Psalm level 1 + Minor fixes

CHANGELOG.md

@@ -4,6 +4,7 @@
 
 - New #113: Split `AuthenticationMethodInterface` into focused authentication and challenge interfaces (@samdark, @vjik)
 - Bug #116: Fix authentication scheme in `HttpBearer` challenge according to RFC 6750 (@samdark)
+- Bug #123: Fix `HttpHeader` authentication to correctly handle header value `"0"` (@vjik)
 - Chg #104: Bump minimal PHP version to 8.1 (@vjik)
 - Enh #104: Explicitly mark readonly properties (@vjik)
 - Enh #105: Explicitly import classes and functions in "use" section (@mspirkov)

composer.json

@@ -44,7 +44,7 @@
         "rector/rector": "^2.3.0",
         "roave/infection-static-analysis-plugin": "^1.35",
         "spatie/phpunit-watcher": "^1.24.4",
-        "vimeo/psalm": "^5.26.1 || ^6.10",
+        "vimeo/psalm": "^5.26.1 || ^6.16.1",
         "yiisoft/yii-debug": "dev-master"
     },
     "autoload": {
@@ -66,8 +66,11 @@
         }
     },
     "scripts": {
-        "test": "phpunit --testdox --no-interaction",
-        "test-watch": "phpunit-watcher watch"
+        "test": "phpunit",
+        "test-watch": "phpunit-watcher watch",
+        "cs-fix": "php-cs-fixer fix",
+        "rector": "rector",
+        "psalm": "psalm --no-cache"
     },
     "config": {
         "sort-packages": true,

psalm.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0"?>
 <psalm
-    errorLevel="3"
+    errorLevel="1"
     resolveFromConfigFile="true"
     findUnusedBaselineEntry="true"
     findUnusedCode="false"

src/Debug/AuthenticationMethodInterfaceProxy.php

@@ -9,6 +9,9 @@
 use Yiisoft\Auth\AuthenticationMethodInterface;
 use Yiisoft\Auth\IdentityInterface;
 
+/**
+ * @psalm-suppress DeprecatedInterface
+ */
 final class AuthenticationMethodInterfaceProxy implements AuthenticationMethodInterface
 {
     public function __construct(private readonly AuthenticationMethodInterface $decorated, private readonly IdentityCollector $collector) {}

src/Method/Composite.php

@@ -14,6 +14,8 @@
 
 /**
  * Composite allows multiple authentication methods at the same time.
+ *
+ * @psalm-suppress DeprecatedInterface
  */
 final class Composite implements AuthenticationMethodInterface, AuthenticatorWithChallengeInterface
 {
@@ -28,7 +30,7 @@
     {
         foreach ($this->methods as $method) {
             if (!$method instanceof AuthenticatorInterface) {
                 throw new RuntimeException('Authentication method must be an instance of ' . AuthenticatorInterface::class . '.');
             }
 
             $identity = $method->authenticate($request);

src/Method/HttpBasic.php

@@ -28,6 +28,10 @@
  * ```
  * RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
  * ```
+ *
+ * @psalm-suppress DeprecatedInterface
+ *
+ * @psalm-type TAuthenticationCallback = callable(?string, ?string, IdentityWithTokenRepositoryInterface): (?IdentityInterface)
  */
 final class HttpBasic implements AuthenticationMethodInterface, AuthenticatorWithChallengeInterface
 {
@@ -36,6 +40,7 @@
 
     /**
      * @var callable|null
+     * @psalm-var TAuthenticationCallback|null
      */
     private $authenticationCallback;
 
@@ -69,7 +74,7 @@
      * static function (
      *     ?string $username,
      *     #[\SensitiveParameter] ?string $password,
-     *     \Yiisoft\Auth\IdentityRepositoryInterface $identityRepository
+     *     \Yiisoft\Auth\IdentityWithTokenRepositoryInterface $identityRepository
      * ): ?\Yiisoft\Auth\IdentityInterface
      * ```
      *
@@ -81,6 +86,8 @@
      * while the password information will be ignored.
      * The {@see IdentityWithTokenRepositoryInterface::findIdentityByToken()}
      * method will be called to authenticate an identity.
+     *
+     * @psalm-param TAuthenticationCallback $authenticationCallback
      */
     public function withAuthenticationCallback(callable $authenticationCallback): self
     {
@@ -121,11 +128,17 @@
      * Obtains authentication credentials from request.
      *
      * @return array ['username', 'password'] array.
+     *
+     * @psalm-return array{0: ?string, 1: ?string}
      */
     private function getAuthenticationCredentials(ServerRequestInterface $request): array
     {
-        $username = $request->getServerParams()['PHP_AUTH_USER'] ?? null;
-        $password = $request->getServerParams()['PHP_AUTH_PW'] ?? null;
+        /**
+         * @var string[] $serverParams
+         */
+        $serverParams = $request->getServerParams();
+        $username = $serverParams['PHP_AUTH_USER'] ?? null;
+        $password = $serverParams['PHP_AUTH_PW'] ?? null;
         if ($username !== null || $password !== null) {
             return [$username, $password];
         }
@@ -156,14 +169,22 @@
             return $header;
         }
 
