PHPStan: SecretController mixed type warnings from request->input()

[kevalyq]

Problem

PHPStan Level max reports 14 warnings in SecretController.php related to type casting from Request->input() which returns mixed.

Errors

• Lines 108-114 (store method): Cannot cast mixed to string/array
• Lines 152-170 (update method): Cannot cast mixed to string/array

Example

$secret->title_plain = (string) $request->input('title'); // PHPStan: Cannot cast mixed to string

Context

• All tests passing (35/35 Secret+SecretShare tests)
• Runtime behavior correct
• Only static analysis warnings

Solutions to Consider

1. @var DocBlocks before assignments (most common Laravel pattern)
2. Custom type-safe Request classes with typed getters
3. PHPStan baseline to suppress these specific warnings
4. Validation-based type inference (PHPStan Laravel extension)

Priority

Low - Does not affect functionality, only static analysis

Related

• Issue Phase 3: Secret Sharing & Access Control (RBAC Integration) #182 (Secret Sharing & Access Control implementation)

[github-actions]

✅ This issue has been added to the SecPal Feature Roadmap with status: 💡 Ideas

New idea - needs discussion and evaluation

Status Flow:
💡 Ideas → 💬 Discussion → 📥 Backlog → 📋 Planned → 🚧 In Progress → 👀 In Review → ✅ Done

Note: Ideas that won't be implemented should be moved to 🚫 Won't Do with a reason.

[kevalyq]

✅ Already resolved in PR #185!

The PHPStan warnings were fixed by adding @var type hints in PR #185:

vendor/bin/phpstan analyse --memory-limit=1G --no-progress
# [OK] No errors

Solution: Added @var type hints before all $request->input() assignments to satisfy PHPStan level max.

Closing as completed. 🎉