build: upgrade to PHP 8.5

.github/workflows/build-push-test-docker-image.yml

@@ -16,7 +16,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Build the app
-        uses: openconext/build-and-publish-test-container/php82-node20@main
+        uses: openconext/build-and-publish-test-container/php85-node24@main
         with:
           use_yarn: false
 

.github/workflows/test-integration.yml

@@ -10,7 +10,7 @@ jobs:
       run:
         working-directory: /var/www/html/
     container:
-      image:  ghcr.io/openconext/openconext-basecontainers/php82-apache2-node20-composer2:latest
+      image:  ghcr.io/openconext/openconext-basecontainers/php85-apache2-node24:latest
       volumes:
         - .:/var/www/html
 

.scrutinizer.yml

@@ -1,8 +1,8 @@
 build:
   image: default-jammy
   environment:
-    php: 8.2
-    node: 'v20'
+    php: 8.5
+    node: 'v24'
 
 filter:
     excluded_paths:

ci/qa/patch-mockery.php

@@ -0,0 +1,19 @@
+<?php
+
+$file = __DIR__ . '/../../vendor/mockery/mockery/library/Mockery.php';
+if (!file_exists($file)) {
+    exit(0);
+}
+
+$content = file_get_contents($file);
+$patched = str_replace(
+    ['public static function formatArgs($method, array $arguments = null)', 'public static function formatObjects(array $objects = null)'],
+    ['public static function formatArgs($method, ?array $arguments = null)', 'public static function formatObjects(?array $objects = null)'],
+    $content,
+    $count
+);
+
+if ($count > 0) {
+    file_put_contents($file, $patched);
+    echo "Patched Mockery: fixed $count implicit nullable param(s) for PHP 8.4+ compatibility\n";
+}

ci/qa/phpunit.xml

@@ -2,20 +2,29 @@
 <!-- https://phpunit.readthedocs.io/en/latest/configuration.html -->
 <phpunit
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/9.3/phpunit.xsd"
+    xsi:noNamespaceSchemaLocation="https://schema.phpunit.de/10.0/phpunit.xsd"
     backupGlobals="false"
     colors="true"
     bootstrap="../../tests/bootstrap.php"
     cacheDirectory="../../var/qa/phpunit.cache"
 >
   <php>
-    <ini name="error_reporting" value="-1"/>
+    <ini name="error_reporting" value="24575"/><!-- E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED -->
+    <ini name="display_errors" value="0"/>
     <ini name="memory_limit" value="256M"/>
     <server name="APP_ENV" value="test" force="true"/>
     <server name="SHELL_VERBOSITY" value="-1"/>
     <server name="KERNEL_CLASS" value="\Surfnet\StepupMiddleware\Kernel"/>
     <env name="APP_ENV" value="test" force="true"/>
   </php>
+  <source>
+    <include>
+      <directory suffix=".php">../../src</directory>
+    </include>
+    <exclude>
+      <directory>../../vendor</directory>
+    </exclude>
+  </source>
   <testsuites>
     <testsuite name="unit">
       <directory suffix="Test.php">../../src</directory>

ci/qa/rector.php

@@ -7,6 +7,7 @@
 use Rector\Php80\Rector\Class_\ClassPropertyAssignToConstructorPromotionRector;
 use Rector\Php81\Rector\Property\ReadOnlyPropertyRector;
 use Rector\Php82\Rector\Class_\ReadOnlyClassRector;
+use Rector\Php84\Rector\Param\ExplicitNullableParamTypeRector;
 
 return RectorConfig::configure()
     ->withPaths([
@@ -21,6 +22,9 @@
     ->withTypeCoverageLevel(10)
     ->withDeadCodeLevel(10)
     ->withCodeQualityLevel(10)
+    ->withRules([
+        ExplicitNullableParamTypeRector::class,
+    ])
     ->withSkip([
         ReadOnlyClassRector::class,
         ReadOnlyPropertyRector::class,

composer.json

@@ -18,7 +18,7 @@
     },
     "minimum-stability": "stable",
     "require": {
-        "php": "^8.2",
+        "php": "^8.5",
         "ext-gmp": "*",
         "ext-json": "*",
         "ext-openssl": "*",
@@ -108,11 +108,13 @@
 
