chore: add php-cs-fixer with PSR-12 config and CI check

- Add friendsofphp/php-cs-fixer to require-dev
- Create .php-cs-fixer.dist.php configured for @PSR12 ruleset
- Add php-cs-fixer dry-run step to CI pipeline
- Auto-fix existing PSR-12 violations
- Document code style tooling in readme.md

tests/Unit/Service/DomainManagerTest.php

@@ -1,4 +1,5 @@
 <?php
+
 declare(strict_types=1);
 
 namespace App\Tests\Unit\Service;
@@ -6,44 +7,52 @@ namespace App\Tests\Unit\Service;
 use App\Service\DomainManager;
 use PHPUnit\Framework\TestCase;
 
-final class DomainManagerTest extends TestCase {
-    private function createManager(bool $subdomainRedirect, string $authSubdomain): DomainManager {
+final class DomainManagerTest extends TestCase
+{
+    private function createManager(bool $subdomainRedirect, string $authSubdomain): DomainManager
+    {
         return new DomainManager($subdomainRedirect, $authSubdomain);
     }
 
     /* ── authBase / getAuthSubdomain ─────────────────────────────────────── */
 
-    public function testAuthBaseIsNullWhenSubdomainRedirectIsDisabled(): void {
+    public function testAuthBaseIsNullWhenSubdomainRedirectIsDisabled(): void
+    {
         $manager = $this->createManager(false, 'auth.example.com');
         self::assertNull($manager->authBase());
         self::assertNull($manager->getAuthSubdomain());
     }
 
-    public function testAuthBaseIsNullWhenAuthSubdomainIsEmpty(): void {
+    public function testAuthBaseIsNullWhenAuthSubdomainIsEmpty(): void
+    {
         $manager = $this->createManager(true, '');
         self::assertNull($manager->authBase());
         self::assertNull($manager->getAuthSubdomain());
     }
 
-    public function testAuthBaseExtractsSimpleDomain(): void {
+    public function testAuthBaseExtractsSimpleDomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertSame('example.com', $manager->authBase());
         self::assertSame('auth.example.com', $manager->getAuthSubdomain());
     }
 
-    public function testAuthBaseExtractsMultiPartTld(): void {
+    public function testAuthBaseExtractsMultiPartTld(): void
+    {
         $manager = $this->createManager(true, 'auth.example.co.uk');
         self::assertSame('example.co.uk', $manager->authBase());
         self::assertSame('auth.example.co.uk', $manager->getAuthSubdomain());
     }
 
-    public function testAuthBaseIsNullForLocalhostAuth(): void {
+    public function testAuthBaseIsNullForLocalhostAuth(): void
+    {
         $manager = $this->createManager(true, 'localhost');
         self::assertNull($manager->authBase());
         self::assertNull($manager->getAuthSubdomain());
     }
 
-    public function testAuthBaseIsNullForIpAuth(): void {
+    public function testAuthBaseIsNullForIpAuth(): void
+    {
         $manager = $this->createManager(true, '192.168.1.1');
         self::assertNull($manager->authBase());
         self::assertNull($manager->getAuthSubdomain());
@@ -51,90 +60,105 @@ final class DomainManagerTest extends TestCase {
 
     /* ── validReturn ──────────────────────────────────────────────────────── */
 
-    public function testValidReturnAcceptsAnyUrlWhenNoSubdomain(): void {
+    public function testValidReturnAcceptsAnyUrlWhenNoSubdomain(): void
+    {
         $manager = $this->createManager(false, '');
         self::assertTrue($manager->validReturn('https://evil.com/page'));
         self::assertTrue($manager->validReturn('https://example.com/ok'));
     }
 
-    public function testValidReturnRejectsInvalidUrl(): void {
+    public function testValidReturnRejectsInvalidUrl(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->validReturn('not-a-url'));
         self::assertFalse($manager->validReturn(''));
     }
 
-    public function testValidReturnAcceptsSameBaseDomain(): void {
+    public function testValidReturnAcceptsSameBaseDomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertTrue($manager->validReturn('https://app.example.com/dashboard'));
         self::assertTrue($manager->validReturn('https://example.com/'));
     }
 
