Codecs\Credential::getTransportFlags() resolves each transport to a bit position via array_search:
private static function getTransportFlags(array $transports): int
{
$flags = 0;
foreach ($transports as $transport) {
$bit = array_search($transport, self::TRANPSORT_FLAGS, true);
$flags |= (1 << $bit);
}
return $flags;
}array_search returns false when the value is absent, and 1 << false evaluates to 1 << 0 — the bit for Ble. An unmapped transport is therefore silently encoded as Ble rather than raising.
This is unreachable today: Enums\AuthenticatorTransport has exactly six cases and TRANPSORT_FLAGS maps all six. It becomes reachable the moment a case is added to the enum without updating the map — which is easy to miss, since nothing links the two.
The decode side is not symmetric either: parseTransportFlags() iterates bits 0-5 and ignores bits 6-7, so a round-trip through a future encoder that used the RFU bits would silently drop them.
Suggested resolution
Have the lookup fail loudly on a miss, or move the bit position onto the enum itself (a method or a match) so the mapping cannot drift from the cases.
Unrelated but adjacent: the constant is spelled TRANPSORT_FLAGS, while the class docblock refers to it as TRANSPORT_FLAGS.
This issue body was written by AI. The underlying findings were reviewed by a human.
Codecs\Credential::getTransportFlags()resolves each transport to a bit position viaarray_search:array_searchreturnsfalsewhen the value is absent, and1 << falseevaluates to1 << 0— the bit forBle. An unmapped transport is therefore silently encoded as Ble rather than raising.This is unreachable today:
Enums\AuthenticatorTransporthas exactly six cases andTRANPSORT_FLAGSmaps all six. It becomes reachable the moment a case is added to the enum without updating the map — which is easy to miss, since nothing links the two.The decode side is not symmetric either:
parseTransportFlags()iterates bits 0-5 and ignores bits 6-7, so a round-trip through a future encoder that used the RFU bits would silently drop them.Suggested resolution
Have the lookup fail loudly on a miss, or move the bit position onto the enum itself (a method or a match) so the mapping cannot drift from the cases.
Unrelated but adjacent: the constant is spelled
TRANPSORT_FLAGS, while the class docblock refers to it asTRANSPORT_FLAGS.This issue body was written by AI. The underlying findings were reviewed by a human.