refactor(quality): Rector wave 3 — equivalence-safe cosmetics only (AID-531)

app/Actions/CheckServerFirewallAction.php

@@ -85,7 +85,7 @@ public function handle(string $ip, int $hostId): array
                 'error' => $e->getMessage(),
             ];
         } finally {
-            if ($keyName) {
+            if ($keyName !== '' && $keyName !== '0') {
                 $this->firewallService->removeMultiplexingPath($keyName);
             }
         }

app/Actions/WhmcsSynchro.php

@@ -91,7 +91,7 @@ public function handle(?Command $command = null): void
         }
 
         // Set debug mode and specific user from command options
-        if ($command) {
+        if ($command instanceof Command) {
             $this->debugMode = (bool) ($command->option('debug') ?? false);
             $userOption = $command->option('user');
             $this->specificUserEmail = is_string($userOption) ? $userOption : null;
@@ -123,7 +123,7 @@ public function handle(?Command $command = null): void
 
     protected function output(?Command $command, string $message): void
     {
-        if ($command) {
+        if ($command instanceof Command) {
             $command->info($message);
         }
 
@@ -272,7 +272,7 @@ protected function processClient(object $whmcsClient, ?Command $command): void
 
         $user = $this->findOrCreateUser($whmcsClient, $command);
 
-        if (! $user) {
+        if (! $user instanceof User) {
             $this->debugOutput($command, "❌ Could not find or create user for: {$whmcsClient->email}");
 
             return;
@@ -425,7 +425,7 @@ public function processActiveHostings(int $userId, ?Command $command = null): vo
                 }
 
                 $host = $this->findHostByWhmcsId((string) $whmcsHosting->server);
-                if (! $host) {
+                if (! $host instanceof Host) {
                     $this->debugOutput($command, "❌ No host found for WHMCS server ID: {$whmcsHosting->server}");
                     Log::warning("No host found for WHMCS server ID: {$whmcsHosting->server}");
 

app/Console/Commands/AddHostKeyCommand.php

@@ -25,7 +25,7 @@ public function handle(): void
         // Si no se proporciona hostId, permitir seleccionar con prompts
         if (! $hostId) {
             $host = $this->selectHost();
-            if (! $host) {
+            if (! $host instanceof Host) {
                 error('No se seleccionó ningún host.');
 
                 return;

app/Console/Commands/Develop/TestHostConnectionCommand.php

@@ -20,7 +20,7 @@ public function handle(): int
         info('=== DIAGNÓSTICO SSH REAL ===');
 
         $host = $this->selectHost();
-        if (! $host) {
+        if (! $host instanceof Host) {
             error('Host no encontrado');
 
             return 1;

app/Console/Commands/UserAuthorizeCommand.php

@@ -71,7 +71,7 @@ private function createAuthorizedUser(): int
         $parentUserId = search(
             label: 'Select the parent user:',
             options: function (string $value) use ($parentUsers) {
-                if (strlen($value) === 0) {
+                if ($value === '') {
                     return $parentUsers->take(10)->mapWithKeys(fn ($user) => [
                         (string) $user->id => "$user->name ($user->email)",
                     ])->toArray();
@@ -145,7 +145,7 @@ private function assignPermissions(): int
         $userId = search(
             label: 'Select the authorized user:',
             options: function (string $value) use ($authorizedUsers) {
-                if (strlen($value) === 0) {
+                if ($value === '') {
                     return $authorizedUsers->take(10)->mapWithKeys(fn ($user) => [
                         (string) $user->id => "$user->name ($user->email) - Parent: {$user->parentUser->name}",
                     ])->toArray();
@@ -365,7 +365,7 @@ private function revokePermissions(): int
         $userId = search(
             label: 'Select the authorized user:',
             options: function (string $value) use ($authorizedUsers) {
-                if (strlen($value) === 0) {
+                if ($value === '') {
                     return $authorizedUsers->take(10)->mapWithKeys(fn ($user) => [
                         (string) $user->id => "{$user->name} ({$user->email}) - Parent: {$user->parentUser->name}",
                     ])->toArray();
@@ -537,7 +537,7 @@ private function reassignUserToParent(): int
         $userId = search(
             label: 'Select the authorized user:',
             options: function (string $value) use ($authorizedUsers) {
-                if (strlen($value) === 0) {
+                if ($value === '') {
                     return $authorizedUsers->take(10)->mapWithKeys(fn ($user) => [
                         (string) $user->id => "$user->name ($user->email) - Current Parent: {$user->parentUser->name}",
                     ])->toArray();
@@ -593,7 +593,7 @@ private function reassignUserToParent(): int
         $parentUserId = search(
             label: 'Select the new parent user:',
             options: function (string $value) use ($parentUsers) {
-                if (strlen($value) === 0) {
+                if ($value === '') {
                     return $parentUsers->take(10)->mapWithKeys(fn ($user) => [
                         (string) $user->id => "$user->name ($user->email)",
                     ])->toArray();

app/Console/Commands/UserCreateCommand.php

@@ -269,7 +269,7 @@ private function handleInteractive(): int
         $this->info('📋 User Summary:');
         $this->line("   Email:       {$email}");
         $this->line("   Name:        {$firstName} {$lastName}");
-        if ($companyName) {
+        if ($companyName !== '' && $companyName !== '0') {
             $this->line("   Company:     {$companyName}");
         }
         $this->line('   Type:        '.($isAdmin ? '👑 Administrator' : '👤 Normal User'));

app/Jobs/ProcessHqWhitelistJob.php

@@ -33,7 +33,7 @@ public function __construct(
     public function handle(FirewallService $firewallService): void
     {
         $hqHost = $this->resolveHqHost();
-        if (! $hqHost) {
+        if (! $hqHost instanceof Host) {
             Log::warning('HQ host not found, skipping HQ whitelist check');
 
             return;
@@ -95,7 +95,7 @@ public function handle(FirewallService $firewallService): void
             throw $e;
         } finally {
             // Best effort cleanup of temporary key file
-            if ($keyPath) {
+            if ($keyPath !== '' && $keyPath !== '0') {
                 try {
                     $fileName = basename($keyPath);
                     Storage::disk('ssh')->delete($fileName);

app/Livewire/OtpLogin.php

@@ -189,7 +189,7 @@ public function verifyOtp(): void
                 'oneTimePassword' => 'required|string|size:6',
             ]);
 
-            if (! $this->user) {
+            if (! $this->user instanceof User) {
                 throw ValidationException::withMessages([
                     'oneTimePassword' => 'Sesión expirada. Solicita un nuevo código.',
                 ]);

app/Models/User.php

@@ -327,11 +327,9 @@ public function hasAccessToHosting(int $hostingId): bool
         }
 
         // If this is a principal user (no parent), check ownership
-        if (! $this->parent_user_id) {
-            // Check if user owns the hosting
-            if (Hosting::where('id', $hostingId)->where('user_id', $this->id)->exists()) {
-                return true;
-            }
+        // Check if user owns the hosting
+        if (! $this->parent_user_id && Hosting::where('id', $hostingId)->where('user_id', $this->id)->exists()) {
+            return true;
         }
 
         // For all users (principal and authorized), check specific permissions

app/Services/Firewall/DirectAdminFirewallAnalyzer.php

@@ -174,7 +174,7 @@ public function analyze(string $ipAddress, mixed $session): FirewallAnalysisResu
             // STEP 3: Check DirectAdmin BFM blacklist (ALWAYS - independent of CSF status)
             if ($this->serviceChecks['da_bfm_check'] ?? false) {
                 $bfmResult = $this->checkAndRemoveFromBfmBlacklist($ipAddress, $sshKeyName);
-                if ($bfmResult) {
+                if ($bfmResult instanceof FirewallAnalysisResult) {
                     $logs['da_bfm'] = $bfmResult->getLogs()['da_bfm'] ?? '';
                     $results[] = $bfmResult;
                     $bfmBlocked = $bfmResult->isBlocked();

app/Services/Firewall/V2/FirewallLogAnalyzer.php

@@ -58,7 +58,7 @@ public function analyzeDirectAdmin(string $ipAddress, Host $host): FirewallAnaly
 
             // STEP 3: Análisis BFM independiente (siempre se ejecuta)
             $bfmResult = $this->analyzeBfmBlacklist($ipAddress, $host, $session);
-            if ($bfmResult) {
+            if ($bfmResult instanceof FirewallAnalysisResult) {
                 $logs['da_bfm_check'] = $bfmResult->getLogs()['da_bfm'] ?? '';
                 $results[] = $bfmResult;
             }

app/Services/FirewallUnblocker.php

@@ -119,11 +119,7 @@ private function hasCsfBlocks(array $logs): bool
         }
 
         // Check for CSF temporary blocks - any content means blocked
-        if (! empty($logs['csf_tempip'] ?? '')) {
-            return true;
-        }
-
-        return false;
+        return ! empty($logs['csf_tempip'] ?? '');
     }
 
     /**

app/Services/PatternDetection/AnomalyDetector.php

@@ -54,10 +54,8 @@ public function detectAll(): array
         $currentTraffic = $this->getCurrentTraffic();
 