         "post-install-cmd": [
             "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
-            "@auto-scripts"
+            "@auto-scripts",
+            "php ci/qa/patch-mockery.php"
         ],
         "post-update-cmd": [
             "Incenteev\\ParameterHandler\\ScriptHandler::buildParameters",
-            "@auto-scripts"
+            "@auto-scripts",
+            "php ci/qa/patch-mockery.php"
         ],
         "frontend-install":
             "echo 'Skipping task: no frontend assets available'"
@@ -141,7 +143,7 @@
             "symfony/runtime": true
         },
         "platform": {
-            "php": "8.2"
+            "php": "8.5"
         },
         "optimize-autoloader": true,
         "sort-packages": true

docker/Dockerfile.prod

@@ -1,4 +1,4 @@
-FROM ghcr.io/openconext/openconext-basecontainers/php82-apache2:latest AS php-build
+FROM ghcr.io/openconext/openconext-basecontainers/php85-apache2-node24:latest AS php-build
 ARG APP_VERSION
 ARG GIT_SHA
 ARG GIT_COMMIT_TIME

docker/Dockerfile.test

@@ -3,7 +3,7 @@ WORKDIR /unpack
 COPY output.zip /unpack
 RUN unzip /unpack/output.zip
 
-FROM ghcr.io/openconext/openconext-basecontainers/php82-apache2:latest
+FROM ghcr.io/openconext/openconext-basecontainers/php85-apache2-node24:latest
 # Set the default workdir
 WORKDIR /var/www/html
 COPY --from=unpack /unpack/ /var/www/html/

src/Surfnet/Stepup/DateTime/DateTime.php

@@ -73,7 +73,7 @@ public static function fromString(string $string): self
     /**
      * @param CoreDateTime|null $dateTime
      */
-    public function __construct(CoreDateTime $dateTime = null)
+    public function __construct(?CoreDateTime $dateTime = null)
     {
         $this->dateTime = $dateTime ?: new CoreDateTime();
     }

src/Surfnet/Stepup/Tests/Identity/Value/EmailVerificationWindowTest.php

@@ -116,7 +116,7 @@ public function the_window_correctly_calculates_the_end_datetime(): void
      * @throws Exception
      * @throws Exception
      */
-    private function newEmailVerificationWindow(int $timeFrameSeconds, string $startTimeOffset = null): EmailVerificationWindow
+    private function newEmailVerificationWindow(int $timeFrameSeconds, ?string $startTimeOffset = null): EmailVerificationWindow
     {
         $start = DateTime::now();
         if ($startTimeOffset) {

src/Surfnet/StepupMiddleware/ApiBundle/Authorization/Service/CommandAuthorizationService.php

@@ -69,7 +69,7 @@ public function __construct(
      * @param IdentityId|null $actorId
      * @return bool
      */
-    public function isInstitutionWhitelisted(Institution $institution, IdentityId $actorId = null): bool
+    public function isInstitutionWhitelisted(Institution $institution, ?IdentityId $actorId = null): bool
     {
         // If the actor is SRAA all actions should be allowed
         if (!is_null($actorId) && $this->isSraa($actorId)) {
@@ -78,7 +78,7 @@ public function isInstitutionWhitelisted(Institution $institution, IdentityId $a
         return $this->whitelistService->isWhitelisted($institution->getInstitution());
     }
 
-    public function maySelfServiceCommandBeExecutedOnBehalfOf(Command $command, IdentityId $actorId = null): bool
+    public function maySelfServiceCommandBeExecutedOnBehalfOf(Command $command, ?IdentityId $actorId = null): bool
     {
         $commandName = $command::class;
         $identityId = $actorId instanceof IdentityId ? $actorId->getIdentityId() : null;
@@ -140,8 +140,8 @@ public function maySelfServiceCommandBeExecutedOnBehalfOf(Command $command, Iden
      */
     public function mayRaCommandBeExecutedOnBehalfOf(
         Command $command,
-        IdentityId $actorId = null,
-        Institution $actorInstitution = null,
+        ?IdentityId $actorId = null,
+        ?Institution $actorInstitution = null,
     ): bool {
         $commandName = $command::class;
         $identityId = $actorId instanceof IdentityId ? $actorId->getIdentityId() : null;
@@ -256,7 +256,7 @@ public function mayRaCommandBeExecutedOnBehalfOf(
         return true;
     }
 
