DerManoMann · Oct 13, 2026 · Oct 13, 2026
diff --git a/phpstan-baseline.neon b/phpstan-baseline.neon
diff --git a/phpstan.neon → phpstan.neon.dist b/phpstan.neon → phpstan.neon.dist
@@ -1,9 +1,6 @@
-includes:
-	- phpstan-baseline.neon
-
 parameters:
     phpVersion: 80200
-    level: 5
+    level: 7
     paths:
         - src
         - tests

diff --git a/src/Adapters/AbstractOpenApiResponseVerifier.php b/src/Adapters/AbstractOpenApiResponseVerifier.php
@@ -8,44 +8,44 @@ trait AbstractOpenApiResponseVerifier
 {
     protected object|string|null $openapiSpecification = null;
 
-    protected function prepareOpenApiSpecificationLoader(string $srcDir, ?string $specification = null)
+    /**
+     * Find the specification: the given one, then `tests/openapi.json` or `tests/openapi.yaml`,
+     * then one generated from `$srcDir`.
+     */
+    protected function prepareOpenApiSpecificationLoader(string $srcDir, ?string $specification = null): void
     {
-        $appRoot = null;
-
         if ($specification) {
             $this->openapiSpecification = $specification;
         }
 
-        // try loader
-        $specificationLoader = $this->getOpenApiSpecificationLoader();
+        if ($this->getOpenApiSpecificationLoader()) {
+            return;
+        }
+
+        $appRoot = $this->getAppRoot();
 
-        if (!$specificationLoader) {
-            $appRoot = $appRoot ?: $this->getAppRoot();
+        foreach (['openapi.json', 'openapi.yaml'] as $specfile) {
+            if (file_exists($filename = $appRoot . '/tests/' . $specfile)) {
+                $this->openapiSpecification = $filename;
 
-            // try some default filenames
-            foreach (['openapi.json', 'openapi.yaml'] as $specfile) {
-                if (file_exists($specification = $appRoot . '/tests/' . $specfile)) {
-                    $this->openapiSpecification = $specification;
-                    break;
-                }
+                return;
             }
-
-            // try loader again
-            $specificationLoader = $this->getOpenApiSpecificationLoader();
         }
 
-        if (!$specificationLoader) {
-            $appRoot = $appRoot ?: $this->getAppRoot();
-
-            $openApi = (new Generator())->generate([$appRoot . '/' . $srcDir]);
-            $this->openapiSpecification = json_decode($openApi->toJson());
-        }
+        $openApi = (new Generator())->generate([$appRoot . '/' . $srcDir]);
+        $this->openapiSpecification = json_decode($openApi->toJson());
     }
 
-    protected function getAppRoot()
+    /**
+     * The project root: three levels above Composer's `ClassLoader`, in `vendor/composer/`.
+     */
+    protected function getAppRoot(): string
     {
-        $rc = new \ReflectionClass('\Composer\Autoload\ClassLoader');
+        $classLoader = (new \ReflectionClass(\Composer\Autoload\ClassLoader::class))->getFileName();
+        if (false === $classLoader) {
+            throw new \RuntimeException('Cannot locate the project root: Composer\'s ClassLoader has no file');
+        }
 
-        return dirname(dirname(dirname($rc->getFileName())));
+        return dirname($classLoader, 3);
     }
 }
diff --git a/src/Adapters/Laravel/OpenApiVerifierMiddleware.php b/src/Adapters/Laravel/OpenApiVerifierMiddleware.php
@@ -2,11 +2,14 @@
 
 namespace Radebatz\OpenApi\Verifier\Adapters\Laravel;
 
+use Illuminate\Http\Request;
+use Illuminate\Routing\Route;
 use Nyholm\Psr7\Factory\Psr17Factory;
 use Psr\Http\Message\ResponseInterface;
 use Radebatz\OpenApi\Verifier\OpenApiSchemaMismatchException;
 use Radebatz\OpenApi\Verifier\OpenApiVerifier;
 use Symfony\Bridge\PsrHttpMessage\Factory\PsrHttpFactory;
+use Symfony\Component\HttpFoundation\Response;
 
 /**
  * Terminating middleware verifying every response against the specification.
@@ -29,18 +32,21 @@ public function __construct(
         $this->psrHttpFactory = new PsrHttpFactory($psr17Factory, $psr17Factory, $psr17Factory, $psr17Factory);
     }
 
-    public function handle($request, \Closure $next)
+    public function handle(Request $request, \Closure $next): Response
     {
         return $next($request);
     }
 
