phpmd.xml

<?xml version="1.0"?>
<ruleset name="shillinq"
    xmlns="http://pmd.sourceforge.net/ruleset/2.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 http://pmd.sourceforge.net/ruleset_xml_schema.xsd">
    <description>shillinq — Conduction PHPMD ruleset (single source: conduction/hydra-gates).</description>

    <!-- Deviations from the central ruleset go BELOW this line, each with a
         reason and a tracking issue. Everything else comes from
         conduction/hydra-gates. All twelve relaxations below are the ones this
         app already carried; they are re-declared verbatim so the effective
         rule set is unchanged by the move to the central ruleset. Paying the
         underlying debt down belongs in shillinq#506, not here. -->
    <rule ref="vendor/conduction/hydra-gates/quality-config/phpmd.xml">
        <exclude name="StaticAccess"/>
        <exclude name="CyclomaticComplexity"/>
        <exclude name="NPathComplexity"/>
        <exclude name="ExcessiveMethodLength"/>
        <exclude name="ExcessiveClassLength"/>
        <exclude name="ExcessiveParameterList"/>
        <exclude name="TooManyMethods"/>
        <exclude name="TooManyPublicMethods"/>
        <exclude name="ExcessiveClassComplexity"/>
        <exclude name="CouplingBetweenObjects"/>
        <exclude name="ShortVariable"/>
        <exclude name="LongVariable"/>
    </rule>

    <!--
        StaticAccess exceptions (issue #506): every class below was audited and is
        either (a) a static factory / immutable value-object constructor
        (GuardResult, KlantbeeldResult/Transaction, PipelinqContact,
        InvoiceGenerationRequest, AggregationQuery, MetricSample,
        PortalPaymentSessionResult), (b) a static
        config/catalogue/rule registry deliberately designed as a stateless
        lookup table (RuleEngine, RuleCatalogue, ReportCatalogue, DBAConstants,
        TokenValidator), (c) a native PHP class (DateTimeImmutable), or (d) a
        third-party/Nextcloud static API we do not own and cannot inject
        (PhpOffice\PhpWord\*, OCP\Server). None of these represent the "hard
        dependency on a service that should be mocked" smell this rule targets.

        (e) ObjectIdentifier (shillinq#526) is a pure function of its argument.
        The exemption's reason is a TESTABLE CLAIM about the class, not a claim
        about the world, so it cannot rot: the class declares NO constructor, NO
        properties and NO collaborators, so there is nothing the rule's
        "should be mocked" concern can apply to. If a future edit gives it state
        or an injected dependency, that claim becomes false and this entry must
        be removed rather than kept — check it before trusting this line.
    -->
    <rule ref="rulesets/cleancode.xml/StaticAccess">
        <properties>
            <property name="exceptions" value="
                DateTimeImmutable,
                OCP\Server,
                OCA\Shillinq\Support\FleetAppId,
                OCA\OpenRegister\Lifecycle\GuardResult,
                OCA\OpenRegister\Service\Aggregation\AggregationQuery,
                OCA\OpenRegister\AppHost\Observability\MetricSample,
                OCA\Shillinq\Standards\RuleEngine,
                OCA\Shillinq\Standards\RuleCatalogue,
                OCA\Shillinq\Reporting\ReportCatalogue,
                OCA\Shillinq\Enums\DBAConstants,
                OCA\Shillinq\Util\TokenValidator,
                OCA\Shillinq\Util\ObjectIdentifier,
                OCA\Shillinq\Request\InvoiceGenerationRequest,
                OCA\Shillinq\Service\Pipelinq\PipelinqContact,
                OCA\Shillinq\Service\Pipelinq\KlantbeeldResult,
                OCA\Shillinq\Service\Pipelinq\KlantbeeldTransaction,
                OCA\Shillinq\Service\Payment\PortalPaymentSessionResult,
                PhpOffice\PhpWord\Shared\Converter,
                PhpOffice\PhpWord\Settings,
                PhpOffice\PhpWord\IOFactory
            "/>
        </properties>
    </rule>

    <!-- Code Size Rules -->
    <!--
        Thresholds below are calibrated (issue #506) from the observed distribution
        of a full-codebase phpmd run: each was raised just past the point where the
        long tail of "just barely over the generic PHPMD default" findings clears,
        while still catching genuine outliers (which carry per-class/method
        @SuppressWarnings with a rationale). This financial/tax/accounting domain
        (SBR/XBRL, VAT, BIK staffel, multi-jurisdiction compliance) has inherently
        higher branch counts and DTO/service surface area than PHPMD's generic
        defaults assume.
    -->
    <rule ref="rulesets/codesize.xml/CyclomaticComplexity">
        <properties>
            <property name="reportLevel" value="15"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/NPathComplexity">
        <properties>
            <property name="minimum" value="5000"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/ExcessiveMethodLength">
        <properties>
            <property name="minimum" value="150"/>
            <property name="ignore-whitespace" value="false"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/ExcessiveClassLength">
        <properties>
            <property name="minimum" value="1300"/>
            <property name="ignore-whitespace" value="false"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/ExcessiveParameterList">
        <properties>
            <property name="minimum" value="13"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/TooManyMethods">
        <properties>
            <property name="maxmethods" value="35"/>
            <property name="ignorepattern" value="(^(set|get|is|has|with))i"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/TooManyPublicMethods">
        <properties>
            <property name="maxmethods" value="14"/>
        </properties>
    </rule>
    <rule ref="rulesets/codesize.xml/ExcessiveClassComplexity">
        <properties>
            <property name="maximum" value="80"/>
        </properties>
    </rule>

    <!-- CouplingBetweenObjects raised 13->19 (issue #506): the generic PHPMD
         default under-counts tolerable coupling for Nextcloud app classes,
         which routinely inject 14-19 collaborators (services + guards +
         loggers + config) via constructor DI. -->
    <rule ref="rulesets/design.xml/CouplingBetweenObjects">
        <properties>
            <property name="maximum" value="19"/>
        </properties>
    </rule>

    <!--
        ShortVariable configured with allowlist of idiomatic short names.
        Extended (issue #506) with the short names that recurred 2+ times,
        independently, across the codebase-wide phpmd audit: each is an
        established local abbreviation (e.g. o=OpenRegister row/object in a
        foreach, os=objectService, gl=GL account, tx=transaction, dt=date,
        cv=coefficient/control-value), not a one-off unclear name.
    -->
    <rule ref="rulesets/naming.xml/ShortVariable">
        <properties>
            <property name="minimum" value="3" />
            <property name="exceptions" value="id,db,qb,op,ui,io,gc,tz,pk,fk,to,ch,a,b,l,v,c,t,r,f,n,k,e,o,po,vb,os,rs,m,tx,bs,s,ok,h,gl,dt,ts,pl,kp,kd,cv,bc" />
        </properties>
    </rule>

    <!-- LongVariable raised 20->24 (issue #506): clears the dominant repeated
         domain term `$administrationContext` (21 chars) and its siblings,
         which are the CORRECT self-documenting name for this app's core
         multi-tenant concept - shortening them would reduce clarity. -->
    <rule ref="rulesets/naming.xml/LongVariable">
        <properties>
            <property name="maximum" value="24"/>
        </properties>
    </rule>
</ruleset>