WIP: fix most of phpstan level 6 warnings

9 files changed, 69 insertions, 49 deletions

diff --git a/backend.php b/backend.php
index 9678fab..c2dd25e 100644
--- a/backend.php
+++ b/backend.php
@@ -261,7 +261,8 @@
 
 	case "define":
 		if (Config::get(Config::DICT_SERVER)) {
-			function parse_dict_reply($reply) {
+			/** @return array<string> */
+			function parse_dict_reply(string $reply) : array {
 				$tmp = [];
 
 				foreach (explode("\n", $reply) as $line) {
diff --git a/classes/config.php b/classes/config.php
index 3485081..e71f314 100644
--- a/classes/config.php
+++ b/classes/config.php
@@ -26,12 +26,16 @@ class Config {
 		Config::SESSION_NAME => [ "epube_sid", Config::T_STRING ],
 	];
 
+	/** @var Config|null */
 	private static $instance;
 
-	private $params = [];
-	private $version = [];
+	/** @var array<string, array<bool|int|string>> */
+	private array $params = [];
 
-	/** @var Db_Migrations|null $migrations */
+	/** @var array<string, mixed> */
+	private array $version = [];
+
+	/** @var Db_Migrations|null */
 	private $migrations;
 
 	public static function get_instance() : Config {
@@ -63,11 +67,13 @@ class Config {
 		directory, its contents are displayed instead of git commit-based version, this could be generated
 		based on source git tree commit used when creating the package */
 
-	static function get_version(bool $as_string = true) {
+	/** @return string|array<string, mixed> */
+	static function get_version(bool $as_string = true) : mixed {
 		return self::get_instance()->_get_version($as_string);
 	}
 
-	private function _get_version(bool $as_string = true) {
+	/** @return string|array<string, mixed> */
+	private function _get_version(bool $as_string = true) : mixed {
 		$root_dir = dirname(__DIR__);
 
 		if (empty($this->version)) {
@@ -93,7 +99,8 @@ class Config {
 		return $as_string ? $this->version["version"] : $this->version;
 	}
 
-	static function get_version_from_git(string $dir) {
+	/** @return array<string, mixed> */
+	static function get_version_from_git(string $dir) : array {
 		$descriptorspec = [
 			1 => ["pipe", "w"], // STDOUT
 			2 => ["pipe", "w"], // STDERR
@@ -159,7 +166,8 @@ class Config {
 		return self::get_migrations()->get_version();
 	}
 
-	static function cast_to(string $value, int $type_hint) {
+	/** @return int|bool|string */
+	static function cast_to(string $value, int $type_hint) : mixed {
 		switch ($type_hint) {
 			case self::T_BOOL:
 				return sql_bool_to_bool($value);
@@ -170,24 +178,26 @@ class Config {
 		}
 	}
 
-	private function _get(string $param) {
+	/** @return int|bool|string */
+	private function _get(string $param) : mixed {
 		list ($value, $type_hint) = $this->params[$param];
 
 		return $this->cast_to($value, $type_hint);
 	}
 
-	private function _add(string $param, string $default, int $type_hint) {
+	private function _add(string $param, string $default, int $type_hint) : void {
 		$override = getenv($this::_ENVVAR_PREFIX . $param);
 
 		$this->params[$param] = [ self::cast_to(!empty($override) ? $override : $default, $type_hint), $type_hint ];
 	}
 
-	static function add(string $param, string $default, int $type_hint = Config::T_STRING) {
+	static function add(string $param, string $default, int $type_hint = Config::T_STRING) : void {
 		$instance = self::get_instance();
 
-		return $instance->_add($param, $default, $type_hint);
+		$instance->_add($param, $default, $type_hint);
 	}
 
+	/** @return int|bool|string */
 	static function get(string $param) {
 		$instance = self::get_instance();
 
@@ -214,7 +224,7 @@ class Config {
 	}
 
 	/** also initializes Db and ORM */
-	static function sanity_check() {
+	static function sanity_check() : void {
 
 		/*
 			we don't actually need the DB object right now but some checks below might use ORM which won't be initialized
@@ -399,7 +409,7 @@ class Config {
 		}
 	}
 
