Upgrade PHPStan to 2.x and raise analysis level from 6 to 10

- Bump phpstan/phpstan ^2.0 and szepeviktor/phpstan-wordpress ^2.0
- Move the analysis level into phpstan.neon (single source) and raise it to 10
- Add Val, a runtime coercion helper that narrows untyped WordPress boundary
  values (wpdb rows, REST params, superglobals, options) with explicit checks
  instead of blind casts, plus unit tests
- Type value-object fromRow() params as stdClass (what wpdb returns) and map
  columns through Val so unexpected shapes degrade safely
- Use %i identifier placeholders for table names in all wpdb::prepare() calls
  so every query string is a literal and identifiers are escaped by WordPress;
  raises the minimum WordPress version to 6.2 where %i was introduced
- Guard wpdb::prepare() null result before wpdb::query() in updateTax()
- Fix nullable get_permalink()/strtotime() handling, list types at REST and
  capability call sites, dead null-coalescing on checked superglobals, and
  narrow get_users() results before mapping
- Register Val method names with the ValidatedSanitizedInput sniff so it
  validates the real sanitizer around each superglobal read
- Update repository unit tests for the %i placeholder arguments

Co-Authored-By: Claude Fable 5 <[email protected]>

src/Availability/AvailabilityController.php

@@ -6,6 +6,7 @@ namespace Unsupervised\Schedular\Availability;
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Offering\Offering;
 use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Val;
 
 class AvailabilityController {
 
@@ -34,14 +35,14 @@ class AvailabilityController {
 	private function handleFormAction( int $instructorId ): void {
 		// Nonce is verified by the caller (renderPage) before this method runs.
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
-		$action = sanitize_key( wp_unslash( $_POST['usc_action'] ?? '' ) );
+		$action = sanitize_key( Val::string( wp_unslash( $_POST['usc_action'] ?? '' ) ) );
 
 		if ( 'add' === $action ) {
 			$this->addSlot( $instructorId );
 		}
 
 		if ( 'delete' === $action ) {
-			$slotId = absint( $_POST['slot_id'] ?? 0 );
+			$slotId = absint( Val::int( $_POST['slot_id'] ?? 0 ) );
 			if ( $slotId > 0 ) {
 				$slot = $this->repository->findById( $slotId );
 				if ( $slot && $slot->instructorId === $instructorId ) {
@@ -54,15 +55,15 @@ class AvailabilityController {
 
 	private function addSlot( int $instructorId ): void {
 		// phpcs:disable WordPress.Security.NonceVerification.Missing
-		$startDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( wp_unslash( $_POST['start_dt'] ?? '' ) ) );
-		$endDt   = AvailabilitySlot::normalizeDateTime( sanitize_text_field( wp_unslash( $_POST['end_dt'] ?? '' ) ) );
+		$startDt = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['start_dt'] ?? '' ) ) ) );
+		$endDt   = AvailabilitySlot::normalizeDateTime( sanitize_text_field( Val::string( wp_unslash( $_POST['end_dt'] ?? '' ) ) ) );
 
 		if ( null === $startDt || null === $endDt || $endDt <= $startDt ) {
 			return;
 		}
 
-		$offeringId = absint( $_POST['offering_id'] ?? 0 );
-		$duration   = absint( $_POST['duration_minutes'] ?? 0 );
+		$offeringId = absint( Val::int( $_POST['offering_id'] ?? 0 ) );
+		$duration   = absint( Val::int( $_POST['duration_minutes'] ?? 0 ) );
 
 		$slot = new AvailabilitySlot(
 			instructorId:    $instructorId,
@@ -72,8 +73,8 @@ class AvailabilityController {
 			offeringId:      $offeringId > 0 ? $offeringId : null,
 		);
 
