Fix: Store broadcast channels on BroadcastManager to ensure coroutine-safe authorization

src/broadcasting/src/Broadcasters/Broadcaster.php

@@ -35,12 +35,12 @@ abstract class Broadcaster implements BroadcasterContract
     /**
      * The registered channel authenticators.
      */
-    protected array $channels = [];
+    protected static array $channels = [];
 
     /**
      * The registered channel options.
      */
-    protected array $channelOptions = [];
+    protected static array $channelOptions = [];
 
     /**
      * Resolve the authenticated user payload for the incoming connection request.
@@ -77,9 +77,9 @@ public function channel(HasBroadcastChannel|string $channel, callable|string $ca
             $channel = (new $channel())->broadcastChannelRoute();
         }
 
-        $this->channels[$channel] = $callback;
+        static::$channels[$channel] = $callback;
 
-        $this->channelOptions[$channel] = $options;
+        static::$channelOptions[$channel] = $options;
 
         return $this;
     }
@@ -91,7 +91,7 @@ public function channel(HasBroadcastChannel|string $channel, callable|string $ca
      */
     protected function verifyUserCanAccessChannel(RequestInterface $request, string $channel): mixed
     {
-        foreach ($this->channels as $pattern => $callback) {
+        foreach (static::$channels as $pattern => $callback) {
             if (! $this->channelNameMatchesPattern($channel, $pattern)) {
                 continue;
             }
@@ -266,7 +266,7 @@ protected function retrieveUser(string $channel): mixed
      */
     protected function retrieveChannelOptions(string $channel): array
     {
-        foreach ($this->channelOptions as $pattern => $options) {
+        foreach (static::$channelOptions as $pattern => $options) {
             if (! $this->channelNameMatchesPattern($channel, $pattern)) {
                 continue;
             }
@@ -290,6 +290,15 @@ protected function channelNameMatchesPattern(string $channel, string $pattern):
      */
     public function getChannels(): Collection
     {
-        return Collection::make($this->channels);
+        return Collection::make(static::$channels);
+    }
+
+    /**
+     * Flush the registered channels.
+     */
+    public static function flushChannels(): void
+    {
+        static::$channels = [];
+        static::$channelOptions = [];
     }
 }

src/http-client/src/Request.php

@@ -207,9 +207,9 @@ public function query(): array
 
     public function withQuery(array $query = []): Request
     {
-        $new = $this->request->getUri()->withQuery(http_build_query(array_merge($this->query(), $query)));
-
-        $this->request = $this->request->withUri($new);
+        $this->request = $this->request->withUri(
+            $this->request->getUri()->withQuery(http_build_query(array_merge($this->query(), $query)))
+        );
 
         return $this;
     }

tests/Broadcasting/BroadcasterTest.php

@@ -45,6 +45,8 @@ protected function tearDown(): void
         parent::tearDown();
 
         m::close();
+
+        FakeBroadcaster::flushChannels();
     }
 
     public function testExtractingParametersWhileCheckingForUserAccess()
@@ -379,6 +381,24 @@ public static function channelNameMatchPatternProvider()
             ['customerorder.1', 'order.{id}', false],
         ];
     }
+
+    public function testChannelsAreSharedAcrossBroadcasterInstances()
+    {
+        // Simulate boot time: register channel on first broadcaster instance
+        $broadcasterA = new FakeBroadcaster(m::mock(ContainerInterface::class));
+        $broadcasterA->channel('App.Models.User.{id}', function ($user, $id) {
+            return (int) $user->id === (int) $id;
+        });
+
+        // Simulate auth request time: create a second broadcaster instance
+        $broadcasterB = new FakeBroadcaster(m::mock(ContainerInterface::class));
+
+        // The second instance should see the channel registered on the first
+        $channels = $broadcasterB->getChannels();
+
+        $this->assertCount(1, $channels);
+        $this->assertArrayHasKey('App.Models.User.{id}', $channels->toArray());
+    }
 }
 
 class FakeBroadcaster extends Broadcaster

tests/Container/ContainerCallTest.php

@@ -7,6 +7,7 @@
 use Hyperf\Contract\NormalizerInterface;
 use Hyperf\Di\ClosureDefinitionCollector;
 use Hyperf\Di\ClosureDefinitionCollectorInterface;
+use Hyperf\Di\MetadataCollector;
 use Hyperf\Di\MethodDefinitionCollector;
 use Hyperf\Di\MethodDefinitionCollectorInterface;
 use Hyperf\Serializer\SimpleNormalizer;
@@ -21,6 +22,13 @@
  */
 class ContainerCallTest extends TestCase
 {
+    protected function tearDown(): void
+    {
+        parent::tearDown();
+
+        MetadataCollector::clear();
+    }
+
     protected function getContainer(array $dependencies = [])
     {
         return new Container(