fix(gate-7): a (string) cast blinded Pattern 6 — the guard was unchanged, only its spelling (#414)

[rubenvdlinde]

Closes #414.

Reproduced first — five arms on the shipped openbuild file, one token varying

arm	expression carrying the session identity	gate-7
A (shipped)	uid: (string)$user->getUID()	FAIL
B	uid: $user->getUID()	PASS
C	$uid = (string)$user->getUID(); … uid: $uid	FAIL
D	appId: (string)$appId, uid: $user->getUID()	PASS
E	$uid = $user->getUID(); … uid: $uid	PASS

D rules out "any cast in the call defeats it" — an unrelated cast is harmless. C rules out "hoist it into a local" as the workaround.

Mechanism

Pattern 6's identity recogniser applies control 2 — "the expression may carry no call ARGUMENTS" — with \(\s*[^)\s]. A PHP cast is written with exactly those bytes:

>>> re.search(r"\(\s*[^)\s]", "(string)$user->getUID()")   # matches "(s"

So the guard did not change; only its spelling did. And the cast is not an odd spelling: IUser::getUID() carries no PHP return type (only @return string), so Psalm and PHPStan actively encourage writing it. The gate and the analysers pulled in opposite directions on the same line.

This is a false positive whose recommended repair is wrong: gate-7's FAIL text says "the fix is to scope the object to the caller" and the object already was — the UID is never a request parameter. Following the guidance means adding a redundant guard to an endpoint that had one, and then believing the gate about it.

The fix

A leading (string) / (int) / (integer) cast is normalised away before classification. (array) and (object) are deliberately absent — they would launder a payload into an identity. Both surviving controls run after the strip, so nothing widens: (string)canAccess($id, $uid) still has a real argument list, (string)$row['ownerId'] still has a subscript.

⚠️ The strip is applied in _argument_is_session_identity as well, before the bare-variable test — not only inside _is_identity_expression. Doing it in one place only would have routed (string)$targetUid past the declared-parameter veto (_IDENTITY_TOKEN_RE matches "uid"), turning a false positive into a false negative. That is the direction that leaves no log to notice.

Measured before/after — gate-7 on lib/Controller, all 18 core apps

repo	before	after	Δ
decidesk	15	15	0
docudesk	23	23	0
doriath	4	4	0
hermiq	17	17	0
larpingapp	1	1	0
launchpad	1	1	0
nldesign	0	0	0
openbuild	6	6	0
opencatalogi	14	14	0
openconnector	80	80	0
openregister	95	95	0
pipelinq	50	50	0
portaliq	1	1	0
procest	27	27	0
scholiq	4	4	0
shillinq	18	18	0
softwarecatalog	30	30	0
zaakafhandelapp	89	89	0
TOTAL	475	475	+0

Zero delta is the honest number, and it is not zero effect: ConductionNL/openbuild#196 had already dropped the cast in-app, so the only live site was gone before this ran.

Two-directional control on the byte-exact pre-#196 file: WITHOUT this change it reports method=getUser rule=no-auth-guard-in-body (7 findings); WITH it, it does not (6). That matches openbuild#196's own recorded measurement of 7 → 6 exactly. Same file, same checker, one token.

Revert control — which arms are evidence

Suite re-run with the fixtures kept and the checker reverted:

• EVIDENCE — authn-vs-authz/clean handoffCastIdentity() + handoffCastLocal(): the clean arm FAILS with 2 method(s) with NoAdminRequired + no guard → 130 passed / 4 failed. With the fix: 134 / 0. (A false-positive fix shows up as a clean arm that stops failing.)
• CONTROL — authn-vs-authz/planted castCallerValue(): a cast on a value the caller chose. Reports before and after, so "strip every cast and classify what is left" cannot pass this bundle.
• CONTROL — the three #365 planted arms and the four original clean shapes: unchanged in both directions.

test_check_no_admin_idor.py: 145 pass, seven of them new (including test_cast_on_a_caller_supplied_value_is_still_reported, test_cast_does_not_make_object_data_an_identity, test_array_and_object_casts_are_not_stripped). test_gate_orphaned_capability_fixtures.sh fails identically on pristine main (missing fixture dirs) — pre-existing, not this branch.

🤖 Generated with Claude Code

[rubenvdlinde]

Merged main in and resolved.

#426 and #427 each merged cleanly onto main individually and conflicted with each other — both appended a test class at the same point in test_check_no_admin_idor.py. Testing each against the base could never have surfaced that; it only appears when you build the combined tree.

The conflict is purely additive, so the resolution is union, not a choice. Verified on the combined tree before pushing:

• test_check_no_admin_idor — 162 tests, OK (the fix(gates 7, 25, 48, 49): a comment must not be enough to get past a gate — 47 of 65 were (#415 class) #425 + fix(gate-7): Pattern 8 is keyed on the signature, so a SOAP endpoint is invisible to it (#413) #426 + fix(gate-7): a (string) cast blinded Pattern 6 — the guard was unchanged, only its spelling (#414) #427 combination, which no run had exercised)
• test_gate_acceptance_matrix.sh — 137 passed, 0 failed, 60 of 65 gates fixtured

Both checkers compile. Re-running CI on the merged head now.