Mago

[tijsverkoyen]

Summary by Sourcery

Integrate Mago-based static analysis and formatting into the project, refresh dependencies and Symfony-related configuration, and tighten type safety, security, and tests around user management, while enhancing CI pipelines and workflows for improved code quality and reliability.

New Features:

• Integrate Mago static analysis tooling into the project with configuration and CI jobs for formatting, linting, analysis, and structural guard checks.
• Add a GitHub Actions workflow to exercise the project skeleton creation across PHP versions.

Bug Fixes:

• Harden handling of tokens, secrets, JSON payloads, and session data by adding sensitive parameter attributes, null/empty checks, strict comparisons, and runtime safeguards.
• Ensure user-facing flows (confirmation, reset password, 2FA, registration, profile updates) behave correctly when invalid tokens or missing data are encountered.

Enhancements:

• Upgrade front-end and dev dependencies such as symfony/ux-turbo, symfonycasts/sass-bundle, tom-select, sortablejs, axios, and deployer to newer versions.
• Improve type safety and documentation across configuration references, entities, DTOs, messages, forms, validators, repositories, and security components using stricter PHPDoc and attributes.
• Modernize tests and code style by adopting PHPUnit static assertions, refining mocks, and aligning with the new code-quality tooling.
• Refine Doctrine and asset mapper configuration to match updated Symfony best practices and naming strategies.

Build:

• Extend importmap definitions for updated JS/CSS packages and adjust Symfony asset mapper exclusions.
• Add Mago to composer dev requirements and configure PHPStan, web profiler, and Doctrine settings for the updated stack.

CI:

• Expand GitLab CI with interruptible jobs, improved caching, and dedicated Mago, PHP_CodeSniffer, PHPStan, Twig-CS-Fixer, Stylelint, and dependency scanning stages.
• Introduce a GitHub Actions workflow to validate the application skeleton with composer on each branch.

Tests:

• Strengthen and modernize the test suite around user repository, handlers, security, and value objects to better cover email, token, password, and 2FA behaviours while aligning with new tooling expectations.

Chores:

• Apply widespread code-style adjustments for arrays, strings, exception handling, and controller patterns to conform to Mago and updated PSR/Symfony conventions.

• Resolves CVE-2026-45075 — CVE-2026-45075: HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]
• Resolves 1/2 issues in symfony/mime
• Resolves CVE-2026-45077 — CVE-2026-45077: Unauthenticated PHP Object Deserialization in MonologBridge server:log Listener
• Resolves 3/5 issues in symfony/security-http
• Resolves 5/16 issues in twig/twig
• Resolves 1/2 issues in spomky-labs/otphp

[sourcery-ai]

Reviewer's Guide

This PR integrates the Mago static analysis/formatter toolchain and improves type-safety and security across the user management domain, while updating CI, importmap, and several Symfony-/Sass-related configurations for newer versions and stricter typing.

Sequence diagram for the updated password reset flow

sequenceDiagram
    actor User
    participant ResetPasswordController
    participant UserRepository
    participant MessageBus
    participant ResetPasswordHandler
    participant User

    User->>ResetPasswordController: __invoke(token, request)
    ResetPasswordController->>UserRepository: checkResetToken(token)
    UserRepository-->>ResetPasswordController: User|null
    alt valid user
        ResetPasswordController->>MessageBus: dispatch(ResetPassword)
        MessageBus->>ResetPasswordHandler: __invoke(ResetPassword)
        ResetPasswordHandler->>User: setPassword(password)
        ResetPasswordHandler->>User: erasePasswordResetRequest()
        ResetPasswordHandler->>UserRepository: save()
        ResetPasswordController-->>User: redirectToRoute("login")
    else invalid user
        ResetPasswordController-->>User: addFlash("error")
        ResetPasswordController-->>User: redirectToRoute("user_forgot_password")
    end

