BUGFIX: ProxyBuilding minor refactor and fixes #3494

kitsunet · 2025-09-09T08:03:24Z

Props to @lorenzulrich for this correct fix, which always gets the
parent in relation to the method being called and not the parent of
the instance at hand.

Fixes: #3406

This is an overhaul of how object serialization
is prepared in proxies.

Proxies can skip object serialization code if there is nothing to
serialize, that is, if there are no entity properties, no injected, or
transient properties. We were too eager prior to this patch with
not using the serialization code, the checks are now way more detailed.
Additionally the "Proxy" Annotation now allows to force serialization
code for a class if the checks still fail to detect correctly, this
should be rarely needed.
This fix however broke some code in Neos that should have gotten the
serialization code previously but didn't. Since the class in question
is readonly, injecting a mutable property via trait resulted in
PHP errors.
Therefore we now use a mutable object to hold related entities for
serialization purposes which is declared readonly in the proxy to
avoid errors with readonly classes should they need serialization
code. Other mutable properties were removed as they are not strictly
needed. We should do the same refactoring for AOP as well.
Proxies can use the original constructor argument signature if no
constructor injection is used.
Finally prototype autowiring is now a choice via setting, currently
default enabled to not change behavior, in the future we should plan
a breaking change to disable it and then remove the option altogether.

Fixes: #3493
Related: #3212
Related: #3076

@lorenzulrich

Props to @lorenzulrich for this correct fix, which always gets the parent in relation to the method being called and not the parent of the instance at hand. Fixes: neos#3406

This allows classes without constructor injection to have a proper constructor signature.

This is an overhaul of how object serialization is prepared in proxies. Proxies can skip object serialization code if there is nothing to serialize, that is, if there are no entity properties, no injected, or transient properties. We were too eager prior to this patch with not using the serialization code, the checks are now way more detailed. Additionally the "Proxy" Annotation now allows to force serialization code for a class if the checks still fail to detect correctly, this should be rarely needed. This fix however broke some code in Neos that should have gotten the serialization code previously but didn't. Since the class in question is readonly, injecting a mutable property via trait resulted in PHP errors. Therefore we now use a mutable object to hold related entities for serialization purposes which is declared readonly in the proxy to avoid errors with readonly classes should they need serialization code. Other mutable properties were removed as they are not strictly needed. We should do the same refactoring for AOP as well. Proxies can use the original constructor argument signature if no constructor injection is used. Finally prototype autowiring is now a choice via setting, currently default enabled to not change behavior, in the future we should plan a breaking change to disable it and then remove the option altogether. Fixes: neos#3493 Related: neos#3212 Related: neos#3076

This removes occurances of constructor injection with prototypes, the modified classes are all injected via constructor and should therefore be singletons. Related: neos/flow-development-collection#3494

kitsunet · 2025-09-09T09:32:34Z

Interesting test failures... because that did work fine... Investigating...

lorenzulrich · 2025-09-11T13:37:07Z

Thanks @kitsunet. This is "above my pay grade", so thanks for taking care and finding the reason why my code works ;-).

kitsunet · 2025-09-11T16:49:25Z

Ok funny, now this PR shows one of the errors I wanted to fix in the functional tests. Why? Well because I broke something (that is if an object already has a sleep method we do not proxy anything) but intererstingly this scenario is AFAIK not happening in Flow nor Neos, nor have I seen it in any of the projects I checked. Anyways, will fix, seems like a good idea.

This removes occurances of constructor injection with prototypes, the modified classes are all injected via constructor and should therefore be singletons. Related: neos/flow-development-collection#3494

robertlemke · 2025-10-20T14:54:56Z

Some documentation for the new flag - I don't know where to put it, maybe into this PR's description? Or the manual?

When Flow generates proxy classes, it automatically detects if your class contains entity properties
(properties typed with classes annotated as @Flow\Entity) or other framework-managed objects
that require special handling during serialization. In such cases, Flow automatically generates
__sleep() and __wakeup() methods that:

Convert entity references to metadata (class name and persistence identifier) before serialization
Remove injected and transient properties
Restore entity references after deserialization

This detection is automatic and works in most cases. However, in rare edge cases where the automatic
detection fails (e.g., with complex generic types, deeply nested entity structures, or unusual type
declarations), you can force the generation of serialization code using the @Flow\Proxy annotation::

	use Neos\Flow\Annotations as Flow;

	/**
	 * @Flow\Proxy(forceSerializationCode=true)
	 */
	class ComplexObjectWithEntities {

		/**
		 * @var ComplexGenericType<SomeEntity>
		 */
		protected $complexProperty;

	}

You should rarely need to use forceSerializationCode. If you find yourself needing it
for standard entity properties or injected dependencies, this indicates a bug in Flow's
automatic detection that should be reported.

robertlemke

Makes sense. I tested this locally based on the functional tests and verified the difference of the generated proxy classes. Fine to merge, I guess?

kdambekalns · 2025-10-22T09:14:25Z

Neos.Flow/Classes/ObjectManagement/Proxy/RelatedEntitiesContainer.php

+ * see references to it in serialized object strings.
+ * @internal
+ */
+#[Flow\Proxy(false)]


