From 4698734f74e6f760f12f65372186d8c9b09772fb Mon Sep 17 00:00:00 2001 From: Max Scholz Date: Fri, 23 Oct 2026 01:05:12 +0200 Subject: [PATCH 1/5] fix: use explicit nullable types for PHP 8.4+ PHP 8.4 deprecates implicitly nullable parameters, so every request that loads PluginSession logged a deprecation for destroySession(). Co-authored-by: OpenCode Co-authored-by: GitHub Copilot --- src/SSOTokenGenerator.php | 2 +- src/SessionHandling/SessionHandlerTrait.php | 2 +- test/PluginSessionTest.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/SSOTokenGenerator.php b/src/SSOTokenGenerator.php index 8d6230d..59cbe6b 100644 --- a/src/SSOTokenGenerator.php +++ b/src/SSOTokenGenerator.php @@ -34,7 +34,7 @@ class SSOTokenGenerator * * @return string Encoded token. */ - public static function createSignedTokenFromData(string $privateKey, array $tokenData, Signer $signer = null): string + public static function createSignedTokenFromData(string $privateKey, array $tokenData, ?Signer $signer = null): string { $config = Configuration::forSymmetricSigner($signer ?: new Sha256(), InMemory::plainText($privateKey)); diff --git a/src/SessionHandling/SessionHandlerTrait.php b/src/SessionHandling/SessionHandlerTrait.php index 3d88898..2bf3c7d 100644 --- a/src/SessionHandling/SessionHandlerTrait.php +++ b/src/SessionHandling/SessionHandlerTrait.php @@ -116,7 +116,7 @@ public function setSessionVar($key, $val, ?string $parentKey = null): void * @param String|null $sessionId * @return bool true on success or false on failure. */ - public function destroySession(String $sessionId = null): bool + public function destroySession(?string $sessionId = null): bool { $sessionId = $sessionId ?: $this->sessionId; diff --git a/test/PluginSessionTest.php b/test/PluginSessionTest.php index efd7c76..02db408 100644 --- a/test/PluginSessionTest.php +++ b/test/PluginSessionTest.php @@ -61,7 +61,7 @@ public function __construct() * @param string|null $queryParamJwt JWT query param emulation * @param boolean $clearSession optionally clear out the $_SESSION array */ - private function setupEnvironment(string $queryParamPid = null, string $queryParamJwt = null, bool $clearSession = true) + private function setupEnvironment(?string $queryParamPid = null, ?string $queryParamJwt = null, bool $clearSession = true) { $_REQUEST[PluginSession::QUERY_PARAM_PID] = $queryParamPid; From 976c1536e1dc24af9b557048b1ad30b70d2a2154 Mon Sep 17 00:00:00 2001 From: Max Scholz Date: Fri, 23 Oct 2026 01:05:20 +0200 Subject: [PATCH 2/5] test: create RSA test keys with ext-openssl instead of phpseclib 2 Composer blocks phpseclib/phpseclib ^2.0 because of security advisories, so dependencies could not be installed and CI failed. The tests only used it to create key pairs, which ext-openssl can do. Co-authored-by: OpenCode Co-authored-by: GitHub Copilot --- composer.json | 1 - test/PluginSessionTest.php | 7 +------ test/SSOTestData.php | 16 ++++++++++++++++ test/SSOTokenTest.php | 7 +------ 4 files changed, 18 insertions(+), 13 deletions(-) diff --git a/composer.json b/composer.json index a355af8..77c6695 100644 --- a/composer.json +++ b/composer.json @@ -19,7 +19,6 @@ }, "require-dev": { - "phpseclib/phpseclib": "^2.0", "phpunit/phpunit": "^9.0" }, "autoload": { diff --git a/test/PluginSessionTest.php b/test/PluginSessionTest.php index 02db408..bc00e75 100644 --- a/test/PluginSessionTest.php +++ b/test/PluginSessionTest.php @@ -12,7 +12,6 @@ namespace Staffbase\plugins\test; use ReflectionClass; -use phpseclib\Crypt\RSA; use PHPUnit\Framework\TestCase; use SessionHandlerInterface; use Staffbase\plugins\sdk\Exceptions\SSOAuthenticationException; @@ -42,11 +41,7 @@ public function __construct() { parent::__construct(); - $rsa = new RSA(); - $keypair = $rsa->createKey(2048); - - $this->publicKey = $keypair['publickey']; - $this->privateKey = $keypair['privatekey']; + [$this->publicKey, $this->privateKey] = SSOTestData::createKeyPair(); $this->tokenData = SSOTestData::getTokenData(); $this->token = SSOTokenGenerator::createSignedTokenFromData($this->privateKey, $this->tokenData); diff --git