fix: Match absolute out-of-project source paths against relative PSR-4 mappings in Psr4SourcePathsRule

src/Rule/Rules/Composer/Psr4SourcePathsRule.php

@@ -76,16 +76,19 @@ public function evaluateProject(string $basePath, Architecture $architecture, ar
     private function normalisePaths(array $paths, string $basePath): array
     {
         $normalisedBase = Path::normalise($basePath);
+        $canonicalBase  = Path::normalise($basePath, canonicalise: true);
 
         return array_map(
-            static function (string $path) use ($normalisedBase): string {
+            static function (string $path) use ($normalisedBase, $canonicalBase): string {
                 $path = Path::normalise(trim($path));
 
                 if ($normalisedBase !== '' && str_starts_with($path, $normalisedBase . '/')) {
-                    return substr($path, strlen($normalisedBase) + 1);
+                    $path = substr($path, strlen($normalisedBase) + 1);
                 }
 
-                return $path;
+                // Express every spelling relative to the canonical base path, so absolute,
+                // relative, out-of-project ("../shared/src") and symlinked forms compare equal.
+                return Path::relativeTo($path, $canonicalBase) ?: $path;
             },
             $paths
         );

tests/Rule/Composer/Psr4SourcePathsRuleTest.php

@@ -13,6 +13,8 @@
 
 use function file_put_contents;
 use function json_encode;
+use function mkdir;
+use function symlink;
 
 use const JSON_THROW_ON_ERROR;
 
@@ -231,6 +233,77 @@ public function testPassesWhenComposerUsesAbsoluteSourcePath(): void
         );
     }
 
+    public function testPassesWhenAbsoluteSourcePathOutsideProjectMatchesRelativeComposerPsr4Path(): void
+    {
+        $workspace = $this->makeTempDir();
+        mkdir($workspace . '/app');
+        mkdir($workspace . '/shared/src', 0777, true);
+        file_put_contents($workspace . '/app/composer.json', <<<'JSON'
+{
+    "autoload": {
+        "psr-4": {
+            "Shared\\": "../shared/src/"
+        }
+    }
+}
+JSON);
+
+        $psr4SourcePathsRule = new Psr4SourcePathsRule([$workspace . '/shared/src']);
+
+        $this->assertNotInstanceOf(
+            RuleViolation::class,
+            $psr4SourcePathsRule->evaluateProject($workspace . '/app', Architecture::define())
+        );
+    }
+
+    public function testFailsWhenSourcePathOutsideProjectIsMissingFromComposerPsr4Autoloads(): void
+    {
+        $workspace = $this->makeTempDir();
+        mkdir($workspace . '/app');
+        mkdir($workspace . '/shared/src', 0777, true);
+        mkdir($workspace . '/other/src', 0777, true);
+        file_put_contents($workspace . '/app/composer.json', <<<'JSON'
+{
+    "autoload": {
+        "psr-4": {
+            "Shared\\": "../shared/src/"
+        }
+    }
+}
+JSON);
+
+        $psr4SourcePathsRule = new Psr4SourcePathsRule([$workspace . '/other/src', '.']);
+
+        $violation = $psr4SourcePathsRule->evaluateProject($workspace . '/app', Architecture::define());
+
+        $this->assertInstanceOf(RuleViolation::class, $violation);
+        $this->assertStringContainsString('[../other/src, .]', $violation->message);
+    }
+
+    public function testPassesWhenAbsoluteSourcePathIsInProjectSymlinkToOutsideDirectory(): void
+    {
+        $workspace = $this->makeTempDir();
+        mkdir($workspace . '/app');
+        mkdir($workspace . '/shared/src', 0777, true);
+        symlink($workspace . '/shared/src', $workspace . '/app/src');
+        file_put_contents($workspace . '/app/composer.json', <<<'JSON'
+{
+    "autoload": {
+        "psr-4": {
+            "App\\": "src/"
+        }
+    }
+}
+JSON);
+
+        $psr4SourcePathsRule = new Psr4SourcePathsRule([$workspace . '/app/src', 'src']);
+
+        $this->assertNotInstanceOf(
+            RuleViolation::class,
+            $psr4SourcePathsRule->evaluateProject($workspace . '/app', Architecture::define())
+        );
+    }
+
     private function makeTempProject(string $composerJson): string
     {
         $basePath = $this->makeTempDir();