-    private function isSraa(IdentityId $actorId = null): bool
+    private function isSraa(?IdentityId $actorId = null): bool
     {
         if (is_null($actorId)) {
             return false;

src/Surfnet/StepupMiddleware/ApiBundle/Identity/Projector/RaSecondFactorProjector.php

@@ -229,8 +229,8 @@ private function saveRaSecondFactor(
         string             $secondFactorIdentifier,
         CommonName         $commonName,
         Email              $email,
-        SecondFactorStatus $status = null,
-        DocumentNumber     $documentNumber = null,
+        ?SecondFactorStatus $status = null,
+        ?DocumentNumber     $documentNumber = null,
     ): void {
         $identity = $this->identityRepository->find($identityId);
 

src/Surfnet/StepupMiddleware/ApiBundle/Security/Http/EntryPoint/JsonBasicAuthenticationEntryPoint.php

@@ -36,7 +36,7 @@ public function __construct(private string $realmName)
     /**
      * {@inheritdoc}
      */
-    public function start(Request $request, AuthenticationException $authException = null): Response
+    public function start(Request $request, ?AuthenticationException $authException = null): Response
     {
         $authExceptionMessage = $authException instanceof AuthenticationException ? $authException->getMessage() : '';
         $error = sprintf('You are required to authorise before accessing this API (%s).', $authExceptionMessage);

src/Surfnet/StepupMiddleware/ApiBundle/Tests/Identity/Projector/AuditLogProjectorTest.php

@@ -170,9 +170,9 @@ public function it_creates_entries_for_auditable_events(DomainMessage $message,
     private function createAuditLogMetadata(
         IdentityId $identityId,
         Institution $institution,
-        SecondFactorId $secondFactorId = null,
-        SecondFactorType $secondFactorType = null,
-        SecondFactorIdentifier $secondFactorIdentifier = null,
+        ?SecondFactorId $secondFactorId = null,
+        ?SecondFactorType $secondFactorType = null,
+        ?SecondFactorIdentifier $secondFactorIdentifier = null,
     ): Metadata {
         $metadata = new Metadata();
         $metadata->identityId = $identityId;
@@ -189,10 +189,10 @@ private function createExpectedAuditLogEntry(
         Institution $identityInstitution,
         string $event,
         StepupDateTime $recordedOn,
-        IdentityId $actorId = null,
-        Institution $actorInstitution = null,
-        SecondFactorId $secondFactorId = null,
-        SecondFactorType $secondFactorType = null,
+        ?IdentityId $actorId = null,
+        ?Institution $actorInstitution = null,
+        ?SecondFactorId $secondFactorId = null,
+        ?SecondFactorType $secondFactorType = null,
         ?YubikeyPublicId $secondFactorIdentifier = null,
         ?CommonName $actorCommonName = null,
     ): AuditLogEntry {

src/Surfnet/StepupMiddleware/CommandHandlingBundle/EventSourcing/MetadataEnricher.php

@@ -26,5 +26,5 @@ interface MetadataEnricher
      * @param Metadata|null $metadata
      * @return void
      */
-    public function setMetadata(Metadata $metadata = null): void;
+    public function setMetadata(?Metadata $metadata = null): void;
 }

src/Surfnet/StepupMiddleware/CommandHandlingBundle/EventSourcing/MetadataEnrichingEventStreamDecorator.php

@@ -28,7 +28,7 @@ final class MetadataEnrichingEventStreamDecorator implements EventStreamDecorato
 {
     private ?Metadata $metadata = null;
 