Is this needed? Or an optimization / safeguard?

kdambekalns · 2025-10-22T09:20:11Z

Neos.Flow/Classes/ObjectManagement/Proxy/ObjectSerializationTrait.php

-    private function Flow_searchForEntitiesAndStoreIdentifierArray(string $path, mixed $propertyValue, string $originalPropertyName): void
+    private function Flow_searchForEntitiesAndStoreIdentifierArray(string $path, mixed $propertyValue, string $originalPropertyName): bool
    {
+        $foundEntity = false;


Suggested change

$foundEntity = false;

$entityWasFound = false;

like in the code above – and $foundEntity sounds as if it contains the entity that was found.

kdambekalns · 2025-10-22T09:20:43Z

Neos.Flow/Classes/ObjectManagement/Proxy/ObjectSerializationTrait.php

        if (is_array($propertyValue) || ($propertyValue instanceof \ArrayObject || $propertyValue instanceof \SplObjectStorage)) {
            foreach ($propertyValue as $key => $value) {
-                $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);
+                $foundEntity = $foundEntity || $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);


Suggested change

$foundEntity = $foundEntity || $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);

$entityWasFound = $entityWasFound || $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);

kdambekalns · 2025-10-22T09:21:01Z

Neos.Flow/Classes/ObjectManagement/Proxy/ObjectSerializationTrait.php

-                'entityPath' => $path
-            ];
-            $this->$originalPropertyName = Arrays::setValueByPath($this->$originalPropertyName, $path, null);
+            $foundEntity = true;


Suggested change

$foundEntity = true;

$entityWasFound = true;

kdambekalns · 2025-10-22T09:21:22Z

Neos.Flow/Classes/ObjectManagement/Proxy/ObjectSerializationTrait.php

+            $foundEntity = true;
        }
+
+        return $foundEntity;


Suggested change

return $foundEntity;

return $entityWasFound;

kdambekalns · 2025-10-22T09:38:04Z

Neos.Flow/Classes/ObjectManagement/DependencyInjection/ProxyClassBuilder.php

+    protected function couldHaveEntityRelations(Configuration $objectConfiguration): bool
+    {
+        $result = false;
+        /** @var class-string $className */


Is class-string on a plain @var something useful?

kdambekalns · 2025-10-23T11:29:36Z

Neos.Flow/Configuration/Settings.Object.yaml

+        #
+        # In the future autowiring of prototypes should no longer be an option as it makes no sense.
+        # Use a factory class if you need this otherwise.
+        prototypeAutowiring: true


The name is not as clear to me, as it should be. Does this prevent the autowiring of constructor arguments to prototypes or does it prevent the use of prototypes as constructor arguments?

kitsunet added 3 commits September 8, 2025 22:29

BUGFIX: Correctly check advices in parent's parent classes

513c42e

Props to @lorenzulrich for this correct fix, which always gets the parent in relation to the method being called and not the parent of the instance at hand. Fixes: neos#3406

BUGFIX:ProxyConstructor from reflection

d058ac6

This allows classes without constructor injection to have a proper constructor signature.

github-actions bot added Bug 9.0 labels Sep 9, 2025

kitsunet mentioned this pull request Sep 9, 2025

TASK: Avoid prototype injection in constructors neos/neos-development-collection#5621

Merged

TASK: Fixes and style updates

907d557

Some further logic fixes to proxy serialization

dfcda74

Jan3k3y mentioned this pull request Oct 20, 2025

Fix: ProxyBuilding call createQueryForType() on null #3503

Merged

6 tasks

robertlemke approved these changes Oct 20, 2025

View reviewed changes

robertlemke force-pushed the bugfix/proxy-fix-overhaul branch from 53be99c to 14c41f0 Compare October 20, 2025 15:17

robertlemke added 2 commits October 20, 2025 17:49

Add functional test for proxy serialization bug

a4fae90

Improve documentation for Proxy annotation

024bd10

robertlemke force-pushed the bugfix/proxy-fix-overhaul branch from 14c41f0 to 024bd10 Compare October 20, 2025 15:49

robertlemke mentioned this pull request Oct 20, 2025

BUGFIX: Support PHP 8+ named arguments in proxy constructors #3504

Open

kitsunet requested a review from kdambekalns October 22, 2025 07:32

kdambekalns reviewed Oct 23, 2025

View reviewed changes

	$foundEntity = $foundEntity \|\| $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);
	$entityWasFound = $entityWasFound \|\| $this->Flow_searchForEntitiesAndStoreIdentifierArray($path . '.' . $key, $value, $originalPropertyName);

Uh oh!

BUGFIX: ProxyBuilding minor refactor and fixes #3494

Are you sure you want to change the base?

BUGFIX: ProxyBuilding minor refactor and fixes #3494

Uh oh!

Conversation

kitsunet commented Sep 9, 2025

Uh oh!

kitsunet commented Sep 9, 2025

Uh oh!

lorenzulrich commented Sep 11, 2025

Uh oh!

kitsunet commented Sep 11, 2025

Uh oh!

robertlemke commented Oct 20, 2025

Uh oh!

robertlemke left a comment

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

kdambekalns Oct 23, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants