fix(gate-7): drop a redundant (string) cast that hid a real ownership guard

[rubenvdlinde]

What

Drop one redundant (string) cast in AppOverrideController::getUser().

Why — this is a gate-7 false positive, and the obvious repair would have been wrong

getUser() is already owner-scoped. The UID is never a request parameter; it comes from the session and is handed to AppOverrideService::getUserDelta(appId:, uid:). That is exactly gate-7's Pattern 6 — session-identity hand-off, and the method's own docblock says so.

gate-7 flagged it anyway. Four arms on the shipped file, changing nothing but the expression carrying the identity:

arm	expression	gate-7
A (shipped)	uid: (string)$user->getUID()	FAIL
B	uid: $user->getUID()	PASS
C	$uid = (string)$user->getUID(); … uid: $uid	FAIL
D	appId: (string)$appId, uid: $user->getUID()	PASS
E	$uid = $user->getUID(); … uid: $uid	PASS

The guard is identical in all five arms. Only its spelling moves the verdict. Arm D rules out "any cast in the call breaks it" — casting an unrelated argument is harmless. Arm C rules out "hoist it into a local" as the fix: the cast defeats the recogniser through a variable too.

So the finding was never about this endpoint's authorization. Had it been treated as real, the repair would have been to add a guard to an endpoint that already had one — which is precisely the wrong repair the gate's own preamble warns about.

Is dropping the cast safe?

IUser::getUID() is documented @return string (since 8.0.0, lib/public/IUser.php on stable34), and AppOverrideService::getUserDelta() declares string $uid under declare(strict_types=1). The cast was a no-op. Psalm and PHPStan are the control — if getUID() could return anything else here, they fail this PR.

Nothing can now return 200 that previously errored: the change is inside an argument expression on a call that already ran.

What this does NOT do

gate-7 on lib/Controller/*.php goes 7 → 6. It does not turn the Hydra Gates cell green — gate-19 (158 scenarios), gate-26 (4 components) and gate-49 (2 methods) are all still red on development, and the remaining six gate-7 findings (RulesController::evaluate/schema/testAll, ShopController::githubInstall, StoreController::search/install) are untriaged and deliberately not touched here.

Fleet note

The (string)$user->getUID() spelling occurs 7 times across the six apps in this sweep (openbuild 5, launchpad 2), but only 1 of the 20 live gate-7 findings is this class. Reported as measured, not extrapolated — the other 12 fleet apps are unmeasured.

Scope

One token in one file.

[github-actions]

Quality Report — ConductionNL/openbuild @ 8277290

Check	PHP	Vue	Security	License	Tests
lint	✅
phpcs	✅
phpmd	✅
psalm	✅
phpstan	✅
phpmetrics	✅
eslint		✅
stylelint		✅
build		✅
check-manifest		✅
test-l10n		✅
check-gitignore		✅
check-nc-floor		✅
composer			✅	✅ 106/106
npm			✅	✅ 654/654
app:check-code	⏭️
info.xml	✅
REUSE	❌
PHPUnit					✅
Newman					⏭️
Playwright					✅
Hydra gates					❌

---

Quality workflow — 2026-08-12 23:58 UTC

Download the full PDF report from the workflow artifacts.