         // Check if anomaly detected
-        if ($this->isAnomaly($currentTraffic, $baseline)) {
-            if ($detection = $this->createAnomalyDetection($currentTraffic, $baseline)) {
-                $detections[] = $detection;
-            }
+        if ($this->isAnomaly($currentTraffic, $baseline) && $detection = $this->createAnomalyDetection($currentTraffic, $baseline)) {
+            $detections[] = $detection;
         }
 
         return $detections;

app/Services/PatternDetection/DistributedAttackDetector.php

@@ -51,7 +51,7 @@ public function detectAll(): array
             ->filter();
 
         foreach ($recentEmailHashes as $emailHash) {
-            if ($detection = $this->detectForEmail($emailHash)) {
+            if (($detection = $this->detectForEmail($emailHash)) instanceof PatternDetection) {
                 $detections[] = $detection;
             }
         }

app/Services/PatternDetection/SubnetScanDetector.php

@@ -57,7 +57,7 @@ public function detectAll(): array
             ->keys();
 
         foreach ($recentSubnets as $subnetPrefix) {
-            if ($detection = $this->detectForSubnet($subnetPrefix)) {
+            if (($detection = $this->detectForSubnet($subnetPrefix)) instanceof PatternDetection) {
                 $detections[] = $detection;
             }
         }

app/Services/SshConnectionManager.php

@@ -48,13 +48,11 @@ public function prepareMultiplexingPath(): void
     {
         $directoryPath = '/tmp/cm';
 
-        if (! File::exists($directoryPath)) {
-            if (! File::makeDirectory($directoryPath, 0755, true)) {
-                Log::error('Error creating SSH multiplexing directory');
-                throw new ConnectionFailedException(
-                    'Could not create SSH multiplexing directory: '.$directoryPath
-                );
-            }
+        if (! File::exists($directoryPath) && ! File::makeDirectory($directoryPath, 0755, true)) {
+            Log::error('Error creating SSH multiplexing directory');
+            throw new ConnectionFailedException(
+                'Could not create SSH multiplexing directory: '.$directoryPath
+            );
         }
     }
 

rector.php

@@ -2,6 +2,8 @@
 
 declare(strict_types=1);
 
+use Rector\CodeQuality\Rector\Identical\StrlenZeroToIdenticalEmptyStringRector;
+use Rector\CodeQuality\Rector\If_\{CombineIfRector, ExplicitBoolCompareRector, ObjectExplicitBoolCompareRector, SimplifyIfReturnBoolRector};
 use Rector\Config\RectorConfig;
 use Rector\Php83\Rector\ClassConst\AddTypeToConstRector;
 use Rector\Php83\Rector\ClassMethod\AddOverrideAttributeToOverriddenMethodsRector;
@@ -66,6 +68,29 @@
         // Wave 1 (AID-529), landed last: the only semantic rule here, since
         // strict_types changes runtime type coercion rather than shape.
         DeclareStrictTypesRector::class,
+        // Wave 3 (AID-531). ONLY the equivalence-safe cosmetics from
+        // LARAVEL_CODE_QUALITY + codeQuality level 50. The rest of that set
+        // is NOT mechanical and was split off by risk profile:
+        //   - MakeModelAttributesAndScopesProtectedRector (27 scopes
+        //     public→protected, public surface) → AID-540
+        //   - CarbonToDateFacadeRector + NowFunc...ToTodayFunc (runtime class
+        //     + temporal semantics) → AID-541
+        //   - ApplyDefaultInsteadOfNullCoalesceRector (?? vs ?: — differs on
+        //     false/0/'') → AID-542
+        //   - DispatchToHelperFunctions / RedirectRouteToToRoute /
+        //     CompactToVariables / ThrowWithPreviousException (equivalence
+        //     must be shown per transform) → AID-543
+        // Each transform below was diff-verified equivalence-preserving; the
+        // ExplicitBoolCompare rewrites were confirmed to fire only on
+        // string-typed vars (Rector left the ?string option() path alone).
+        // NB: measure/apply waves with `rector --clear-cache` — the cache does
+        // not discriminate the rule set, so `composer refactor` after a local
+        // measuring session can under-apply (16 files measured, 3 applied).
+        ObjectExplicitBoolCompareRector::class,
+        ExplicitBoolCompareRector::class,
+        SimplifyIfReturnBoolRector::class,
+        StrlenZeroToIdenticalEmptyStringRector::class,
+        CombineIfRector::class,
     ])
     ->withSkip([
         // Excluded by design decision (AID-528), armed BEFORE any wave enables