Repository navigation
Rule 3 Types as a security layer
Part one: wiring. Types stop the wrong kind of value at the door, before it becomes a bug or a security hole.
The short form of every rule is in BUILD_PHILOSOPHY.md, which is the version that
counts. This page is the long form: why, where it shows today, and when not to use it.
Slim Killer takes untrusted input from forms, uploads and webhooks. Every value that is
checked once, at the edge, and then carried as a precise type cannot be wrong later. A
string $role accepts "admn"; a Role $role accepts only the roles that exist.
-
declare(strict_types=1);in every PHP file, and PHPStan at level 8 in the quality gates. - Enums for anything with a fixed set of values:
src/Auth/Role.php(site owner, administrator),src/Doctor/Status.php(PASS, WARN, FAIL, INFO). -
src/Auth/EmailAddress.php: an email address is checked and normalised once, when it is made, so the rest of the code never sees an invalid one.
Inside one small private function, a plain string or array is fine. The rule is about
values that cross a boundary: from a form, from the database, from another class.
Value object, boundary. See Glossary.
PHP 8.5 OOP Mastery, Rule 3 in its course philosophy, taught in module 2, advanced types. Course page.