mirror of
https://github.com/karatektus/pl_mail.git
synced 2026-10-25 01:54:10 +00:00
Paul LütznerandClaude Opus 5
ddccc8fa2e
55k lines of PHP with no static analysis, and a dependency tree holding four OAuth clients, a JWT library and an IMAP parser with nothing watching it for advisories. PHPStan at level 5 with a baseline. Level 5 is where the class of defect this codebase actually has starts showing up — nullable entity getters flowing into non-nullable parameters — without a fortnight of triage first. 208 findings are baselined as a debt ledger, not a licence; the level goes up when the ledger is small enough that raising it is a day's work. Two of the 217 were real bugs, both fixed here rather than baselined: "Test connection" in account settings constructed ConnectionTestResult with four arguments where six are required, and passed null for a string parameter. Both call sites are the early returns for an incomplete form and a blank password — that is, the two cases the button exists to report, each of which raised an ArgumentCountError instead. GraphCategorySyncer caught App\Service\Mail\GraphApiException, which does not exist; the client throws App\Domain\Exception\GraphApiException. The catch never matched, so the 403 that means "this account needs reconnecting with MailboxSettings.ReadWrite" propagated as an unhandled error instead of degrading quietly, which is what the comment inside it says it is there to do. One more it found is left alone deliberately, because it needs a decision rather than a fix: Controller/Admin/User/DefaultController references App\Form\Admin\UserFormType and User::setName(), neither of which exists, so that admin page fatals on load. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>