-    public function terminate($request, $response): void
+    public function terminate(Request $request, Response $response): void
     {
         $psrRequest = $this->psrHttpFactory->createRequest($request);
         $psrResponse = $this->psrHttpFactory->createResponse($response);
 
         try {
-            $this->verifier->verify($psrRequest, $psrResponse, $request->route()?->uri);
+            // what `route()` calls; its docblock claims a route is always there, but a request that
+            // matched none, a 404 for example, has none
+            $route = ($request->getRouteResolver())();
+            $this->verifier->verify($psrRequest, $psrResponse, $route instanceof Route ? $route->uri() : null);
         } catch (OpenApiSchemaMismatchException $oasme) {
             if ($this->onMismatch instanceof \Closure) {
                 ($this->onMismatch)($oasme, $psrResponse);

diff --git a/src/Adapters/Slim/OpenApiResponseVerifier.php b/src/Adapters/Slim/OpenApiResponseVerifier.php
@@ -13,6 +13,11 @@ trait OpenApiResponseVerifier
 {
     use AbstractOpenApiResponseVerifier, VerifiesOpenApi;
 
+    /**
+     * @template TContainer of \Psr\Container\ContainerInterface|null
+     *
+     * @param App<TContainer> $app
+     */
     public function registerOpenApiVerifier(App $app, ?string $specification = null): void
     {
         $this->prepareOpenApiSpecificationLoader('src', $specification);

diff --git a/src/OpenApiSpecificationLoader.php b/src/OpenApiSpecificationLoader.php
@@ -7,22 +7,21 @@
 
 class OpenApiSpecificationLoader
 {
-    protected $filename;
-    protected $specification;
+    protected \stdClass $specification;
 
     /**
-     * @param $specification object|string The specification object or filename
+     * @param mixed $specification the specification object, or the filename of a JSON or YAML document
      */
-    public function __construct($specification)
+    public function __construct(mixed $specification)
     {
         $this->specification = $this->resolveSpecification($specification);
     }
 
-    protected function resolveSpecification($specification)
+    protected function resolveSpecification(mixed $specification): \stdClass
     {
         $resolved = null;
         if (is_string($specification)) {
-            if (false !== strpos($specification, '.yaml') || false !== strpos($specification, '.yml')) {
+            if (preg_match('/\.ya?ml$/i', $specification)) {
                 try {
                     $resolved = (object) Yaml::parseFile($specification, Yaml::PARSE_OBJECT_FOR_MAP);
                 } catch (ParseException $parseException) {
@@ -32,15 +31,18 @@ protected function resolveSpecification($specification)
                         $parseException
                     );
                 }
-            } elseif (file_exists($specification)) {
-                $resolved = json_decode(file_get_contents($specification));
+            } elseif (file_exists($specification) && false !== ($json = file_get_contents($specification))) {
+                $resolved = json_decode($json);
             }
 
-            if (!$resolved) {
+            if (!$resolved instanceof \stdClass) {
                 throw new \InvalidArgumentException(sprintf('Could not load specification: %s', $specification));
             }
-        } elseif (is_object($specification)) {
+        } elseif ($specification instanceof \stdClass) {
             $resolved = $specification;
+        } elseif (is_object($specification)) {
+            // any other object, as plain data
+            $resolved = json_decode((string) json_encode($specification));
         } else {
             throw new \InvalidArgumentException('Invalid specification');
         }
@@ -78,7 +80,7 @@ public function getResponseSchemaFor(string $method, string $path, int $statusCo
         }
 
         // copy, so the components do not end up inside the specification itself
-        $schema = is_object($schema) ? clone $schema : (object) $schema;
+        $schema = $schema instanceof \stdClass ? clone $schema : (object) (array) $schema;
         $schema->components = $this->property($this->specification, 'components') ?? new \stdClass();
 
         return $schema;

diff --git a/src/Schema/OpenApi30Translator.php b/src/Schema/OpenApi30Translator.php
@@ -47,7 +47,8 @@ private function translateNode(mixed $node): mixed
             return array_map($this->translateNode(...), $node);
         }
 
-        if (!is_object($node)) {
+        // the copy comes from `json_decode()`, so every object in it is a `stdClass`
+        if (!$node instanceof \stdClass) {
             return $node;
         }
 

diff --git a/tests/Adapters/AbstractOpenApiResponseVerifierTest.php b/tests/Adapters/AbstractOpenApiResponseVerifierTest.php
@@ -25,7 +25,7 @@ protected function tearDown(): void
         }
     }
 
-    protected function getAppRoot()
+    protected function getAppRoot(): string
     {
         return $this->appRoot;
     }
@@ -42,7 +42,7 @@ protected function assertVerifiesUsers(): void
     }
 
     #[Test]
-    public function explicitSpecification()
+    public function explicitSpecification(): void
     {
         $this->appRoot = '/does/not/exist';
 
