Immutable methods have incorrect return types

[anthonyryan1]

Version(s) affected

11.4.1

Description

The new immutable interface is causing static analysis false positives because the immutable methods return self, which is an OTP rather than TOTP or HOTP with their specific provisions.

Because we've got the wrong interface, static analysis is

How to reproduce

mkdir testdir
cd testdir
composer require spomky-labs/otphp phpstan/phpstan

Create test.php

<?php

declare(strict_types=1);

require('vendor/autoload.php');

use OTPHP\TOTP;
use OTPHP\InternalClock;

// We start with a TOTP object and get no false positives during static analysis
$totp = TOTP::generate(new InternalClock());
PHPStan\dumpType($totp);
$totp->verify('123456', leeway: 20);


// As soon as we use an immutable, it reports that it's returning an OTP object instead
$totp = TOTP::generate(new InternalClock())
    ->withLabel("Testing");

PHPStan\dumpType($totp);
// The OTP object does not accept a leeway parameter
$totp->verify('123456', leeway: 20);

Analyze types:

./vendor/bin/phpstan analyze --level=5 test.php

 ------ --------------------------------------------------------------------------- 
  Line   test.php                                                                   
 ------ --------------------------------------------------------------------------- 
  12     Dumped type: OTPHP\TOTP                                                    
  19     Dumped type: OTPHP\OTP                                                     
  20     Unknown parameter $leeway in call to method OTPHP\OTPInterface::verify().  
         🪪  argument.unknown                                                       
 ------ --------------------------------------------------------------------------- 

Possible Solution

No response

Additional Context

No response

[anthonyryan1]

I believe the fix here will be to use "static" instead of "self" as the return type for all of the immutable methods.

Late-static binding should help us preserve the class types we're actually using for static analysis. I'll get a pull request ready in about an hour.