fix(psalm): fix the real type problems, narrow the suppressions, replace the deprecated OCP calls (#1283)

Psalm: 389 errors when every suppression is lifted, down to 327, none of them a type or docblock problem. psalm.xml goes from 33 global suppressions to 2 (UnusedClass, PossiblyUnusedMethod, both DI); the rest are scoped per file with reasons, and UndefinedClass from 74 listed classes to 19.

Deprecated OCP calls: all 20 from the audit plus IUserManager::search replaced with the APIs their deprecation notes name (isEnabledForAnyone, IUserConfig, IAppConfig, IResult, a pure SqlIdentifierQuoter on getDatabaseProvider, IBootContext::injectFn, searchDisplayName). No app id string was changed.

New tests: PreferencesControllerTest, SqlIdentifierQuoterTest, a Health degraded-version test and an untitled-row warning test, each mutation-checked.

Left: IAppManager::getInstalledApps in DemoDataService and SeedProfileService, because hydra gate 66 does not recognise getEnabledApps() as an OpenRegister availability guard.

Refs #1277

Author: rubenvdlinde

lib/AppInfo/Application.php

@@ -197,14 +197,19 @@ public function boot(IBootContext $context): void {
 		// case) without the full decidiq app bundle being present.
 		Util::addInitScript(self::APP_ID, 'decidiq-integration-init');
 
-		$serverContainer = $context->getServerContainer();
-
 		// Object-lifecycle subscriptions MUST be made from boot(), never from
 		// register(): OpenRegister's classes are only autoloadable to apps
 		// registered after it, so the registrar's class_exists() guard would
 		// resolve differently purely by app load order during register().
-		$serverContainer->get(ObjectListenerRegistrar::class)->register(
-			dispatcher: $serverContainer->get(IEventDispatcher::class)
+		//
+		// injectFn() rather than getServerContainer()->get(): IServerContainer
+		// and IAppContainer are both deprecated since NC 20, and injectFn() is
+		// the boot-time API that resolves the parameters from this app's
+		// container (which falls back to the server for OCP services).
+		$context->injectFn(
+			static function (ObjectListenerRegistrar $registrar, IEventDispatcher $dispatcher): void {
+				$registrar->register(dispatcher: $dispatcher);
+			}
 		);
 
 	}//end boot()

lib/BackgroundJob/TranscriptRetentionJob.php

@@ -270,12 +270,12 @@ private function resolveBodyPolicy(object $objectService, array $meeting): array
 			$body = $this->fetchObject(objectService: $objectService, id: (string)$bodyId, schema: 'governance-body');
 		}
 
-		$policy = (string)(($body['transcriptRetentionPolicy'] ?? null) ?? self::DEFAULT_POLICY);
+		$policy = (string)($body['transcriptRetentionPolicy'] ?? self::DEFAULT_POLICY);
 		if (in_array($policy, self::POLICIES, true) === false) {
 			$policy = self::DEFAULT_POLICY;
 		}
 
-		$days = (int)(($body['transcriptRetentionDays'] ?? null) ?? self::DEFAULT_DAYS);
+		$days = (int)($body['transcriptRetentionDays'] ?? self::DEFAULT_DAYS);
 		if ($days < 0) {
 			$days = self::DEFAULT_DAYS;
 		}
@@ -501,7 +501,7 @@ private function resolveMeetingId(array $transcript): ?string {
 	 * @spec openspec/specs/meeting-transcription/spec.md
 	 */
 	private function objectId(array $object): ?string {
-		$id = (string)(($object['id'] ?? ($object['@self']['id'] ?? null)) ?? '');
+		$id = (string)($object['id'] ?? $object['@self']['id'] ?? '');
 		if ($id === '') {
 			return null;
 		}

lib/Controller/ApprovalRouteController.php

@@ -153,7 +153,7 @@ public function record(): JSONResponse {
 		// A final signature given over THIS surface concludes the route just as
 		// surely as one arriving over the cross-app seam, and the producer that
 		// delegated its runtime here is waiting on the announcement.
-		$this->announcer->announceIfConcluded(subject: (string)$action['subject']);
+		$this->announcer->announceIfConcluded(subject: $action['subject']);
 
 		return new JSONResponse($recorded, Http::STATUS_CREATED);
 	}//end record()

lib/Controller/HealthController.php

@@ -47,6 +47,7 @@
 use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
 use OCP\AppFramework\Http\Attribute\PublicPage;
 use OCP\AppFramework\Http\JSONResponse;
+use OCP\IAppConfig;
 use OCP\IConfig;
 use OCP\IRequest;
 use Psr\Container\ContainerInterface;
@@ -91,13 +92,15 @@ class HealthController extends Controller {
 	 * @param IRequest $request The request object.
 	 * @param IConfig $config The Nextcloud config service (baseUrl).
 	 * @param ContainerInterface $container DI container — resolves the AppHost engine lazily.
+	 * @param IAppConfig $appConfig App config store (installed version on the degraded path).
 	 *
 	 * @return void
 	 */
 	public function __construct(
 		IRequest $request,
 		private readonly IConfig $config,
 		private readonly ContainerInterface $container,
+		private readonly IAppConfig $appConfig,
 	) {
 		parent::__construct(appName: Application::APP_ID, request: $request);
 
@@ -134,7 +137,7 @@ public function index(): JSONResponse {
 		if ($body === null) {
 			$body = [
 				'status' => 'degraded',
-				'version' => $this->config->getAppValue(Application::APP_ID, 'installed_version', ''),
+				'version' => $this->appConfig->getValueString(Application::APP_ID, 'installed_version', ''),
 				'openregister' => 'unavailable',
 				'httpStatus' => Http::STATUS_OK,
 			];

lib/Controller/LiveMeetingController.php

@@ -125,8 +125,6 @@ public function recordLiveDecision(string $meetingId): JSONResponse {
 			return $denied;
 		}
 
-		$user = $this->userSession->getUser();
-
 		try {
 			$title = $this->request->getParam('title');
 			$text = $this->request->getParam('text');
@@ -148,8 +146,7 @@ public function recordLiveDecision(string $meetingId): JSONResponse {
 
 			$decisionSlug = $this->liveDecisionService->recordDecision(
 				$meetingId,
-				$decisionData,
-				$user->getUID()
+				$decisionData
 			);
 
 			return new JSONResponse(

lib/Controller/MinutesController.php

@@ -347,13 +347,8 @@ public function submitForApproval(string $minutesId): JSONResponse {
 			return $denied;
 		}
 
-		$user = $this->userSession->getUser();
-
 		return $this->responder->runInternal(
-			operation: fn (): array => $this->workflowService->submitForApproval(
-				minutesId: $minutesId,
-				actorId: $user->getUID()
-			)
+			operation: fn (): array => $this->workflowService->submitForApproval(minutesId: $minutesId)
 		);
 
 	}//end submitForApproval()

lib/Controller/OriController.php

@@ -353,22 +353,22 @@ public function show(string $resource, string $id): JSONResponse {
 			// (publicationDate <= $now, not depublished). A future-dated or
 			// depublished payload is not-found for anonymous callers — return 404
 			// (not 403) so the endpoint never confirms an unpublished payload exists.
-			if ($this->serializer->isPayloadLive(object: (array)$object) === false) {
+			if ($this->serializer->isPayloadLive(object: $object) === false) {
 				return $this->errorResponse(message: 'Not found', status: Http::STATUS_NOT_FOUND);
 			}
 
 			return $this->jsonLdResponse(
-				payload: $this->serializer->serializePayload(object: (array)$object, fallbackType: $type)
+				payload: $this->serializer->serializePayload(object: $object, fallbackType: $type)
 			);
 		}//end if
 
 		// #316: Treat non-published objects as not-found for anonymous callers.
 		// Return 404 (not 403) to avoid confirming the object exists.
-		if ($this->isLifecycleBlocked(object: (array)$object) === true) {
+		if ($this->isLifecycleBlocked(object: $object) === true) {
 			return $this->errorResponse(message: 'Not found', status: Http::STATUS_NOT_FOUND);
 		}
 
-		return $this->jsonLdResponse(payload: $this->serializer->serialize(type: $type, object: (array)$object));
+		return $this->jsonLdResponse(payload: $this->serializer->serialize(type: $type, object: $object));
 	}//end show()
 