-	private static function format_error($msg) {
+	private static function format_error(string $msg) : string {
 		return "<div class=\"alert alert-danger\">$msg</div>";
 	}
 }
diff --git a/classes/db.php b/classes/db.php
index 61467eb..d815095 100644
--- a/classes/db.php
+++ b/classes/db.php
@@ -1,7 +1,9 @@
 <?php
 class Db {
+	/** @var Db|null */
 	private static $instance;
-	private $pdo;
+
+	private PDO $pdo;
 
 	private function __construct() {
 		try {
@@ -24,7 +26,7 @@ class Db {
 		}
 	}
 
-	public static function get_dsn() {
+	public static function get_dsn() : string {
 		return Config::get(Config::DB_TYPE) . ':' . Config::get(Config::SCRATCH_DB);
 	}
 
diff --git a/classes/db/migrations.php b/classes/db/migrations.php
index 495dfc6..7d1362b 100644
--- a/classes/db/migrations.php
+++ b/classes/db/migrations.php
@@ -6,7 +6,7 @@ class Db_Migrations {
 	private $migrations_path;
 	private $migrations_table;
 	private $base_is_latest;
-	private $pdo;
+	private PDO $pdo;
 
 	private $cached_version;
 	private $cached_max_version;
diff --git a/classes/debug.php b/classes/debug.php
index a0dcac3..79116cd 100644
--- a/classes/debug.php
+++ b/classes/debug.php
@@ -5,43 +5,43 @@ class Debug {
     const LOG_VERBOSE = 1;
     const LOG_EXTENDED = 2;
 
-	public static $LOG_DISABLED = -1;
-    public static $LOG_NORMAL = 0;
-    public static $LOG_VERBOSE = 1;
-    public static $LOG_EXTENDED = 2;
+	public static int $LOG_DISABLED = -1;
+    public static int $LOG_NORMAL = 0;
+    public static int $LOG_VERBOSE = 1;
+    public static int $LOG_EXTENDED = 2;
 
-    private static $enabled = false;
-    private static $quiet = false;
-    private static $logfile = false;
-    private static $loglevel = 0;
+    private static bool $enabled = false;
+    private static bool $quiet = false;
+    private static string $logfile = "";
+    private static int $loglevel = 0;
 
-	public static function set_logfile($logfile) {
+	public static function set_logfile(string $logfile) : void {
         self::$logfile = $logfile;
     }
 
-    public static function enabled() {
+    public static function enabled() : bool {
         return self::$enabled;
     }
 
-    public static function set_enabled($enable) {
+    public static function set_enabled(bool $enable) : void {
         self::$enabled = $enable;
     }
 
-    public static function set_quiet($quiet) {
+    public static function set_quiet(bool $quiet) : void {
         self::$quiet = $quiet;
     }
 
-    public static function set_loglevel($level) {
+    public static function set_loglevel(int $level) : void {
         self::$loglevel = $level;
     }
 
-    public static function get_loglevel() {
+    public static function get_loglevel() : int {
         return self::$loglevel;
     }
 
-    public static function log($message, $level = 0) {
+    public static function log(string $message, int $level = 0) : void {
 
-        if (!self::$enabled || self::$loglevel < $level) return false;
+        if (!self::$enabled || self::$loglevel < $level) return;
 
         $ts = strftime("%H:%M:%S", time());
         if (function_exists('posix_getpid')) {
diff --git a/classes/sanitizer.php b/classes/sanitizer.php
index cf68632..5e75276 100644
--- a/classes/sanitizer.php
+++ b/classes/sanitizer.php
@@ -1,7 +1,7 @@
 <?php
 class Sanitizer {
 
-	public static function rewrite_relative($url, $rel_url) {
+	public static function rewrite_relative(string $url, string $rel_url) : string {
 
 		$rel_parts = parse_url($rel_url);
 
@@ -31,7 +31,7 @@ class Sanitizer {
 		}
 	}
 
-	public static function sanitize($str, $force_remove_images = false) {
+	public static function sanitize(string $str) : string {
 
 		$res = trim($str); if (!$res) return '';
 