-		if ( 'weekly' === sanitize_key( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) ) {
-			$this->repository->createWeeklySeries( $slot, absint( $_POST['weeks'] ?? 1 ) );
+		if ( 'weekly' === sanitize_key( Val::string( wp_unslash( $_POST['recurrence'] ?? 'single' ) ) ) ) {
+			$this->repository->createWeeklySeries( $slot, absint( Val::int( $_POST['weeks'] ?? 1 ) ) );
 			return;
 		}
 

src/Availability/AvailabilityEndpoint.php

@@ -5,6 +5,7 @@ namespace Unsupervised\Schedular\Availability;
 
 use Unsupervised\Schedular\Auth\RoleManager;
 use Unsupervised\Schedular\Offering\OfferingRepository;
+use Unsupervised\Schedular\Val;
 
 class AvailabilityEndpoint {
 
@@ -13,6 +14,11 @@ class AvailabilityEndpoint {
 		private OfferingRepository $offerings,
 	) {}
 
+	/**
+	 * Registers this endpoint's REST routes.
+	 *
+	 * @param non-falsy-string $route_namespace REST namespace the routes are registered under (e.g. `us-scheduler/v1`).
+	 */
 	public function registerRoutes( string $route_namespace ): void {
 		register_rest_route(
 			$route_namespace,
@@ -96,11 +102,11 @@ class AvailabilityEndpoint {
 
 	public function index( \WP_REST_Request $request ): \WP_REST_Response {
 		$slots = $this->repository->findAvailable(
-			(int) $request->get_param( 'instructor_id' ),
-			(int) $request->get_param( 'offering_id' ),
-			(int) $request->get_param( 'duration_minutes' ),
-			(string) $request->get_param( 'from' ),
-			(string) $request->get_param( 'to' ),
+			Val::int( $request->get_param( 'instructor_id' ) ),
+			Val::int( $request->get_param( 'offering_id' ) ),
+			Val::int( $request->get_param( 'duration_minutes' ) ),
+			Val::string( $request->get_param( 'from' ) ),
+			Val::string( $request->get_param( 'to' ) ),
 		);
 
 		return new \WP_REST_Response( array_map( fn( AvailabilitySlot $s ) => $s->toArray(), $slots ), 200 );
@@ -108,8 +114,8 @@ class AvailabilityEndpoint {
 
 	public function create( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
 		$instructorId = get_current_user_id();
-		$offeringId   = absint( $request->get_param( 'offering_id' ) );
-		$duration     = absint( $request->get_param( 'duration_minutes' ) );
+		$offeringId   = absint( Val::int( $request->get_param( 'offering_id' ) ) );
+		$duration     = absint( Val::int( $request->get_param( 'duration_minutes' ) ) );
 
 		// A slot may only be tied to an offering the instructor owns, so it can
 		// never inherit another instructor's price or payment routing at booking.
@@ -120,8 +126,8 @@ class AvailabilityEndpoint {
 			}
 		}
 
-		$startDt = AvailabilitySlot::normalizeDateTime( (string) $request->get_param( 'start_dt' ) );
-		$endDt   = AvailabilitySlot::normalizeDateTime( (string) $request->get_param( 'end_dt' ) );
+		$startDt = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'start_dt' ) ) );
+		$endDt   = AvailabilitySlot::normalizeDateTime( Val::string( $request->get_param( 'end_dt' ) ) );
 
 		if ( null === $startDt || null === $endDt || $endDt <= $startDt ) {
 			return new \WP_Error( 'invalid_datetime', __( 'Provide a valid start and end, with the end after the start.', 'unsupervised-schedular' ), [ 'status' => 400 ] );
@@ -136,7 +142,7 @@ class AvailabilityEndpoint {
 		);
 
 		if ( 'weekly' === $request->get_param( 'recurrence' ) ) {
-			$ids = $this->repository->createWeeklySeries( $slot, absint( $request->get_param( 'weeks' ) ) );
+			$ids = $this->repository->createWeeklySeries( $slot, absint( Val::int( $request->get_param( 'weeks' ) ) ) );
 
 			return new \WP_REST_Response( [ 'ids' => $ids ], 201 );
 		}
@@ -147,7 +153,7 @@ class AvailabilityEndpoint {
 	}
 
 	public function delete( \WP_REST_Request $request ): \WP_REST_Response|\WP_Error {
-		$id   = absint( $request->get_param( 'id' ) );
+		$id   = absint( Val::int( $request->get_param( 'id' ) ) );
 		$slot = $this->repository->findById( $id );
 
 		if ( null === $slot ) {

src/Availability/AvailabilityRepository.php

@@ -116,11 +116,11 @@ class AvailabilityRepository {
 		}
 
 		$whereClause = implode( ' AND ', $where );
-		$sql         = "SELECT * FROM {$this->table} WHERE {$whereClause} ORDER BY start_dt ASC";
+		$sql         = "SELECT * FROM %i WHERE {$whereClause} ORDER BY start_dt ASC";
 
-		$rows = $params
-			? $this->db->get_results( $this->db->prepare( $sql, $params ) )
-			: $this->db->get_results( $sql );
+		$rows = $this->db->get_results(
+			$this->db->prepare( $sql, array_merge( [ $this->table ], $params ) )
+		);
 
 		return array_map( AvailabilitySlot::fromRow( ... ), $rows ?? [] );
 	}
@@ -133,7 +133,8 @@ class AvailabilityRepository {
 	public function findByInstructor( int $instructorId ): array {
 		$rows = $this->db->get_results(
 			$this->db->prepare(
-				"SELECT * FROM {$this->table} WHERE instructor_id = %d ORDER BY start_dt ASC",
+				'SELECT * FROM %i WHERE instructor_id = %d ORDER BY start_dt ASC',
+				$this->table,
 				$instructorId
 			)
 		);
@@ -149,7 +150,8 @@ class AvailabilityRepository {
 	public function findUnbookedInGroup( int $recurrenceGroup ): array {
 		$rows = $this->db->get_results(
 			$this->db->prepare(
-				"SELECT * FROM {$this->table} WHERE recurrence_group = %d AND is_booked = 0 ORDER BY start_dt ASC",
+				'SELECT * FROM %i WHERE recurrence_group = %d AND is_booked = 0 ORDER BY start_dt ASC',
+				$this->table,
 				$recurrenceGroup
 			)
 		);
@@ -159,7 +161,7 @@ class AvailabilityRepository {
 
 	public function findById( int $id ): ?AvailabilitySlot {
 		$row = $this->db->get_row(
-			$this->db->prepare( "SELECT * FROM {$this->table} WHERE id = %d", $id )
+			$this->db->prepare( 'SELECT * FROM %i WHERE id = %d', $this->table, $id )
 		);
 
 		return $row ? AvailabilitySlot::fromRow( $row ) : null;

src/Availability/AvailabilitySlot.php

@@ -3,6 +3,8 @@ declare(strict_types=1);
 
 namespace Unsupervised\Schedular\Availability;
 
+use Unsupervised\Schedular\Val;
+
 class AvailabilitySlot {
 
 	public function __construct(
@@ -35,16 +37,16 @@ class AvailabilitySlot {
 		return null;
 	}
 
-	public static function fromRow( object $row ): self {
+	public static function fromRow( \stdClass $row ): self {
 		return new self(
-			instructorId:    (int) $row->instructor_id,
-			startDt:         $row->start_dt,
-			endDt:           $row->end_dt,
-			durationMinutes: (int) $row->duration_minutes,
-			offeringId:      null !== $row->offering_id ? (int) $row->offering_id : null,
-			isBooked:        (bool) $row->is_booked,
-			recurrenceGroup: null !== $row->recurrence_group ? (int) $row->recurrence_group : null,
-			id:              (int) $row->id,
+			instructorId:    Val::int( $row->instructor_id ),
+			startDt:         Val::string( $row->start_dt ),
+			endDt:           Val::string( $row->end_dt ),
+			durationMinutes: Val::int( $row->duration_minutes ),
+			offeringId:      Val::intOrNull( $row->offering_id ),
+			isBooked:        Val::bool( $row->is_booked ),
+			recurrenceGroup: Val::intOrNull( $row->recurrence_group ),
+			id:              Val::int( $row->id ),
 		);
 	}