Loading

File-Level Changes

Change	Details	Files
Update importmap entries and versions and add detailed return-type documentation.	Add a precise array-shape phpdoc for importmap.php return value, including local and remote asset structures. Reformat importmap entries into compact one-line arrays. Bump versions for tom-select, sortablejs, axios, and keep other asset entries aligned with current toolchain.	importmap.php
Tighten configuration type definitions and add/deprecate options for Symfony framework, Doctrine, and related bundles.	Refine psalm types in config/reference.php: allow scalar-or-list unions, add optional fields (decorates_tag, webhook headers, json_streamer options, etc.), and document deprecated options. Adjust Doctrine-related configuration comments (e.g. default_dbname description, cache lifetimes, class optionality).	config/reference.php
Enhance CI/CD pipelines with Mago, better caching, and interruptible jobs, plus GitHub workflow for skeleton tests.	Add workflow.auto_cancel to GitLab CI and mark most jobs interruptible. Extend cache paths to include var/sass. Introduce Mago-based jobs (fmt, lint, analyse, guard) with appropriate needs and allow_failure on some. Tighten scripts in existing jobs (quoted CI_JOB_STATUS comparisons, extra flags) and mark dependency scanning, outdated packages, tests, and deploy stages as interruptible or non-interruptible as appropriate. Add a GitHub Actions workflow to create a project skeleton against current branch using PHP 8.5 and Node/Volta.	.gitlab-ci.yml .github/workflows/php.yml
Strengthen domain model typing and security in the User entity and related message/DTOs.	Add non-empty-string and array-key generics to User email/roles, plus type-hinted getters and display roles. Mark sensitive parameters (passwords, TOTP secrets, tokens) with #[\SensitiveParameter]. Improve TOTP configuration by throwing when secret is null and tightening types (return ?string, TotpConfiguration). Make backup code handling strict (strict in_array, array_search, parameter rename). Change CustomAuthenticator LOGIN_ROUTE to a typed const and adjust onAuthenticationSuccess logic. Update message classes (ChangeEmail, ChangePassword, ResetPassword, RegisterUser, Enable2Fa, etc.) with stricter assertions and readonly properties.	src/Entity/User/User.php src/Security/CustomAuthenticator.php src/Message/User/ChangeEmail.php src/Message/User/ChangePassword.php src/Message/User/ConfirmUser.php src/Message/User/DisableUser.php src/Message/User/EnableUser.php src/Message/User/SendConfirmation.php src/Message/User/UpdateUser.php src/Message/User/ResetPassword.php src/Message/User/RegisterUser.php src/Message/User/Enable2Fa.php src/DataTransferObject/User/UserDataTransferObject.php
Harden repository and controller logic around tokens, filters, and 2FA secrets, and improve null/empty handling.	Mark token parameters in UserRepository and controllers as SensitiveParameter and adjust query builder style and exception unions. Change filter term handling to explicit null/empty checks. Ensure TOTP-related controllers treat missing/blank secrets as error conditions and cast session values to the right type. Adjust PasswordStrengthController to decode JSON safely with exception handling and default to empty password on error. Tweak UserTotpCodeValidator to trim values, cast to string, and simplify violation building.	src/Repository/User/UserRepository.php src/Controller/User/ConfirmController.php src/Controller/User/ResetPasswordController.php src/Controller/User/ResendConfirmationController.php src/Controller/User/Profile/TwoFactorController.php src/Controller/User/Profile/TwoFactorQrCodeController.php src/Controller/User/Ajax/PasswordStrengthController.php src/Validator/User/UserTotpCodeValidator.php
