markitosgv / JWTRefreshTokenBundle / 31018513506

100%

push

github

fix: clear the code scanning alerts

Nineteen were open, all from the psalm security scan, which reports its
informational issues too. Seven were real:

- RefreshTokenFamilyTrait carried no mutation annotation while every sibling
  did, which is what psalm's taint analysis wants before it will reason about
  where a family came from. The only error-severity one.
- Four array shapes were sealed promises about keys the method never looks at.
  configureObjectManager takes the one value it reads; the rest say so with a
  trailing ellipsis.
- The primary key column is read into a variable so the emptiness check
  narrows it, rather than being re-read and taken on trust.
- DEFAULT_BATCH_SIZE gains its type; Rector had typed the class constants but
  not the interface ones.

The cast in SessionLister stays and its docblock is corrected instead: a
family is 32 hex characters and PHP turns an all-digit one into an integer
key, so the cast was doing something and the shape was the wrong part.

The remaining eleven are by design or belong to Symfony, Doctrine and API
Platform. Those are suppressed in psalm.xml.dist, scoped to the files they
concern and each with the reason, since an unexplained suppression cannot be
told apart from a bug somebody gave up on.

7 of 7 new or added lines in 2 files covered. (100.0%)

1821 of 1822 relevant lines covered (99.95%)

25.81 hits per line