  |  5 ++
 .../Service/NestedTokenServiceConsumer.php    | 31 +++++++
 7 files changed, 165 insertions(+), 2 deletions(-)
 create mode 100644 tests/Bundle/JoseFramework/Functional/AutowiringAliasesTest.php
 create mode 100644 tests/Bundle/JoseFramework/TestBundle/Service/NestedTokenServiceConsumer.php

diff --git a/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenBuilder.php b/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenBuilder.php
index b5c5c7568..4828c44e5 100644
--- a/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenBuilder.php
+++ b/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenBuilder.php
@@ -42,7 +42,11 @@ public function load(array $configs, ContainerBuilder $container): void
                 $definition->addTag($id, $attributes);
             }
             $container->setDefinition($service_id, $definition);
-            $container->registerAliasForArgument($service_id, self::class, $name . 'NestedTokenBuilder');
+            $container->registerAliasForArgument(
+                $service_id,
+                NestedTokenBuilderService::class,
+                $name . 'NestedTokenBuilder'
+            );
         }
     }
 
diff --git a/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenLoader.php b/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenLoader.php
index 25283cb96..b233d4843 100644
--- a/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenLoader.php
+++ b/src/Bundle/DependencyInjection/Source/NestedToken/NestedTokenLoader.php
@@ -44,7 +44,11 @@ public function load(array $configs, ContainerBuilder $container): void
                 $definition->addTag($id, $attributes);
             }
             $container->setDefinition($service_id, $definition);
-            $container->registerAliasForArgument($service_id, self::class, $name . 'NestedTokenLoader');
+            $container->registerAliasForArgument(
+                $service_id,
+                NestedTokenLoaderService::class,
+                $name . 'NestedTokenLoader'
+            );
         }
     }
 
diff --git a/tests/Bundle/JoseFramework/Functional/AutowiringAliasesTest.php b/tests/Bundle/JoseFramework/Functional/AutowiringAliasesTest.php
new file mode 100644
index 000000000..5df6d7704
--- /dev/null
+++ b/tests/Bundle/JoseFramework/Functional/AutowiringAliasesTest.php
@@ -0,0 +1,83 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Jose\Tests\Bundle\JoseFramework\Functional;
+
+use Jose\Bundle\JoseFramework\JoseFrameworkBundle;
+use Jose\Component\NestedToken\NestedTokenBuilder;
+use Jose\Component\NestedToken\NestedTokenLoader;
+use PHPUnit\Framework\Attributes\DataProvider;
+use PHPUnit\Framework\Attributes\Test;
+use PHPUnit\Framework\TestCase;
+use Symfony\Component\DependencyInjection\ContainerBuilder;
+use Symfony\Component\Yaml\Yaml;
+use function explode;
+use function is_a;
+use function iterator_to_array;
+use function sprintf;
+use function str_contains;
+use function str_starts_with;
+
+/**
+ * The bundle registers an autowiring alias for every service it creates from the configuration. The nested token
+ * sources used to alias their own class - the class of the configuration source - instead of the class of the service
+ * they create, so nothing could ever be autowired through those aliases.
+ *
+ * @internal
+ */
+final class AutowiringAliasesTest extends TestCase
+{
+    #[Test]
+    #[DataProvider('autowiringAliases')]
+    public function theAliasedServiceIsAnInstanceOfTheAliasedType(
+        string $type,
+        string $serviceId,
+        string $class
+    ): void {
+        static::assertTrue(
+            is_a($class, $type, true),
+            sprintf('The service "%s" is a "%s" and cannot be autowired as a "%s".', $serviceId, $class, $type)
+        );
+    }
+
+    #[Test]
+    public function theNestedTokenServicesAreAliasedWithTheClassOfTheServiceTheyCreate(): void
+    {
+        $aliases = iterator_to_array(self::autowiringAliases());
+
+        static::assertArrayHasKey(
+            NestedTokenLoader::class . ' $nestedTokenLoader1NestedTokenLoader',
+            $aliases
+        );
+        static::assertArrayHasKey(
+            NestedTokenBuilder::class . ' $nestedTokenBuilder1NestedTokenBuilder',
+            $aliases
+        );
+    }
+
+    /**
+     * @return iterable<string, array{string, string, string}>
+     */
+    public static function autowiringAliases(): iterable
+    {
+        $container = new ContainerBuilder();
+        $container->setParameter('kernel.debug', false);
+        (new JoseFrameworkBundle())->getContainerExtension()
+            ->load([Yaml::parseFile(__DIR__ . '/../config/config_test.yml')['jose']], $container);
+
+        foreach ($container->getAliases() as $id => $alias) {
+            if (str_starts_with($id, '.') || ! str_contains($id, ' $')) {
+                continue;
+            }
+            $serviceId = (string) $alias;
+
+            yield $id => [
+                explode(' $', $id, 2)[0],
+                $serviceId,
+                $container->findDefinition($serviceId)
+                    ->getClass() ?? '',
+            ];
+        }
+    }
+}
diff --git a/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenBuilderTest.php b/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenBuilderTest.php
index 09c9615c8..748da453f 100644
--- a/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenBuilderTest.php
+++ b/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenBuilderTest.php
@@ -7,6 +7,7 @@
 use Jose\Bundle\JoseFramework\Services\NestedTokenBuilderFactory;
 use Jose\Component\Core\JWK;
 use Jose\Component\NestedToken\NestedTokenBuilder;
+use Jose\Tests\Bundle\JoseFramework\TestBundle\Service\NestedTokenServiceConsumer;
 use Jose\Tests\Bundle\JoseFramework\WebTestCase;
 use PHPUnit\Framework\Attributes\Test;
 
