fix: harden Psalm with server-aware context and related signing fixes

.github/workflows/psalm.yml

@@ -20,6 +20,8 @@ permissions:
 jobs:
   static-analysis:
     runs-on: ubuntu-latest
+    env:
+      APP_NAME: libresign
 
     name: static-psalm-analysis
     steps:
@@ -33,7 +35,23 @@ jobs:
         id: versions
         uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2.3.1.3.2
 
+      - name: Checkout server
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: true
+          repository: nextcloud/server
+          ref: ${{ steps.versions.outputs.branches-max }}
+
+      - name: Checkout app
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: true
+          path: apps/${{ env.APP_NAME }}
+
       - name: Check enforcement of minimum PHP version ${{ steps.versions.outputs.php-min }} in psalm.xml
+        working-directory: apps/${{ env.APP_NAME }}
         run: grep 'phpVersion="${{ steps.versions.outputs.php-min }}' psalm.xml
 
       - name: Set up php${{ steps.versions.outputs.php-available }}
@@ -49,15 +67,19 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
+        working-directory: apps/${{ env.APP_NAME }}
         run: |
           composer remove nextcloud/ocp --dev --no-scripts
           composer i
 
       - name: Check for vulnerable PHP dependencies
+        working-directory: apps/${{ env.APP_NAME }}
         run: composer require --dev roave/security-advisories:dev-latest
 
       - name: Install nextcloud/ocp
+        working-directory: apps/${{ env.APP_NAME }}
         run: composer require --dev nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} --ignore-platform-reqs --with-dependencies
 
       - name: Run coding standards check
+        working-directory: apps/${{ env.APP_NAME }}
         run: composer run psalm -- --threads=1 --monochrome --no-progress --output-format=github

.github/workflows/update-psalm-baseline.yml

@@ -15,6 +15,8 @@ on:
 jobs:
   update-psalm-baseline:
     runs-on: ubuntu-latest
+    env:
+      APP_NAME: libresign
 
     if: ${{ github.repository_owner != 'nextcloud-gmbh' }}
 
@@ -37,6 +39,22 @@ jobs:
         id: versions
         uses: icewind1991/nextcloud-version-matrix@8a7bac6300b2f0f3100088b297995a229558ddba # v1.3.2.3.1.3.2
 
+      - name: Checkout server
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          submodules: true
+          repository: nextcloud/server
+          ref: ${{ steps.versions.outputs.branches-max }}
+
+      - name: Checkout app
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ matrix.branches }}
+          submodules: true
+          path: apps/${{ env.APP_NAME }}
+
       - name: Set up php${{ steps.versions.outputs.php-available }}
         uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
@@ -48,15 +66,24 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install dependencies
-        run: composer i
+        working-directory: apps/${{ env.APP_NAME }}
+        run: |
+          composer remove nextcloud/ocp --dev --no-scripts
+          composer i
+
+      - name: Install nextcloud/ocp
+        working-directory: apps/${{ env.APP_NAME }}
+        run: composer require --dev nextcloud/ocp:dev-${{ steps.versions.outputs.branches-max }} --ignore-platform-reqs --with-dependencies
 
       - name: Psalm
+        working-directory: apps/${{ env.APP_NAME }}
         run: composer run psalm:update-baseline -- --monochrome --no-progress --output-format=text
         continue-on-error: true
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
+          path: apps/${{ env.APP_NAME }}
           token: ${{ secrets.COMMAND_BOT_PAT }}
           commit-message: Update psalm baseline
           committer: GitHub <noreply@github.com>

lib/AppInfo/Application.php

@@ -8,7 +8,6 @@
 
 namespace OCA\Libresign\AppInfo;
 
-use OCA\Files\Event\LoadAdditionalScriptsEvent;
 use OCA\Files\Event\LoadSidebar;
 use OCA\Libresign\Activity\Listener as ActivityListener;
 use OCA\Libresign\Capabilities;
@@ -66,7 +65,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerEventListener(SignedEvent::class, SignedCallbackListener::class);
 
 		// Files newFile listener
-		$context->registerEventListener(LoadAdditionalScriptsEvent::class, LoadAdditionalListener::class);
+		$context->registerEventListener('OCA\\Files\\Event\\LoadAdditionalScriptsEvent', LoadAdditionalListener::class);
 
 		// Activity listeners
 		$context->registerEventListener(SendSignNotificationEvent::class, ActivityListener::class);

lib/Command/Configure/Cfssl.php

@@ -15,6 +15,7 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class Cfssl extends Base {
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:configure:cfssl')
@@ -69,6 +70,7 @@ protected function configure(): void {
 			);
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		if (!$this->installService->isCfsslBinInstalled()) {
 			throw new InvalidArgumentException('CFSSL binary not found! run libresign:istall --cfssl first.');

lib/Command/Configure/Check.php

@@ -26,6 +26,7 @@ public function __construct(
 		parent::__construct();
 	}
 
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:configure:check')
@@ -44,6 +45,7 @@ protected function configure(): void {
 			);
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$sign = $input->getOption('sign');
 		$certificate = $input->getOption('certificate');

lib/Command/Configure/OpenSsl.php

@@ -15,6 +15,7 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class OpenSsl extends Base {
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:configure:openssl')
@@ -63,6 +64,7 @@ protected function configure(): void {
 			);
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$names = [];
 		if (!$commonName = $input->getOption('cn')) {

lib/Command/Developer/Reset.php

@@ -28,10 +28,12 @@ public function __construct(
 		parent::__construct();
 	}
 
+	#[\Override]
 	public function isEnabled(): bool {
 		return $this->config->getSystemValue('debug', false) === true;
 	}
 
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:developer:reset')
@@ -105,6 +107,7 @@ protected function configure(): void {
 		;
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$ok = false;
 

lib/Command/Developer/SignSetup.php

@@ -29,10 +29,12 @@ public function __construct(
 		parent::__construct();
 	}
 
+	#[\Override]
 	public function isEnabled(): bool {
 		return $this->config->getSystemValue('debug', false) === true;
 	}
 
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:developer:sign-setup')
@@ -42,6 +44,7 @@ protected function configure(): void {
 		;
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$privateKeyPath = $input->getOption('privateKey');
 		$keyBundlePath = $input->getOption('certificate');

lib/Command/Install.php

@@ -26,6 +26,7 @@ public function __construct(
 		parent::__construct($installService, $logger);
 	}
 
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:install')
@@ -82,6 +83,7 @@ protected function configure(): void {
 		}
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$ok = false;
 		$this->installService->setOutput($output);

lib/Command/Uninstall.php

@@ -13,6 +13,7 @@
 use Symfony\Component\Console\Output\OutputInterface;
 
 class Uninstall extends Base {
+	#[\Override]
 	protected function configure(): void {
 		$this
 			->setName('libresign:uninstall')
@@ -55,6 +56,7 @@ protected function configure(): void {
 			);
 	}
 
+	#[\Override]
 	protected function execute(InputInterface $input, OutputInterface $output): int {
 		$ok = false;
 

lib/Controller/AdminController.php

@@ -10,10 +10,9 @@
 
 use OCA\Libresign\AppInfo\Application;
 use OCA\Libresign\Controller\Traits\UploadValidator;
-use OCA\Libresign\Db\FileMapper;
-use OCA\Libresign\Enum\FileStatus;
 use OCA\Libresign\Handler\CertificateEngine\CertificateEngineFactory;
 use OCA\Libresign\Handler\CertificateEngine\IEngineHandler;
+use OCA\Libresign\Service\ActiveSigningsService;
 use OCA\Libresign\Service\Certificate\ValidateService;
 use OCA\Libresign\Service\CertificatePolicyService;
 use OCA\Libresign\Service\IdentifyMethodService;
@@ -67,7 +66,7 @@ public function __construct(
 		private CertificatePolicyService $certificatePolicyService,
 		private ValidateService $validateService,
 		private IdentifyMethodService $identifyMethodService,
-		private FileMapper $fileMapper,
+		private ActiveSigningsService $activeSigningsService,
 		private SetupCheckResultService $setupCheckResultService,
 	) {
 		parent::__construct(Application::APP_ID, $request);
@@ -461,22 +460,8 @@ public function updateOid(string $oid): DataResponse {
 	#[ApiRoute(verb: 'GET', url: '/api/{apiVersion}/admin/active-signings', requirements: ['apiVersion' => '(v1)'])]
 	public function getActiveSignings(): DataResponse {
 		try {
-			$activeSignings = $this->fileMapper->findByStatus(FileStatus::SIGNING_IN_PROGRESS->value);
-
-			$result = [];
-			foreach ($activeSignings as $file) {
-				$result[] = [
-					'id' => $file->getId(),
-					'uuid' => $file->getUuid(),
-					'name' => $file->getName(),
-					'signerEmail' => $file->getSignerEmail() ?? '',
-					'signerDisplayName' => $file->getSignerName() ?? '',
-					'updatedAt' => $file->getUpdatedAt(),
-				];
-			}
-
 			return new DataResponse([
-				'data' => $result,
+				'data' => $this->activeSigningsService->getActiveSignings(),
 			]);
 		} catch (\Exception $e) {
 			return new DataResponse([

lib/Dav/SignatureStatusPlugin.php

@@ -16,6 +16,7 @@
 use Sabre\DAV\ServerPlugin;
 
 class SignatureStatusPlugin extends ServerPlugin {
+	#[\Override]
 	public function initialize(Server $server): void {
 		$server->on('propFind', $this->propFind(...));
 	}

