[fashxp]

What

Adds GET /pimcore-studio/api/session ({"authenticated": true|false}, plus the two-factor step of a login that waits for its code). It answers 200 for every request that passes the general rate limit (429 above it), reveals only the caller's own session state, is not cacheable, and is opened to requests without a session by a compiler pass (SessionAccessPass) that puts a PUBLIC_ACCESS rule for <url_prefix>/session in front of the project's access_control rules. Projects do not have to change their security.yaml, also not with a custom url_prefix. user/current-user-information is unchanged. The failed request disappears from the login page only together with the UI companion PR. The rule is added without host, IP or channel, so a project's IP or https restriction does not apply to this one route.

Why

The Studio login page learned that nobody is logged in from a 401 on user/current-user-information, which the browser shows as a failed request. The UI will ask the new route instead (companion PR in pimcore/studio-ui-bundle, improvement/19159-session-probe-ui; it merges after this one). A prepended security.access_control is not possible: Symfony refuses a second definition of that node, hence the compiler pass.
Fixes pimcore/pimcore#19159

Verification

• Unit: SessionControllerTest (2), SessionStatusServiceTest (4) and SessionAccessPassTest (3, incl. /session%0A stays protected) fail on base 5d5446a (classes do not exist) and pass on 02f52af. Neighbouring Authorization and Security suites pass.
• API: the Postman smoke collection calls GET /session without and with a session through the real firewall (not run here; the api-test workflow runs it on a schedule against a remote environment, not on pull requests). On dev-2026.x the route answers 200 without a session, /session/ and /session/x stay protected/404, POST gives 405.
• Static: PHPStan level 6 and php-cs-fixer clean on the changed files.
• E2E (Studio login, dev-2026.x, with the UI companion): promoted spec pimcore-pimcore-19159 red on base (401 on the login page, /session 404), green on 02f52af + UI f1fed400e (no 401, /session 200 authenticated:false and true after a login); the login still reaches Studio.

Not verified

• The two-factor pending answer end to end (unit tests only).
• A custom url_prefix on a running system (unit test of the pass only).
• CI of this repository; the new Postman smoke requests run only in the scheduled api-test workflow, so no pull request check sends GET /session through the real firewall.

Not verified (rating of 05c92c0)

• risk medium: Additive route, but it adds a public rule to the Studio firewall's access map, so what a mistake costs is higher than for a normal endpoint. The rule is anchored (\z), shown to open only /session on a real system, and leaks only the caller's own session state. Two things stay open: the rule has no i
• confidence medium: Criteria 1, 2, 3 (login and reload with a session) and 6 (newer UI against a /session that answers 404) are shown by the promoted e2e spec on this SHA (AC1 red on base, green here; AC6 gate e2e-AC6 pass @05c92c0e4b, T-2782, UI f1fed400e built from sources). Criteria 4 and 5 are shown by unit tests o

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

🔵 Needs a closer look

The intentional override of application access restrictions needs maintainer security review, with real-firewall two-factor and custom-prefix verification still outstanding.

No open issues 🎉

What changed in this PR

Verdict: Request maintainer security review.

Adds a session-status endpoint so the Studio login page can check authentication without relying on a failing protected request.

Changes:

• Adds a non-cacheable GET /session response with authentication and pending two-factor status.
• Registers a compiler pass that grants public access ahead of application access rules.
• Adds unit tests, Postman smoke requests, and API/upgrade documentation.

Review assessment:

• Root cause and caller coverage: The dedicated probe separates session discovery from protected user information (src/Authorization/Controller/SessionController.php:42–57). Removing the login-page failure still depends on the companion UI change, which is outside this diff.
• Boundary: Session-state logic belongs to the service; the controller handles serialization and cache headers (src/Authorization/Service/SessionStatusService.php:41–48, src/Authorization/Controller/SessionController.php:54–59).
• Compatibility: The endpoint is additive, but its public-access rule intentionally overrides application restrictions for the matching path (src/DependencyInjection/CompilerPass/SessionAccessPass.php:45–53).
• Regression coverage: Unit tests cover status states, response caching, and access matching; smoke requests cover anonymous and authenticated requests (tests/Unit/Authorization/Service/SessionStatusServiceTest.php:29–63, tests/Unit/Authorization/Controller/SessionControllerTest.php:30–43, tests/Unit/DependencyInjection/CompilerPass/SessionAccessPassTest.php:32–63, tests/Api/postman/collections/Smoke Test.json:13–24,349–360). Tests were not independently run here.
• Documentation: Upgrade notes explain the route and restriction override (doc/02_Installation_and_Configuration/05_Upgrade.md:6–13).
• Remaining risks: The access-map override warrants maintainer security review. Real-firewall two-factor and custom-prefix behavior remain unverified according to the PR description.

File	Description
translations/​studio_api_docs.en.yaml	Adds session endpoint documentation strings.
tests/​Unit/​DependencyInjection/​CompilerPass/​SessionAccessPassTest.php	Tests public access, path boundaries, and custom prefixes.
tests/​Unit/​Authorization/​Service/​SessionStatusServiceTest.php	Tests anonymous, authenticated, and two-factor states.
tests/​Unit/​Authorization/​Controller/​SessionControllerTest.php	Tests HTTP 200 responses and cache prevention.
tests/​Api/​postman/​collections/​Smoke Test.json	Adds anonymous and authenticated session probes.
src/​PimcoreStudioBackendBundle.php	Registers the session access compiler pass.
src/​DependencyInjection/​CompilerPass/​SessionAccessPass.php	Prepends the public session access rule.
src/​Authorization/​Service/​SessionStatusServiceInterface.php	Defines the session-status service contract.
src/​Authorization/​Service/​SessionStatusService.php	Derives authentication and pending two-factor status.
src/​Authorization/​Schema/​SessionStatus.php	Defines the session response schema.
src/​Authorization/​Controller/​SessionController.php	Exposes the non-cacheable session endpoint.
doc/​02_Installation_and_Configuration/​05_Upgrade.md	Documents the endpoint and security implications.
config/​authorization.yaml	Wires the session-status service interface.

_{Review effort: Balanced}