@@ -45,6 +46,23 @@ public static function theNestedTokenBuilderFromTheConfigurationHelperIsAvailabl
         static::assertTrue($container->has('jose.nested_token_builder.nested_token_builder_2'));
     }
 
+    #[Test]
+    public static function theNestedTokenBuilderFromTheConfigurationCanBeAutowired(): void
+    {
+        static::ensureKernelShutdown();
+        $client = static::createClient();
+        $container = $client->getContainer();
+        static::assertNotNull($container);
+
+        /** @var NestedTokenServiceConsumer $consumer */
+        $consumer = $container->get(NestedTokenServiceConsumer::class);
+
+        static::assertSame(
+            $container->get('jose.nested_token_builder.nested_token_builder_1'),
+            $consumer->getBuilder()
+        );
+    }
+
     #[Test]
     public static function aNestedTokenCanBeSignedAndEncryptedUsingTheServiceCreatedFromTheConfiguration(): void
     {
diff --git a/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenLoaderTest.php b/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenLoaderTest.php
index 146e5244f..6f0c5ddda 100644
--- a/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenLoaderTest.php
+++ b/tests/Bundle/JoseFramework/Functional/NestedToken/NestedTokenLoaderTest.php
@@ -8,6 +8,7 @@
 use Jose\Component\Core\JWK;
 use Jose\Component\Core\JWKSet;
 use Jose\Component\NestedToken\NestedTokenLoader;
+use Jose\Tests\Bundle\JoseFramework\TestBundle\Service\NestedTokenServiceConsumer;
 use Jose\Tests\Bundle\JoseFramework\WebTestCase;
 use PHPUnit\Framework\Attributes\Test;
 
@@ -46,6 +47,23 @@ public static function theNestedTokenLoaderFromTheConfigurationHelperIsAvailable
         static::assertTrue($container->has('jose.nested_token_loader.nested_token_loader_2'));
     }
 
+    #[Test]
+    public static function theNestedTokenLoaderFromTheConfigurationCanBeAutowired(): void
+    {
+        static::ensureKernelShutdown();
+        $client = static::createClient();
+        $container = $client->getContainer();
+        static::assertNotNull($container);
+
+        /** @var NestedTokenServiceConsumer $consumer */
+        $consumer = $container->get(NestedTokenServiceConsumer::class);
+
+        static::assertSame(
+            $container->get('jose.nested_token_loader.nested_token_loader_1'),
+            $consumer->getLoader()
+        );
+    }
+
     #[Test]
     public static function aNestedTokenCanBeDecryptedAndVerifiedUsingTheServiceCreatedFromTheConfiguration(): void
     {
diff --git a/tests/Bundle/JoseFramework/TestBundle/Resources/config/services.php b/tests/Bundle/JoseFramework/TestBundle/Resources/config/services.php
index 5eeef8c84..54dfe7231 100644
--- a/tests/Bundle/JoseFramework/TestBundle/Resources/config/services.php
+++ b/tests/Bundle/JoseFramework/TestBundle/Resources/config/services.php
@@ -3,6 +3,7 @@
 declare(strict_types=1);
 
 use Jose\Tests\Bundle\JoseFramework\TestBundle\Checker\CustomChecker;
+use Jose\Tests\Bundle\JoseFramework\TestBundle\Service\NestedTokenServiceConsumer;
 use Psr\Clock\ClockInterface;
 use Symfony\Component\Clock\NativeClock;
 use Symfony\Component\DependencyInjection\Loader\Configurator\ContainerConfigurator;
@@ -25,4 +26,8 @@
     $container->set(ClockInterface::class)
         ->class(NativeClock::class)
     ;
+
+    $container->set(NestedTokenServiceConsumer::class)
+        ->public()
+    ;
 };
diff --git a/tests/Bundle/JoseFramework/TestBundle/Service/NestedTokenServiceConsumer.php b/tests/Bundle/JoseFramework/TestBundle/Service/NestedTokenServiceConsumer.php
new file mode 100644
index 000000000..672ae751e
--- /dev/null
+++ b/tests/Bundle/JoseFramework/TestBundle/Service/NestedTokenServiceConsumer.php
@@ -0,0 +1,31 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Jose\Tests\Bundle\JoseFramework\TestBundle\Service;
+
+use Jose\Component\NestedToken\NestedTokenBuilder;
+use Jose\Component\NestedToken\NestedTokenLoader;
+
+/**
+ * Receives the nested token services of the configuration through the autowiring aliases registered by the bundle. The
+ * container cannot be compiled unless those aliases refer to the classes of the services.
+ */
+final readonly class NestedTokenServiceConsumer
+{
+    public function __construct(
+        private NestedTokenLoader $nestedTokenLoader1NestedTokenLoader,
+        private NestedTokenBuilder $nestedTokenBuilder1NestedTokenBuilder
+    ) {
+    }
+
+    public function getLoader(): NestedTokenLoader
+    {
+        return $this->nestedTokenLoader1NestedTokenLoader;
+    }
+
+    public function getBuilder(): NestedTokenBuilder
+    {
+        return $this->nestedTokenBuilder1NestedTokenBuilder;
+    }
+}