lib/Db/File.php

@@ -24,7 +24,7 @@
  * @method void setSignedHash(?string $hash)
  * @method ?string getSignedHash()
  * @method void setUserId(?string $userId)
- * @method ?string getUserId()
+ * @method string getUserId()
  * @method void setUuid(string $uuid)
  * @method string getUuid()
  * @method void setCreatedAt(\DateTime $createdAt)

lib/Db/IdDocsMapper.php

@@ -12,7 +12,6 @@
 use OCA\Libresign\Helper\Pagination;
 use OCP\AppFramework\Db\QBMapper;
 use OCP\DB\QueryBuilder\IQueryBuilder;
-use OCP\DB\Types;
 use OCP\IDBConnection;
 use OCP\IL10N;
 use OCP\IURLGenerator;
@@ -210,7 +209,7 @@ private function getQueryBuilder(array $filter = [], bool $count = false): IQuer
 
 		if (!empty($filter['approved']) && $filter['approved'] === 'yes') {
 			$qb->andWhere(
-				$qb->expr()->eq('f.status', $qb->createNamedParameter(FileStatus::SIGNED->value, Types::INTEGER))
+				$qb->expr()->eq('f.status', $qb->createNamedParameter(FileStatus::SIGNED->value, IQueryBuilder::PARAM_INT))
 			);
 		}
 

lib/Db/IdentifyMethodMapper.php

@@ -120,7 +120,7 @@ public function searchByIdentifierValue(string $search, string $userId, string $
 		$latestQb = $this->db->getQueryBuilder();
 		$latestQb->select('im2.identifier_key')
 			->addSelect('im2.identifier_value')
-			->addSelect($latestQb->func()->max('sr2.created_at', 'created_at'))
+			->selectAlias($latestQb->func()->max('sr2.created_at'), 'created_at')
 			->from('libresign_identify_method', 'im2')
 			->join('im2', 'libresign_sign_request', 'sr2',
 				$latestQb->expr()->eq('sr2.id', 'im2.sign_request_id')

lib/Db/PagerFantaQueryAdapter.php

@@ -15,6 +15,8 @@
 
 /**
  * Adapter which calculates pagination from a Doctrine DBAL QueryBuilder.
+ *
+ * @implements AdapterInterface<array<string, mixed>>
  */
 class PagerFantaQueryAdapter implements AdapterInterface {
 	/**
@@ -41,7 +43,7 @@ public function getNbResults(): int {
 	/**
 	 * @psalm-suppress MixedReturnStatement
 	 *
-	 * @return array
+	 * @return array<int, array<string, mixed>>
 	 */
 	#[\Override]
 	public function getSlice(int $offset, int $length): iterable {

lib/Db/PermissionSet.php

@@ -22,7 +22,7 @@
  * @method ?string getDescription()
  * @method void setScopeType(string $scopeType)
  * @method string getScopeType()
- * @method void setEnabled(int $enabled)
+ * @method void setEnabled(bool $enabled)
  * @method void setPriority(int $priority)
  * @method int getPriority()
  * @method void setCreatedAt(\DateTime|string $createdAt)

lib/Handler/CertificateEngine/AEngineHandler.php

@@ -896,9 +896,8 @@ private function createAndSignCrl(\OCA\Libresign\Vendor\phpseclib3\File\X509 $is
 			$dateFormat = 'D, d M Y H:i:s O';
 			foreach ($revokedCertificates as $cert) {
 				$serialNumber = $cert->getSerialNumber();
-				$normalizedSerial = ltrim((string)$serialNumber, '0') ?: '0';
 				$crlToSign->revoke(
-					new \OCA\Libresign\Vendor\phpseclib3\Math\BigInteger($normalizedSerial, 16),
+					$this->normalizeRevokedCertificateSerialForCrl((string)$serialNumber),
 					$cert->getRevokedAt()->format($dateFormat)
 				);
 			}
@@ -920,6 +919,16 @@ private function createAndSignCrl(\OCA\Libresign\Vendor\phpseclib3\File\X509 $is
 		return $signedCrl;
 	}
 
+	private function normalizeRevokedCertificateSerialForCrl(string $serialNumber): string {
+		$normalizedSerial = ltrim($serialNumber, '0') ?: '0';
+
+		if (ctype_digit($normalizedSerial)) {
+			return $normalizedSerial;
+		}
+
+		return (new \OCA\Libresign\Vendor\phpseclib3\Math\BigInteger($normalizedSerial, 16))->toString();
+	}
+
 	private function saveCrlToDer(array $signedCrl, string $configPath): string {
 		$crlDerPath = $configPath . DIRECTORY_SEPARATOR . 'crl.der';
 		$crlToSign = new \OCA\Libresign\Vendor\phpseclib3\File\X509();