Refine user-facing controllers and forms for profile, admin, and auth flows with better typing, final classes, and flash message consistency.	Make EmailController final and annotate CurrentUser parameters explicitly; add @mago-expect comments where needed. Update EditUserController, OverviewController, AddUserController, LoginController, RegisterController, ForgotPasswordController, PasswordController, HomeController, ProfileController to consistently dispatch typed messages, handle form data via DTOs, and standardize translator->trans call formatting. Improve Form types (UserType, LoginType, ChangePasswordType, RegisterType, Reset/Forgot/Enable2Fa, FilterType, ChangeEmailType, RepeatedPasswordStrengthType) with generic @extends annotations, specific data classes, and minor option/array syntax tweaks.	src/Controller/User/Profile/EmailController.php src/Controller/User/Admin/EditUserController.php src/Controller/User/Admin/OverviewController.php src/Controller/User/Admin/AddUserController.php src/Controller/User/LoginController.php src/Controller/User/RegisterController.php src/Controller/User/ForgotPasswordController.php src/Controller/User/Profile/PasswordController.php src/Controller/User/ProfileController.php src/Controller/HomeController.php src/Form/User/Admin/UserType.php src/Form/User/LoginType.php src/Form/User/Admin/ChangePasswordType.php src/Form/User/RegisterType.php src/Form/User/RepeatedPasswordStrengthType.php src/Form/User/ChangeEmailType.php src/Form/User/Admin/FilterType.php src/Form/User/Enable2FaType.php src/Form/User/ForgotPasswordType.php src/Form/User/ResetPasswordType.php
Align tests with static analysis expectations and modern PHPUnit style while adding explicit runtime checks.	Replace $this->assert* with static::assert* across test classes. In repository/handler tests, add @mago-expect annotations for mixed-property/method access, literal passwords, mixed-argument, etc. Guard against null tokens by throwing RuntimeException before using them and cast paginator results via iterator_to_array. Assert email messages as RawMessage instances and handle possibly-null tokens in SendPasswordResetHandlerTest. Update Disable2FaHandlerTest to accommodate changed Disable2Fa signature. Tighten RoleTest and UserCheckerTest expectations to static asserts and clarify behavior.	tests/Repository/User/UserRepositoryTest.php tests/MessageHandler/User/RegisterUserHandlerTest.php tests/Entity/User/UserTest.php tests/Validator/User/UniqueEmailValidatorTest.php tests/MessageHandler/User/SendConfirmationHandlerTest.php tests/MessageHandler/User/SendPasswordResetHandlerTest.php tests/MessageHandler/User/CreateUserHandlerTest.php tests/MessageHandler/User/ResetPasswordHandlerTest.php tests/MessageHandler/User/ChangePasswordHandlerTest.php tests/MessageHandler/User/Enable2FaHandlerTest.php tests/MessageHandler/User/ConfirmUserHandlerTest.php tests/MessageHandler/User/UpdateUserHandlerTest.php tests/ValueObject/User/RoleTest.php tests/Security/UserCheckerTest.php tests/MessageHandler/User/DisableUserHandlerTest.php tests/MessageHandler/User/EnableUserHandlerTest.php
Update Composer dependencies and Symfony configuration to newer ecosystem versions and simpler mappings.	Add carthage-software/mago dev dependency and bump symfony/ux-turbo, symfonycasts/sass-bundle, tijsverkoyen/deployer-sumo versions. Switch Doctrine ORM naming strategy from underscore_number_aware to underscore and remove controller_resolver auto_mapping. Adjust asset_mapper excluded_patterns and web_profiler profiler config to match newer Symfony defaults. Change public/index.php to return a static closure for Kernel instantiation. Simplify MenuListener getSubscribedEvents return type to array<string,string>.	composer.json composer.lock config/packages/doctrine.yaml config/packages/asset_mapper.yaml config/packages/web_profiler.yaml public/index.php src/EventListener/MenuListener.php symfony.lock
Introduce Mago configuration and expect-annotations to integrate with static analysis, linting, and guard tooling.	Add mago.dist.toml with source paths, glob options, formatter preferences, linter integrations, analyzer settings, guard structural rules and ignore patterns. Sprinkle //@mago-expect comments throughout controllers, tests, and DTOs to suppress or document known analysis/lint issues (mixed arguments, cyclomatic complexity, literal passwords, etc.).	mago.dist.toml tests/** src/**

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.