Auth0 Reset fix for worker mode

Author: JanMikes

config/reference.php

@@ -1877,8 +1877,8 @@
  * }
  * @psalm-type MercureConfig = array{
  *     hubs?: array<string, array{ // Default: []
- *         url?: scalar|null, // URL of the hub's publish endpoint // Default: null
- *         public_url?: scalar|null, // URL of the hub's public endpoint
+ *         url?: scalar|null, // URL of the hub's publish endpoint
+ *         public_url?: scalar|null, // URL of the hub's public endpoint // Default: null
  *         jwt?: string|array{ // JSON Web Token configuration.
  *             value?: scalar|null, // JSON Web Token to use to publish to this hub.
  *             provider?: scalar|null, // The ID of a service to call to provide the JSON Web Token.

src/Query/GetRanking.php

@@ -9,8 +9,9 @@
 use SpeedPuzzling\Web\Exceptions\PlayerNotFound;
 use SpeedPuzzling\Web\Exceptions\PuzzleNotFound;
 use SpeedPuzzling\Web\Results\PlayerRanking;
+use Symfony\Contracts\Service\ResetInterface;
 
-final class GetRanking
+final class GetRanking implements ResetInterface
 {
     /** @var array<string, array<string, PlayerRanking>> */
     private array $allForPlayerCache = [];
@@ -221,4 +222,10 @@ public function ofPuzzleForPlayer(string $puzzleId, string $playerId): null|Play
 
         return $ranking;
     }
+
+    public function reset(): void
+    {
+        $this->allForPlayerCache = [];
+        $this->ofPuzzleForPlayerCache = [];
+    }
 }

src/Services/Auth0SdkResetListener.php

@@ -0,0 +1,40 @@
+<?php
+
+declare(strict_types=1);
+
+namespace SpeedPuzzling\Web\Services;
+
+use Auth0\Symfony\Service;
+use Symfony\Component\DependencyInjection\Attribute\Autowire;
+use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
+use Symfony\Component\HttpKernel\Event\RequestEvent;
+use Symfony\Component\HttpKernel\KernelEvents;
+
+/**
+ * Resets Auth0 SDK at the start of each request.
+ *
+ * This is critical for FrankenPHP worker mode where PHP processes persist between requests.
+ * Without this reset, the Auth0 SDK caches user credentials in memory, causing session leakage
+ * where one user's authentication bleeds into another user's request.
+ */
+#[AsEventListener(event: KernelEvents::REQUEST, priority: 512)]
+final class Auth0SdkResetListener
+{
+    public function __construct(
+        #[Autowire(service: 'auth0')]
+        private readonly Service $auth0Service,
+    ) {
+    }
+
+    public function __invoke(RequestEvent $event): void
+    {
+        if ($event->isMainRequest() === false) {
+            return;
+        }
+
+        // Reset Auth0 SDK to force fresh credentials check from session
+        $reflection = new \ReflectionClass($this->auth0Service);
+        $property = $reflection->getProperty('sdk');
+        $property->setValue($this->auth0Service, null);
+    }
+}