BUG: Sessionless authentication providers are not authenticated in GraphQLMiddleware

[MiauzGenau]

With 2.0.0 update the GraphQLMiddleware was introduced, which simulates a controller specific request, but never actually authenticates.
This may be enough for Session based authentication, which can resolve the account from it.
But for sessionless authentication $this->securityContext->getAccount() is null.
Would need a call to $this->authenticationManager->authenticate(); (with try & catch), here:

media-ui/Classes/GraphQL/Middleware/GraphQLMiddleware.php

Line 88 in 25bf3ad

$this->securityContext->setRequest($mockActionRequest);

(This fixes the issue for us.)

We use flownative/openidconnect-neos, which is why we encountered this issue.

How the issue manifests:
Certain GraphQL queries (e.g. /neos/graphql/media-assets: ASSET_SOURCES, TAGS) cause the OIDC JWT cookie (flownative_oidc_jwt) to be expired by SetJwtCookieMiddleware (Set-Cookie: flownative_oidc_jwt=; Expires=Thu, 01-Jan-1970...), logging the user out.
Account-bound asset sources (e.g. flownative/neos-canto) respond with their authorization redirect (/flownative-canto/authorization/needed) despite a valid stored authorization.

Tested with versions:
PHP: 8.4
flowpack/media-ui: 2.0.4
flownative/openidconnect-neos: 0.4.0
flownative/openidconnect-client: 5.2.1
flownative/neos-canto: 0.6.0

From the README I understand that this should be supported: https://github.com/Flowpack/media-ui#api--graphql

A valid Neos backend user is required to access it, but you can define custom policies and an authentication provider to allow access without a user and f.e. use a token based authentication.

[bwaidelich]

I commented on the PR but I'll add some more higher-level context here:

• Session-based or sessionless authentication, in both cases Security\Context::getAccount() will return an account if one is authenticated
• flownative/openidconnect-neos doesn't use a persisted Account IRRC, but it will create a non-persisted one during authentication
• Flows security framework allows to authenticate individual tokens based on the current request and I assume that the OIDC token is not active for the Flowpack\Media\Ui\Controller\MediaController for you