refactor: Code cleanup Pt4

[Ninerian]

• raised phpstan level to 9 and fixed all issues

[Copilot]

Pull request overview

This PR continues the cleanup series by tightening types/guard clauses to satisfy PHPStan level 9 across the SDK, with small accompanying test adjustments.

Changes:

• Raised PHPStan strictness to level 9 and updated code to satisfy stricter type expectations.
• Hardened session access and request parameter handling to avoid invalid $_SESSION/$_REQUEST shapes.
• Added stricter claim type validation/casting for JWT data access and token generation.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
phpstan.neon.dist	Raises PHPStan level to 9.
src/PluginSession.php	Normalizes request params to `string
src/RemoteCall/DeleteInstanceTrait.php	Marks deleteInstance() as never (assumes termination).
src/SessionHandling/SessionHandlerTrait.php	Adds defensive checks around $_SESSION structure before access/mutation.
src/SSOTokenGenerator.php	Validates/coerces registered claims before building a token.
src/SSOData/ClaimAccessTrait.php	Keeps getClaimSafe() generic; relies on typed getters for safety.
src/SSOData/SharedDataTrait.php	Ensures shared claim getters return correct types (or null).
src/SSOData/SSODataTrait.php	Ensures SSO-specific claim getters return correct types (or null).
test/PluginSessionTest.php	Adjusts tests for stricter typing and remote-call exit behavior.
test/SSOTokenTest.php	Adjusts reflection usage and assertion message formatting for PHPStan.

Comments suppressed due to low confidence (1)

src/PluginSession.php:184

• The PID/JWT conflict check now triggers whenever both query params are present (non-null), even if one/both are empty strings (e.g. ?pid=&jwt=). Previously, empty values were treated as “missing” and produced the more appropriate “Missing PID or JWT…” error. Consider checking for non-empty strings (e.g. $pid !== '' && $jwt !== '') rather than only non-null, so empty inputs don’t get misclassified as a conflict.

        // lets hint to bad class usage, as these cases should never happen.
        if ($pid !== null && $jwt !== null) {
            throw new SSOAuthenticationException('Tried to initialize the session with both PID and JWT provided.');
        }

        if (empty($pid) && empty($jwt)) {
            throw new SSOAuthenticationException('Missing PID or JWT query parameter in Request.');
        }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[m-seidel]

[Copilot]

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

deleteInstance() is documented as @return never and it always terminates via exitSuccess/exitFailure followed by exitRemoteCall(), but its signature is still : void. This mismatch makes the control-flow contract unclear for static analysis and readers. Consider changing the return type to never (or, if it can return in some scenarios, adjust the docblock accordingly).

Suggested change

	private function deleteInstance(string $instanceId, RemoteCallInterface $remoteCallHandler): void
	private function deleteInstance(string $instanceId, RemoteCallInterface $remoteCallHandler): never

[Copilot]

After setting expectException(...), the constructor call is expected to throw, so the subsequent assertInstanceOf(...) will never execute and $session is never usable. Remove the unreachable assertion (or restructure with a try/catch if you want to assert on the partially-created object).

Suggested change

$this->assertInstanceOf($this->classname, $session);

[Copilot]

Same issue as above: once expectException(...) is set, the new $Session(...) line is expected to throw, so the following assertInstanceOf(...) is unreachable and $session cannot be inspected. Remove the unreachable assertion or restructure the test to keep the assertion meaningful.

Suggested change

$this->assertInstanceOf($this->classname, $session);