phpstan.neon

includes:
	- vendor/phpstan/phpstan-strict-rules/rules.neon
	- vendor/phpstan/phpstan-deprecation-rules/rules.neon
	- vendor/phpstan/phpstan-phpunit/extension.neon
	- vendor/phpstan/phpstan-phpunit/rules.neon
	- vendor/phpstan/phpstan-symfony/extension.neon
	- vendor/phpstan/phpstan-symfony/rules.neon
	- phpstan/exception-contract.neon

parameters:
	level: max
	paths:
		- src
		- tests
		- phpstan/Rule
	reportIgnoresWithoutComments: true

	# Analyse against the whole range composer.json declares (php ^8.3), not just the
	# version this happens to run on. Without it PHPStan assumes the runtime PHP, so
	# analysing on 8.3 says nothing about 8.5 and analysing on 8.5 would accept syntax
	# that breaks 8.3 consumers.
	#
	# It does not cover the *dependency* axis, which is where this bundle's real
	# findings have come from: Symfony 8.1 deprecations are invisible on PHP 8.3
	# because symfony/http-kernel 8.1 requires PHP >= 8.4.1, so composer cannot install
	# it here. Widening that needs a second job, not a setting.
	phpVersion:
		min: 80300
		max: 80500

	ignoreErrors:
		# PHPUnit declares assertions as static methods on `Assert`, but the
		# pervasive idiom is `$this->assertX()`. phpstan-phpunit handles type
		# narrowing for these but doesn't override strict-rules' judgment that
		# this is a dynamic call to a static method.
		-
			identifier: staticMethod.dynamicCall
			path: tests/*

		# Test fixture/helper PHPDoc completeness — out of scope for the static
		# analysis hardening; can be tightened as a follow-up.
		-
			identifier: missingType.generics
			path: tests/*
		-
			identifier: missingType.iterableValue
			path: tests/*
		-
			identifier: missingType.return
			path: tests/*

		# Symfony's Processor returns an untyped array; phpstan-symfony narrows
		# many other Symfony APIs but does not type processConfiguration's result
		# from a Configuration definition. The tests probe specific keys precisely
		# *because* the production code does.
		-
			identifier: argument.type
			path: tests/DependencyInjection/ConfigurationTest.php
		-
			identifier: offsetAccess.nonOffsetAccessible
			path: tests/DependencyInjection/ConfigurationTest.php

		# `validateClaims` throws `ValidationException`, but the throw happens behind
		# the abstract `authenticate()` the test fixture overrides, so PHPStan's
		# throw-type analysis can't see it reach the catch. The test deliberately
		# asserts the wrap behaviour by catching the concrete type.
		-
			identifier: catch.neverThrown
			path: tests/Security/OpenIdLoginAuthenticatorTest.php

		# Manager tests assert `getProvider()` returns an `OpenIdConfigurationProvider`
		# as a "didn't throw on construction" smoke check. The return type already
		# guarantees the class, so phpstan-phpunit flags the assertion as redundant.
		# A follow-up should replace these with behavioural assertions on the
		# constructed provider; until then the assertion documents intent.
		-
			identifier: method.alreadyNarrowedType
			path: tests/Security/OpenIdConfigurationProviderManagerTest.php