-        return $request->getServerParams()['REDIRECT_HTTP_AUTHORIZATION'] ?? null;
+        /**
+         * @var string[] $serverParams
+         */
+        $serverParams = $request->getServerParams();
+
+        return $serverParams['REDIRECT_HTTP_AUTHORIZATION'] ?? null;
     }
 
+    /**
+     * @psalm-return array{0: ?string, 1?: ?string}
+     */
     private function extractCredentialsFromHeader(#[SensitiveParameter] string $authToken): array
     {
         return array_map(
             static fn($value) => $value === '' ? null : $value,
             explode(':', base64_decode(substr($authToken, 6)), 2),
         );
     }
 

src/Method/HttpBearer.php

@@ -12,6 +12,8 @@
  * Authentication method based on HTTP Bearer token.
  *
  * @see https://tools.ietf.org/html/rfc6750
+ *
+ * @psalm-suppress DeprecatedInterface
  */
 final class HttpBearer extends HttpHeader implements AuthenticatorWithChallengeInterface
 {

src/Method/HttpCookie.php

@@ -15,6 +15,8 @@
  * HTTP cookie authentication method.
  *
  * @see https://tools.ietf.org/html/rfc6265
+ *
+ * @psalm-suppress DeprecatedInterface
  */
 final class HttpCookie implements AuthenticationMethodInterface, AuthenticatorInterface
 {
@@ -67,6 +69,9 @@ public function withTokenType(?string $type): self
 
     private function getAuthenticationToken(ServerRequestInterface $request): ?string
     {
+        /**
+         * @var string[] $cookies
+         */
         $cookies = $request->getCookieParams();
 
         return $cookies[$this->cookieName] ?? null;

src/Method/HttpHeader.php

@@ -20,6 +20,8 @@
  * The default implementation of HttpHeader uses the
  * {@see IdentityWithTokenRepositoryInterface::findIdentityByToken()}
  * and passes the value of the `X-Api-Key` header. This implementation is used mainly for authenticating API clients.
+ *
+ * @psalm-suppress DeprecatedInterface
  */
 class HttpHeader implements AuthenticationMethodInterface, AuthenticatorInterface
 {
@@ -96,11 +98,11 @@
         return $new;
     }
 
     protected function getAuthenticationToken(ServerRequestInterface $request): ?string
     {
         $authHeaders = $request->getHeader($this->headerName);
         $authHeader = reset($authHeaders);
-        if (!empty($authHeader)) {
+        if ($authHeader !== false && $authHeader !== '') {
             if (preg_match($this->pattern, $authHeader, $matches)) {
                 $authHeader = $matches[1];
             } else {

src/Method/QueryParameter.php

@@ -15,6 +15,8 @@
 
 /**
  * QueryParameter supports the authentication based on the access token passed through a query parameter.
+ *
+ * @psalm-suppress DeprecatedInterface
  */
 final class QueryParameter implements AuthenticationMethodInterface, AuthenticatorInterface
 {

src/Middleware/Authentication.php

@@ -27,7 +27,7 @@ final class Authentication implements MiddlewareInterface
     private RequestHandlerInterface $failureHandler;
 
     /**
-     * @var array Patterns to match to consider the given request URI path optional.
+     * @var string[] Patterns to match to consider the given request URI path optional.
      */
     private array $optionalPatterns = [];
     /**
@@ -62,7 +62,7 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
     }
 
     /**
-     * @param array $optional Patterns to match to consider the given request URI path optional.
+     * @param string[] $optional Patterns to match to consider the given request URI path optional.
      *
      * @see WildcardPattern
      */

tests/Method/HttpHeaderTest.php

@@ -143,6 +143,27 @@ public function testWithTokenType(): void
         );
     }
 
+    public function testZeroValueHeader(): void
+    {
+        $identityRepository = new FakeIdentityRepository($this->createIdentity());
+        $result = (new HttpHeader($identityRepository))->authenticate(
+            $this->createRequest(['X-Api-Key' => '0']),
+        );
+
+        $this->assertNotNull($result);
+        $this->assertEquals('test-id', $result->getId());
+        $this->assertEquals(
+            [
+                'findIdentityByToken'
+                    => [
+                        'token' => '0',
+                        'type' => null,
+                    ],
+            ],
+            $identityRepository->getCallParams(),
+        );
+    }
+
     private function createIdentity(): IdentityInterface
     {
         return new FakeIdentity('test-id');