refactor: Code cleanup Pt4

[Ninerian]

• raised phpstan level to 9 and fixed all issues

[Copilot]

Pull request overview

This PR continues the cleanup series by tightening types/guard clauses to satisfy PHPStan level 9 across the SDK, with small accompanying test adjustments.

Changes:

• Raised PHPStan strictness to level 9 and updated code to satisfy stricter type expectations.
• Hardened session access and request parameter handling to avoid invalid $_SESSION/$_REQUEST shapes.
• Added stricter claim type validation/casting for JWT data access and token generation.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
phpstan.neon.dist	Raises PHPStan level to 9.
src/PluginSession.php	Normalizes request params to `string
src/RemoteCall/DeleteInstanceTrait.php	Marks deleteInstance() as never (assumes termination).
src/SessionHandling/SessionHandlerTrait.php	Adds defensive checks around $_SESSION structure before access/mutation.
src/SSOTokenGenerator.php	Validates/coerces registered claims before building a token.
src/SSOData/ClaimAccessTrait.php	Keeps getClaimSafe() generic; relies on typed getters for safety.
src/SSOData/SharedDataTrait.php	Ensures shared claim getters return correct types (or null).
src/SSOData/SSODataTrait.php	Ensures SSO-specific claim getters return correct types (or null).
test/PluginSessionTest.php	Adjusts tests for stricter typing and remote-call exit behavior.
test/SSOTokenTest.php	Adjusts reflection usage and assertion message formatting for PHPStan.

Comments suppressed due to low confidence (1)

src/PluginSession.php:184

• The PID/JWT conflict check now triggers whenever both query params are present (non-null), even if one/both are empty strings (e.g. ?pid=&jwt=). Previously, empty values were treated as “missing” and produced the more appropriate “Missing PID or JWT…” error. Consider checking for non-empty strings (e.g. $pid !== '' && $jwt !== '') rather than only non-null, so empty inputs don’t get misclassified as a conflict.

        // lets hint to bad class usage, as these cases should never happen.
        if ($pid !== null && $jwt !== null) {
            throw new SSOAuthenticationException('Tried to initialize the session with both PID and JWT provided.');
        }

        if (empty($pid) && empty($jwt)) {
            throw new SSOAuthenticationException('Missing PID or JWT query parameter in Request.');
        }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Changing deleteInstance() to return never can cause a runtime fatal error if a consumer overrides exitRemoteCall() (it’s protected) with an implementation that does not terminate execution. In that case, deleteInstance() would reach the end and violate the never contract. To avoid breaking extensibility/tests, consider keeping the return type void and using a PHPDoc @return never for static analysis, or alternatively also declare exitRemoteCall(): never to enforce the contract consistently.

Suggested change

	private function deleteInstance(string $instanceId, RemoteCallInterface $remoteCallHandler): never
	/**
	* Handle the delete-instance remote call and terminate the request.
	*
	* @param string $instanceId
	* @param RemoteCallInterface $remoteCallHandler
	*
	* @return never
	*/
	private function deleteInstance(string $instanceId, RemoteCallInterface $remoteCallHandler): void

[Copilot]

aud is validated as a non-empty string, but aud is commonly represented as an array (and SharedDataTrait::getAudience() explicitly supports array audiences). This makes token generation stricter/inconsistent with token parsing. Consider accepting string|array<string> here (e.g. if array, call permittedFor() for each value or pick the first) instead of throwing.

[m-seidel]

Suggested change

	$val = $this->getClaimSafe(SSODataClaimsInterface::CLAIM_USER_LOCALE);
	return is_string($val) ? $val : '';
	$value = $this->getClaimSafe(SSODataClaimsInterface::CLAIM_USER_LOCALE);
	return is_string($value) ? $value : '';

[m-seidel]

Suggested change

	$val = $this->getClaimSafe(SSODataClaimsInterface::CLAIM_USER_TAGS);
	return is_array($val) ? $val : null;
	$value = $this->getClaimSafe(SSODataClaimsInterface::CLAIM_USER_TAGS);
	return is_array($value) ? $value : null;

[m-seidel]