phpmd.xml

<?xml version="1.0"?>
<ruleset name="unitpay-php-sdk"
         xmlns="http://pmd.sf.net/ruleset/1.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://pmd.sf.net/ruleset/1.0.0 http://pmd.sf.net/ruleset_xml_schema.xsd"
         xsi:noNamespaceSchemaLocation="http://pmd.sf.net/ruleset_xml_schema.xsd">

    <description>
        PHPMD ruleset for the layered Unitpay SDK (PSR-4, src/).

        Stock rulesets with the smallest possible set of deviations: every exclusion and
        every retuned threshold below corresponds to a violation that actually fires
        against the current src/ and is named explicitly. The generous thresholds this
        file used to carry were granted to the pre-3.0 single-file god class; that class
        is gone, so they were dropped rather than inherited — an over-tuned detector
        would silently accept a slide back towards it.
    </description>

    <rule ref="rulesets/cleancode.xml">
        <!--
            Four call sites, all stateless helpers that are static by design and
            deliberately not injected: SignatureBuilder::stringifyFloats() in
            Unitpay::form() and AbstractService::request(), and IpAllowlist::isValidEntry()
            / ::parseWebhooksFeed() in WebhookVerifier.
        -->
        <exclude name="StaticAccess"/>
    </rule>

    <rule ref="rulesets/codesize.xml">
        <!-- Both retuned below rather than dropped, so genuinely complex code still trips. -->
        <exclude name="CyclomaticComplexity"/>
        <exclude name="NPathComplexity"/>
    </rule>

    <!--
        WebhookVerifier::checkHandlerRequest() is the security gate: a flat chain of guard
        clauses (supported method -> params present -> signature -> source IP), measured at
        CC 10 and NPath 256. It is linear rather than tangled, and restructuring the one
        method that decides whether a webhook is trusted is not worth the risk, so the two
        thresholds sit just above its measured values instead. This is a deliberate
        tradeoff, not a clean bill of health. Nothing else in src/ comes close, and the
        next guard clause added here doubles NPath to 512 and trips the rule.
    -->
    <rule ref="rulesets/codesize.xml/CyclomaticComplexity">
        <properties>
            <property name="reportLevel" value="11"/>
        </properties>
    </rule>

    <rule ref="rulesets/codesize.xml/NPathComplexity">
        <properties>
            <property name="minimum" value="260"/>
        </properties>
    </rule>

    <rule ref="rulesets/controversial.xml">
        <!--
            Reading $_GET (checkHandlerRequest) and $_SERVER['REMOTE_ADDR'] (getIp) is the
            documented webhook design — REMOTE_ADDR specifically, never X-Forwarded-For,
            which an attacker controls. Both are overridable through the constructor seams.
        -->
        <exclude name="Superglobals"/>
    </rule>

    <rule ref="rulesets/design.xml">
        <!-- Retuned below rather than dropped, so a genuinely tangled class still trips. -->
        <exclude name="CouplingBetweenObjects"/>
    </rule>

    <!--
        Measured across the whole of src/: Unitpay 13, WebhookVerifier 12, AbstractService
        11, everything else 3 or below. Only the facade actually trips the stock limit of
        13, and it does so for the reason a composition root always does — it couples to
        what it composes: four services plus AbstractService, the transport port and its
        default stack, PendingParams, ClientInfo, SignatureBuilder, WebhookVerifier,
        CashItem and one exception. None of those is removable without either changing the
        public API (the service getters must name their return types) or moving the wiring
        into a class that would couple to exactly the same things.

        The threshold therefore sits one above the measurement. Be aware of what that
        buys: it also gives WebhookVerifier and AbstractService a little headroom they did
        not ask for, so this is a genuine loosening for three classes, not a targeted
        exemption for one. It is still preferred over an in-code @SuppressWarnings, which
        this project uses nowhere, and the margin is deliberately one — the next dependency
        added to any of the three trips the rule again.
    -->
    <rule ref="rulesets/design.xml/CouplingBetweenObjects">
        <properties>
            <property name="maximum" value="14"/>
        </properties>
    </rule>

    <rule ref="rulesets/naming.xml">
        <!--
            $ip (WebhookVerifier, IpAllowlist) and $ch (CurlTransport) are the idiomatic
            names for an address and a cURL handle; longer ones would read worse.
        -->
        <exclude name="ShortVariable"/>
    </rule>

    <rule ref="rulesets/unusedcode.xml"/>
</ruleset>