phpstan.neon

includes:
    - app/vendor/phpstan/phpstan-strict-rules/rules.neon

parameters:
    # Only what we wrote; everything excluded below ships verbatim from the adminer
    # release and is not ours to report on.
    # Directories, not a list of files: a list is something to forget to update, and the
    # things that must not be analysed are stable while our own files are not.
    paths:
        - app
        - cli

    excludePaths:
        # vendor/ lives under app/ now, so paths: [app] would otherwise analyse all of it.
        # Excluded from analysis but still scanned for symbols — which is how Latte and Tracy
        # resolve, without registering composer's autoloader as a bootstrap. That bootstrap
        # would make phpstan *include* our classes to reflect them and fatal on AdminerDesktop's
        # parent Adminer\Plugin, a symbol we only scan (below), never load.
        analyse:
            - app/vendor
            # The plugin catalogue, same deal: not ours to report on, but the classes
            # PluginList names have to resolve — it instantiates them by name.
            - app/src/Settings/Plugins/available
        analyseAndScan:
            - app/adminer.php
            - app/editor.php
            - app/src/Settings/Theme/designs

    # Not analysed, only read for symbols: this is where Adminer\Plugin, Adminer\h(),
    # verify_token() and the rest are defined. Without it every adminer call is an
    # "unknown function" and the real findings drown.
    scanFiles:
        - app/adminer.php
        - phpstan-stubs.php

    # Adminer's phpdoc for the members we override; see the file.
    stubFiles:
        - phpstan-plugin.stub

    # Level 6 adds the missing-type checks: every parameter, return and property in our own
    # code carries a type. The adminer hooks we override (head, css, csp, navigation, ...)
    # carry @param/@return phpdoc rather than native types — adminer's base leaves them
    # untyped and dispatches them dynamically, so a native type would risk a runtime
    # TypeError, not just a phpstan note. Bare $_POST["x"] stays fine either way: phpstan
    # treats the superglobal as open-keyed, so an access is never "possibly undefined".
    level: 6

    # Upstream adminer's stricter set (conf/phpstan.neon there), so code written next to
    # adminer is held to the same bar adminer holds itself to.
    checkNullables: true # level 8
    checkUninitializedProperties: true # typed property without a default value
    checkDynamicProperties: true # property not declared in the class
    checkFunctionNameCase: true
    checkMissingCallableSignature: true # callable without the types of its parameters
    reportAnyTypeWideningInVarTag: true # @var widening the inferred type
    reportMaybesInMethodSignatures: true # nullable parameter and return types of overridden methods
    reportMaybesInPropertyPhpDocTypes: true
    reportStaticMethodSignatures: true

    strictRules:
        allRules: false
        closureUsesThis: true
        disallowedBacktick: true
        disallowedImplicitArrayCreation: true
        dynamicCallOnStaticMethod: true
        illegalConstructorMethodCall: true
        matchingInheritedMethodNames: true
        switchConditionsMatchingType: true
    # rules.neon enables these outside strictRules, so they are set back as upstream does
    polluteScopeWithLoopInitialAssignments: true
    polluteScopeWithAlwaysIterableForeach: true
    reportWrongPhpDocTypeInVarTag: false

    # Defined once per request by whichever driver the URL names; phpstan otherwise takes the
    # first define() in adminer.php ("pgsql") for the only value and calls every check of it
    # always true.
    dynamicConstantNames:
        - Adminer\DRIVER

    # phpstan's workers shell out to a `php` binary, and there is deliberately no PHP
    # installed here — we run it through the frankenphp we already download. One process
    # keeps it in-process, and there are too few files for parallelism to buy anything.
    parallel:
        maximumNumberOfProcesses: 1