@@ -52,7 +52,7 @@ public function explicitSpecification()
     }
 
     #[Test]
-    public function discoveredSpecification()
+    public function discoveredSpecification(): void
     {
         $this->tmpDir = sys_get_temp_dir() . '/openapi-verifier-' . uniqid();
         mkdir($this->tmpDir . '/tests', 0777, true);
@@ -65,7 +65,7 @@ public function discoveredSpecification()
     }
 
     #[Test]
-    public function generatedSpecification()
+    public function generatedSpecification(): void
     {
         // no tests/openapi.{json,yaml} under tests/, so this generates from tests/Fixtures
         $this->appRoot = dirname(__DIR__);

diff --git a/tests/Adapters/ClientAdapterTest.php b/tests/Adapters/ClientAdapterTest.php
@@ -23,6 +23,9 @@ protected function verifier(): OpenApiVerifier
         return OpenApiVerifier::fromSpecification(__DIR__ . '/../specifications/users.yaml');
     }
 
+    /**
+     * @return iterable<array<mixed>>
+     */
     public static function responses(): iterable
     {
         // path, body, expected error (null: valid)

diff --git a/tests/Adapters/LaravelAdapterTest.php b/tests/Adapters/LaravelAdapterTest.php
@@ -4,21 +4,18 @@
 
 use Illuminate\Contracts\Console\Kernel;
 use Illuminate\Foundation\Application;
+use Illuminate\Foundation\Testing\TestCase;
 use Illuminate\Support\Facades\Facade;
 use PHPUnit\Framework\AssertionFailedError;
 use PHPUnit\Framework\Attributes\Test;
 use Radebatz\OpenApi\Verifier\Adapters\Laravel\OpenApiResponseVerifier;
 
-class LaravelAdapterTest extends LaravelTestCase
+class LaravelAdapterTest extends TestCase
 {
     use OpenApiResponseVerifier;
 
     protected function setUp(): void
     {
-        if (!class_exists('\\Illuminate\\Foundation\\Application')) {
-            $this->markTestSkipped('Laravel not installed.');
-        }
-
         parent::setUp();
 
         $this->registerOpenApiVerifier(null, __DIR__ . '/../specifications/users.yaml');
@@ -27,7 +24,7 @@ protected function setUp(): void
     #[Test]
     public function passVerificationUsers(): void
     {
-        $this->createApplication()
+        $this->app
             ->get('router')->get('/users', function () {
                 return '{"data":[{"id":1,"name":"joe","email":"joe@cool.com"}]}';
             });
@@ -40,7 +37,7 @@ public function passVerificationUsers(): void
     #[Test]
     public function failVerificationUsers(): void
     {
-        $this->createApplication()
+        $this->app
             ->get('router')->get('/users', function () {
                 return '{"data":[{"id":1,"email":"joe@cool.com"}]}';
             });
@@ -53,7 +50,7 @@ public function failVerificationUsers(): void
     #[Test]
     public function passVerificationUser(): void
     {
-        $this->createApplication()
+        $this->app
             ->get('router')->get('/user/{id}', function () {
                 return '{"data":{"id":1,"name":"joe","email":"joe@cool.com"}}';
             });
@@ -66,7 +63,7 @@ public function passVerificationUser(): void
     #[Test]
     public function failVerificationUser(): void
     {
-        $this->createApplication()
+        $this->app
             ->get('router')->get('/user/{id}', function () {
                 return '{"data":{"id":1,"name":"joe"}}';
             });
@@ -77,22 +74,20 @@ public function failVerificationUser(): void
         $this->get('/user/1');
     }
 
-    /** @inheritdoc */
-    public function createApplication()
+    /**
+     * Laravel's `setUp()` calls this and keeps the result in `$this->app`.
+     */
+    public function createApplication(): Application
     {
-        if (!$this->app) {
-            /** @var Application $app */
-            $app = require __DIR__ . '/../../vendor/laravel/laravel/bootstrap/app.php';
-            $app->make(Kernel::class)->bootstrap();
-            $app['config']->set([
-                'app.environment' => 'local',
-                'app.debug' => true,
-            ]);
-            Facade::setFacadeApplication($app);
-
-            $this->app = $app;
-        }
-
-        return $this->app;
+        /** @var Application $app */
+        $app = require __DIR__ . '/../../vendor/laravel/laravel/bootstrap/app.php';
+        $app->make(Kernel::class)->bootstrap();
+        $app['config']->set([
+            'app.environment' => 'local',
+            'app.debug' => true,
+        ]);
+        Facade::setFacadeApplication($app);
+
+        return $app;
     }
 }
diff --git a/tests/Adapters/LaravelTestCase.php b/tests/Adapters/LaravelTestCase.php