PR A: Type constructor $options / $collaborators array shapes

[turegjorup]

Summary

First of three small follow-ups (A → B → C) tightening the JSON-payload boundary to make a future level: 8 → level: max PHPStan bump achievable.

PR A targets the constructor's untyped array $options / array $collaborators parameters. The four reads we make — cacheItemPool, openIDConnectMetadataUrl, cacheDuration, jwt — currently flow as mixed into typed setters, producing 4 argument.type errors at level: max.

What changes

Adds PHPDoc array shapes:

/**
 * @param array{
 *     cacheItemPool?: CacheItemPoolInterface,
 *     openIDConnectMetadataUrl?: string,
 *     cacheDuration?: int,
 *     leeway?: int,
 *     allowHttp?: bool,
 *     ...
 * } $options
 * @param array{
 *     jwt?: \League\OAuth2\Client\Tool\RequestFactory,
 *     httpClient?: \GuzzleHttp\ClientInterface,
 *     ...
 * } $collaborators
 */

• Keys are optional (?:) — the runtime array_key_exists + ConfigurationException checks still gate the required ones. PHPStan narrows their type when present.
• ... trailing entry allows league/oauth2-client's extras (clientId, clientSecret, redirectUri, …) and Guzzle's forwarded options (timeout, proxy, verify) to pass through.

Also drops a redundant is_int($options['leeway']) runtime check — once the shape declares leeway?: int, the check becomes a function.alreadyNarrowedType tautology. Under declare(strict_types=1), PHP itself enforces the type via setLeeway(int $leeway).

Behaviour change

None. Pure static-analysis tightening at the constructor boundary.

Test plan

• task test:coverage — 100% coverage on OpenIdConfigurationProvider (24/24 methods, 148/148 lines) preserved.
• task analyze:php at level: 8 — no errors.
• task analyze:php at level: max — 4 constructor argument.type errors gone (16 unrelated max-level errors remain, scheduled for PR B and PR C).
• task lint:php — clean.
• task lint:markdown — clean.
• CI matrix on PR.

Follow-ups

• PR B: narrow fetchJsonResource() and json_decode return types via is_array / is_string guards (~10 max-level errors).
• PR C: narrow validateIdToken claim accesses + the remaining test-side Mockery / fixture-helper types (~6 max-level errors).

After all three land, level: max becomes achievable in a final config bump.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (1774bc0) to head (c715359).

Additional details and impacted files

@@             Coverage Diff             @@
##             develop       #43   +/-   ##
===========================================
  Coverage     100.00%   100.00%           
+ Complexity        62        61    -1     
===========================================
  Files              1         1           
  Lines            172       172           
===========================================
  Hits             172       172           

Flag	Coverage Δ
unittests	100.00% <100.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.