 	/**

lib/Controller/PreferencesController.php

@@ -3,8 +3,8 @@
 /**
  * Decidiq PreferencesController.
  *
- * Generic per-user key/value preferences, backed by Nextcloud IConfig
- * user values. Used by shared @conduction/nextcloud-vue widgets (e.g.
+ * Generic per-user key/value preferences, backed by Nextcloud's per-user
+ * config store (IUserConfig). Used by shared @conduction/nextcloud-vue widgets (e.g.
  * CnSupportDialog's "seen" flag) that need to persist a small per-user
  * UI flag cross-device without a bespoke endpoint per feature.
  *
@@ -28,7 +28,7 @@
 use OCP\AppFramework\Controller;
 use OCP\AppFramework\Http;
 use OCP\AppFramework\Http\JSONResponse;
-use OCP\IConfig;
+use OCP\Config\IUserConfig;
 use OCP\IRequest;
 use OCP\IUserSession;
 
@@ -42,12 +42,12 @@ class PreferencesController extends Controller {
 	 * Constructor.
 	 *
 	 * @param IRequest $request The request.
-	 * @param IConfig $config The Nextcloud config (user values).
+	 * @param IUserConfig $userConfig The Nextcloud per-user config store.
 	 * @param IUserSession $userSession The user session.
 	 */
 	public function __construct(
 		IRequest $request,
-		private readonly IConfig $config,
+		private readonly IUserConfig $userConfig,
 		private readonly IUserSession $userSession,
 	) {
 		parent::__construct(appName: Application::APP_ID, request: $request);
@@ -77,9 +77,9 @@ public function getPreference(string $key): JSONResponse {
 			return new JSONResponse(data: ['message' => 'Invalid key'], statusCode: Http::STATUS_BAD_REQUEST);
 		}
 
-		$value = $this->config->getUserValue(
+		$value = $this->userConfig->getValueString(
 			userId: $user->getUID(),
-			appName: Application::APP_ID,
+			app: Application::APP_ID,
 			key: 'pref_' . $safeKey,
 			default: ''
 		);
@@ -118,18 +118,18 @@ public function setPreference(string $key, string $value = ''): JSONResponse {
 
 		// An empty value clears the preference rather than storing a blank one.
 		if ($value === '') {
-			$this->config->deleteUserValue(
+			$this->userConfig->deleteUserConfig(
 				userId: $user->getUID(),
-				appName: Application::APP_ID,
+				app: Application::APP_ID,
 				key: 'pref_' . $safeKey
 			);
 
 			return new JSONResponse(data: ['value' => null]);
 		}
 
-		$this->config->setUserValue(
+		$this->userConfig->setValueString(
 			userId: $user->getUID(),
-			appName: Application::APP_ID,
+			app: Application::APP_ID,
 			key: 'pref_' . $safeKey,
 			value: $value
 		);
@@ -139,7 +139,7 @@ public function setPreference(string $key, string $value = ''): JSONResponse {
 
 	/**
 	 * Restrict keys to a safe charset so callers cannot reach arbitrary
-	 * IConfig user values outside the `pref_` namespace.
+	 * per-user config values outside the `pref_` namespace.
 	 *
 	 * @param string $key The raw key.
 	 *

lib/Dashboard/DecidiqDashboardWidget.php

@@ -163,7 +163,7 @@ public function load(): void {
 	 *
 	 * @SuppressWarnings(PHPMD.UnusedFormalParameter)
 	 *
-	 * @return WidgetButton[] The widget buttons
+	 * @return list<WidgetButton> The widget buttons
 	 */
 	public function getWidgetButtons(string $userId): array {
 		return [

lib/Lifecycle/QesGuard.php

@@ -207,7 +207,7 @@ private function loadSignedBy(string $resolutionId): array {
 			]
 		);
 
-		foreach ((array)$minutesRows as $row) {
+		foreach ($minutesRows as $row) {
 			$minutes = $this->toArray(row: $row);
 			if (($minutes['meetingIntegration'] ?? null) !== $meetingId) {
 				continue;