phpstan.dist.neon

includes:
    # Pre-existing level-5 violations are frozen here so the higher bar applies
    # to NEW code immediately while the backlog is burned down over time.
    # Regenerate after fixing some: vendor/bin/phpstan analyse --generate-baseline
    - phpstan-baseline.neon

parameters:
    paths:
        - src/

    # Raised from 1 → 5 (with a baseline for the existing backlog). Level 5 adds
    # undefined method/property detection on resolved types and argument-type
    # checks — the class of static bug that previously slipped through.
    level: 5

    # The prod image runs PHP 8.5 while CI analyses on PHP 8.4, so a few
    # version-specific findings (e.g. postInc.type "++ on literal-string") land
    # in the baseline on one version but not the other. Tolerate unmatched
    # baseline entries — genuinely NEW errors still fail the build.
    # Deliberately kept false (re-checked when src/Entity/ + src/Lifecycle/
    # were brought into the analysis): turning it on would fail one of the
    # two PHP versions on entries that only match on the other.
    reportUnmatchedIgnoredErrors: false

    # src/Entity/ and src/Lifecycle/ are analysed like the rest of src/. They
    # used to be excluded wholesale because they may call setStatus()
    # directly — NoDirectSetStatusRule allows those directories itself
    # (ALLOWED_FILE_PATTERNS), so no path exclusion is needed.

    ignoreErrors:
        # Doctrine assigns generated ids (#[ORM\GeneratedValue]) via
        # reflection, which PHPStan cannot see without phpstan/phpstan-doctrine
        # (not installed). Without it every `?int $id` reports "is never
        # assigned int". Limited to $id on entities; any other property.unusedType
        # finding still fails the build.
        -
            identifier: property.unusedType
            message: '#^Property App\\Entity\\[A-Za-z0-9_\\]+::\$id \(int\|null\) is never assigned int so it can be removed from the property type\.$#'
            path: src/Entity/*

services:
    # X.5b — Prevents `setStatus()` outside src/Entity/ and src/Lifecycle/
    # (the rule skips those directories, migrations and tests on its own)
    -
        class: App\Tests\PHPStan\Rule\NoDirectSetStatusRule
        tags:
            - phpstan.rules.rule

    # Type-aware replacement for the textual check_enum_to_json_unwrap.py:
    # a backed enum in a JSON payload makes json_encode() return false, so the
    # endpoint answers 500. The old gate matched getStatus() by name and every
    # one of its five baseline entries was a false positive (all return string).
    -
        class: App\Tests\PHPStan\Rule\NoEnumInJsonResponseRule
        tags:
            - phpstan.rules.rule

    # Prevents unscoped findAll() on tenant-owned entities in Command/Job/
    # MessageHandler. TenantFilterSubscriber only arms the Doctrine
    # tenant_filter on kernel.request, so outside HTTP those reads span ALL
    # tenants (shipped twice: #1023 scheduled reports, #1026 export jobs).
    -
        class: App\Tests\PHPStan\Rule\NoUnscopedTenantQueryInBackgroundRule
        tags:
            - phpstan.rules.rule

    # Y.4 — Prevents `new App\Entity\Workflow()` / `new App\Entity\WorkflowStep()`
    # in src/ code outside Repository and Command namespaces.
    -
        class: App\Tests\PHPStan\Rule\NoNewWorkflowOrWorkflowStepRule
        tags:
            - phpstan.rules.rule

    # Marks constants + methods consumed only outside analysed PHP (CI gate
    # scripts, reflection in tests) as always-used — e.g.
    # BackupService::EXCLUDED_FROM_BACKUP (Gate 43 Python + BackupServiceTest
    # reflection) and ComplianceWizardService::check{Consent,Dsr,Dpia}Coverage
    # (ComplianceWizardServiceTest reflection).
    -
        class: App\Tests\PHPStan\ExternallyConsumedSymbolExtension
        tags:
            - phpstan.constants.alwaysUsedClassConstantsExtension
            - phpstan.methods.alwaysUsedMethodExtension

    # Narrow getUser() → App\Entity\User|null (single user entity). Kills the
    # ~190 false method.notFound/argument.type against ?UserInterface.
    -
        class: App\Tests\PHPStan\Type\GetUserReturnTypeExtension
        arguments:
            forClass: Symfony\Bundle\SecurityBundle\Security
        tags:
            - phpstan.broker.dynamicMethodReturnTypeExtension
    -
        class: App\Tests\PHPStan\Type\GetUserReturnTypeExtension
        arguments:
            forClass: Symfony\Bundle\FrameworkBundle\Controller\AbstractController
        tags:
            - phpstan.broker.dynamicMethodReturnTypeExtension