a/test/SSOTestData.php b/test/SSOTestData.php index f7b8692..ac79cab 100644 --- a/test/SSOTestData.php +++ b/test/SSOTestData.php @@ -33,6 +33,22 @@ class SSOTestData private const CLAIM_USER_LOCALE = 'locale'; private const CLAIM_USER_TAGS = 'tags'; + /** + * Create an RSA-256 key pair in PEM format. + * + * @return array{0: string, 1: string} public key and private key + */ + public static function createKeyPair(): array + { + $key = openssl_pkey_new([ + 'private_key_bits' => 2048, + 'private_key_type' => OPENSSL_KEYTYPE_RSA, + ]); + openssl_pkey_export($key, $privateKey); + + return [openssl_pkey_get_details($key)['key'], $privateKey]; + } + /** * Create test data for a token. * diff --git a/test/SSOTokenTest.php b/test/SSOTokenTest.php index ec39aa5..2cf5e3b 100644 --- a/test/SSOTokenTest.php +++ b/test/SSOTokenTest.php @@ -12,7 +12,6 @@ namespace Staffbase\plugins\test; use DateTimeImmutable; -use phpseclib\Crypt\RSA; use PHPUnit\Framework\TestCase; use ReflectionClass; use Staffbase\plugins\sdk\Exceptions\SSOAuthenticationException; @@ -37,11 +36,7 @@ class SSOTokenTest extends TestCase public function setUp(): void { - $rsa = new RSA(); - $keypair = $rsa->createKey(2048); - - $this->publicKey = $keypair['publickey']; - $this->privateKey = $keypair['privatekey']; + [$this->publicKey, $this->privateKey] = SSOTestData::createKeyPair(); } /** From 130da02bff570d5c743a5bf287b3e1a641952eab Mon Sep 17 00:00:00 2001 From: Max Scholz Date: Fri, 23 Oct 2026 01:05:28 +0200 Subject: [PATCH 3/5] test: avoid null array key in isEditor test PHP 8.5 deprecates null as an array key. The null key also collided with the empty string key, so the null role case was never tested on its own. Co-authored-by: OpenCode Co-authored-by: GitHub Copilot --- test/SSOData/SSODataTest.php | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/test/SSOData/SSODataTest.php b/test/SSOData/SSODataTest.php index 7a825ac..c50188f 100644 --- a/test/SSOData/SSODataTest.php +++ b/test/SSOData/SSODataTest.php @@ -91,15 +91,15 @@ public function testIsEditorReturnsCorrectValues(): void { $map = [ - null => false, - '' => false, - 'use' => false, - 'edito' => false, - 'user' => false, - 'editor' => true, + [null, false], + ['', false], + ['use', false], + ['edito', false], + ['user', false], + ['editor', true], ]; - foreach ($map as $arg => $expect) { + foreach ($map as [$arg, $expect]) { $tokenData = SSOTestData::getTokenData(); $tokenData[SSOTestData::CLAIM_USER_ROLE] = $arg; From 00f2693a807bc5d157cdba5229c31a7082204a17 Mon Sep 17 00:00:00 2001 From: Max Scholz Date: Fri, 23 Oct 2026 01:05:28 +0200 Subject: [PATCH 4/5] ci: run tests on PHP 8.5 "^8.3" already allows PHP 8.4 and 8.5, so the extra "|| ^8.4" is dropped. Co-authored-by: OpenCode Co-authored-by: GitHub Copilot --- .github/workflows/php.yml | 2 +- composer.json | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/php.yml b/.github/workflows/php.yml index dc4557c..83591dc 100644 --- a/.github/workflows/php.yml +++ b/.github/workflows/php.yml @@ -12,7 +12,7 @@ jobs: strategy: matrix: operating-system: ['ubuntu-latest'] - php-versions: ['8.3', '8.4'] + php-versions: ['8.3', '8.4', '8.5'] phpunit-versions: ['latest'] steps: - name: Checkout diff --git a/composer.json b/composer.json index 77c6695..b29a6a9 100644 --- a/composer.json +++ b/composer.json @@ -13,7 +13,7 @@ } ], "require": { - "php": "^8.3 || ^8.4", + "php": "^8.3", "lcobucci/jwt": "^5.5", "lcobucci/clock": "^3.3" From e6a08e815f05389a17cb66bb8ada827a71305213 Mon Sep 17 00:00:00 2001 From: Max Scholz Date: Fri, 23 Oct 2026 01:05:29 +0200 Subject: [PATCH 5/5] chore: update version to 3.0.2 Co-authored-by: OpenCode Co-authored-by: GitHub Copilot --- composer.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/composer.json b/composer.json index b29a6a9..d79f91f 100644 --- a/composer.json +++ b/composer.json @@ -1,6 +1,6 @@ { "name": "staffbase/plugins-sdk-php", - "version": "3.0.1", + "version": "3.0.2", "type": "library", "description": "Staffbase PHP SDK library for plugins.", "keywords": ["staffbase", "plugins", "library", "php", "sdk"],