-    public function setMetadata(Metadata $metadata = null): void
+    public function setMetadata(?Metadata $metadata = null): void
     {
         $this->metadata = $metadata;
     }

src/Surfnet/StepupMiddleware/CommandHandlingBundle/Exception/SecondFactorNotAllowedException.php

@@ -36,7 +36,7 @@ public function getErrors(): array
         return $this->errors;
     }
 
-    public function __construct(string $message = "", int $code = 0, Throwable $previous = null)
+    public function __construct(string $message = "", int $code = 0, ?Throwable $previous = null)
     {
         parent::__construct($message, $code, $previous);
 

src/Surfnet/StepupMiddleware/CommandHandlingBundle/Identity/CommandHandler/Exception/DuplicateIdentityException.php

@@ -24,7 +24,7 @@
 
 final class DuplicateIdentityException extends RuntimeException
 {
-    public function __construct(string $message = "", int $code = 0, Throwable $previous = null)
+    public function __construct(string $message = "", int $code = 0, ?Throwable $previous = null)
     {
         parent::__construct($message, $code, $previous);
     }

src/Surfnet/StepupMiddleware/CommandHandlingBundle/SensitiveData/EventSourcing/SensitiveDataMessageStream.php

@@ -74,7 +74,7 @@ public function getIterator(): Iterator
 
     private function setSensitiveData(
         DomainMessage $domainMessage,
-        SensitiveDataMessage $sensitiveDataMessage = null,
+        ?SensitiveDataMessage $sensitiveDataMessage = null,
     ): void {
         $event = $domainMessage->getPayload();
         $eventIsForgettable = $event instanceof Forgettable;

src/Surfnet/StepupMiddleware/CommandHandlingBundle/Tests/Configuration/CommandHandler/ConfigurationCommandHandlerTest.php

@@ -167,7 +167,7 @@ private function createNewConfigurationCreatedEvent(): NewConfigurationCreatedEv
     /**
      * @return array
      */
-    private function createConfigurationUpdatedEvents(array $newConfiguration, array $oldConfiguration = null): array
+    private function createConfigurationUpdatedEvents(array $newConfiguration, ?array $oldConfiguration = null): array
     {
         return [
             new ConfigurationUpdatedEvent(self::CID, $newConfiguration, $oldConfiguration),

src/Surfnet/StepupMiddleware/CommandHandlingBundle/Tests/DateTimeHelper.php

@@ -28,7 +28,7 @@ class DateTimeHelper
      *
      * @param DateTime|null $now
      */
-    public static function setCurrentTime(DateTime $now = null): void
+    public static function setCurrentTime(?DateTime $now = null): void
     {
         $nowProperty = new ReflectionProperty(DateTime::class, 'now');
         $nowProperty->setValue($now);

src/Surfnet/StepupMiddleware/CommandHandlingBundle/Twig/BackwardsCompatibleExtension.php

@@ -45,7 +45,7 @@ public function localizedDate(
         DateTimeInterface|string|null $date,
         ?string $dateFormat = 'medium',
         ?string $timeFormat = 'medium',
-        string $locale = null
+        ?string $locale = null
     ): string {
         return $this->intlExtension->formatDateTime($env, $date, $dateFormat, $timeFormat, locale: $locale);
     }

symfony.lock

@@ -135,9 +135,6 @@
     "guzzlehttp/psr7": {
         "version": "1.6.1"
     },
-    "hamcrest/hamcrest-php": {
-        "version": "v2.0.0"
-    },
     "incenteev/composer-parameter-handler": {
         "version": "v2.1.4"
     },

tests/bootstrap.php

@@ -16,6 +16,10 @@
  * limitations under the License.
  */
 
+// Suppress vendor E_DEPRECATED notices (e.g. Mockery implicit nullable params in PHP 8.4+)
+// before autoloading to avoid noise in RunInSeparateProcess subprocess output.
+error_reporting(E_ALL & ~E_DEPRECATED & ~E_USER_DEPRECATED);
+
 use Symfony\Component\Dotenv\Dotenv;
 
 require dirname(__DIR__).'/vendor/autoload.php';