@@ -99,7 +99,11 @@ class Sanitizer {
 		}
 	}
 
-	private static function strip_harmful_tags($doc, $allowed_elements, $disallowed_attributes) {
+	/**
+	 * 	@param array<string> $allowed_elements
+	 * 	@param array<string> $disallowed_attributes
+	 * */
+	private static function strip_harmful_tags(DOMDocument $doc, array $allowed_elements, array $disallowed_attributes) : DOMDocument {
 		$xpath = new DOMXPath($doc);
 		$entries = $xpath->query('//*');
 
@@ -140,7 +144,8 @@ class Sanitizer {
 	}
 
 	// extended filtering involves validation for safe ports and loopback
-	static function validate($url, $extended_filtering = false) {
+	/** @return string|bool */
+	static function validate(string $url, bool $extended_filtering = false) : mixed {
 
 		$url = trim($url);
 
@@ -197,7 +202,8 @@ class Sanitizer {
 		return $url;
 	}
 
-	static function build_url($parts) {
+	/** @param array<string, int|string|false> $parts */
+	static function build_url(array $parts) : string {
 		$tmp = $parts['scheme'] . "://" . $parts['host'];
 
 		if (isset($parts['path'])) $tmp .= $parts['path'];
@@ -207,7 +213,8 @@ class Sanitizer {
 		return $tmp;
 	}
 
-	static function resolve_redirects($url, $timeout, $nest = 0) {
+	/** @return string|bool */
+	static function resolve_redirects(string $url, int $timeout, int $nest = 0) : mixed {
 
 		// too many redirects
 		if ($nest > 10)
diff --git a/include/common.php b/include/common.php
index ee3921b..2e179e6 100644
--- a/include/common.php
+++ b/include/common.php
@@ -9,23 +9,23 @@
 	require_once "autoload.php";
 
 	/** its a dummy :( */
-	function T_sprintf(...$args) {
+	function T_sprintf(mixed ...$args) : string {
 		return sprintf(...$args);
 	}
 
-	function validate_csrf($csrf_token) {
-		return isset($csrf_token) && hash_equals($_SESSION['csrf_token'] ?? "", $csrf_token);
+	function validate_csrf(string $csrf_token) : bool {
+		return $csrf_token && hash_equals($_SESSION['csrf_token'] ?? "", $csrf_token);
 	}
 
-	function sql_bool_to_bool($s) {
+	function sql_bool_to_bool(mixed $s) : bool {
 		return $s && ($s !== "f" && $s !== "false"); //no-op for PDO, backwards compat for legacy layer
 	}
 
-	function bool_to_sql_bool($s) {
+	function bool_to_sql_bool(bool $s) : int {
 		return $s ? 1 : 0;
 	}
 
-	function read_stdin() {
+	function read_stdin() : string {
 		$fp = fopen("php://stdin", "r");
 
 		if ($fp) {
@@ -34,5 +34,5 @@
 			return $line;
 		}
 
-		return null;
+		return "";
 	}
diff --git a/include/sessions.php b/include/sessions.php
index aa0cd94..e92a7d9 100644
--- a/include/sessions.php
+++ b/include/sessions.php
@@ -26,7 +26,7 @@
 		ini_get("session.cookie_secure"),
 		ini_get("session.cookie_httponly"));
 
-	function validate_session() {
+	function validate_session() : bool {
 		if (!empty($_SESSION["owner"])) {
 
 			$user = ORM::for_table('epube_users')
@@ -41,7 +41,7 @@
 		return false;
 	}
 
-	function logout_user() {
+	function logout_user() : void {
 		if (session_status() == PHP_SESSION_ACTIVE) {
 			session_destroy();
 
diff --git a/phpstan.neon b/phpstan.neon
index f22fd35..64014ed 100644
--- a/phpstan.neon
+++ b/phpstan.neon
@@ -1,5 +1,5 @@
 parameters:
-   level: 5
+   level: 6
    ignoreErrors:
       #- '#Comparison operation ">" between int<1, max> and 0 is always true.#'
       #- '#Access to an undefined property DOMNode::\$tagName.#'