-    public function testValidReturnRejectsDifferentBaseDomain(): void {
+    public function testValidReturnRejectsDifferentBaseDomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->validReturn('https://evil.com/phish'));
         self::assertFalse($manager->validReturn('https://other-example.com/'));
     }
 
-    public function testValidReturnHandlesCoUkTld(): void {
+    public function testValidReturnHandlesCoUkTld(): void
+    {
         $manager = $this->createManager(true, 'auth.example.co.uk');
         self::assertTrue($manager->validReturn('https://www.example.co.uk/'));
         self::assertFalse($manager->validReturn('https://example.com/'));
     }
 
-    public function testValidReturnRejectsUrlWithoutHost(): void {
+    public function testValidReturnRejectsUrlWithoutHost(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->validReturn('mailto:test@example.com'));
     }
 
     /* ── matchesAuth ──────────────────────────────────────────────────────── */
 
-    public function testMatchesAuthIsFalseWhenSubdomainRedirectDisabled(): void {
+    public function testMatchesAuthIsFalseWhenSubdomainRedirectDisabled(): void
+    {
         $manager = $this->createManager(false, 'auth.example.com');
         self::assertFalse($manager->matchesAuth('example.com'));
         self::assertFalse($manager->matchesAuth('app.example.com'));
     }
 
-    public function testMatchesAuthIsFalseWhenAuthSubdomainIsEmpty(): void {
+    public function testMatchesAuthIsFalseWhenAuthSubdomainIsEmpty(): void
+    {
         $manager = $this->createManager(true, '');
         self::assertFalse($manager->matchesAuth('example.com'));
     }
 
-    public function testMatchesAuthMatchesSameBaseDomain(): void {
+    public function testMatchesAuthMatchesSameBaseDomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertTrue($manager->matchesAuth('example.com'));
         self::assertTrue($manager->matchesAuth('app.example.com'));
     }
 
-    public function testMatchesAuthRejectsDifferentBaseDomain(): void {
+    public function testMatchesAuthRejectsDifferentBaseDomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->matchesAuth('evil.com'));
         self::assertFalse($manager->matchesAuth('example.org'));
     }
 
-    public function testMatchesAuthHandlesMultiPartTld(): void {
+    public function testMatchesAuthHandlesMultiPartTld(): void
+    {
         $manager = $this->createManager(true, 'auth.example.co.uk');
         self::assertTrue($manager->matchesAuth('www.example.co.uk'));
         self::assertFalse($manager->matchesAuth('example.com'));
     }
 
-    public function testMatchesAuthRejectsIpHost(): void {
+    public function testMatchesAuthRejectsIpHost(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->matchesAuth('192.168.1.1'));
     }
 
-    public function testMatchesAuthRejectsLocalhost(): void {
+    public function testMatchesAuthRejectsLocalhost(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->matchesAuth('localhost'));
     }
 
     /* ── baseDomain edge cases via matchesAuth ────────────────────────────── */
 
-    public function testMatchesAuthWithDeepSubdomain(): void {
+    public function testMatchesAuthWithDeepSubdomain(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertTrue($manager->matchesAuth('a.b.c.example.com'));
     }
 
-    public function testMatchesAuthWithTwoPartDomain(): void {
+    public function testMatchesAuthWithTwoPartDomain(): void
+    {
         /* for a 2-part auth subdomain, the baseDomain retains both parts */
         $manager = $this->createManager(true, 'auth.local');
         self::assertSame('auth.local', $manager->authBase());
@@ -145,7 +169,8 @@ final class DomainManagerTest extends TestCase {
 
     /* ── TLD table coverage ──────────────────────────────────────────────── */
 
-    public function testMatchesAuthWithComAuTld(): void {
+    public function testMatchesAuthWithComAuTld(): void
+    {
         // com.au is NOT in the TLD table (table has au? no, it doesn't),
         // so it's treated as a standard 2-part TLD: base = com.au
         $manager = $this->createManager(true, 'auth.example.com.au');
@@ -154,7 +179,8 @@ final class DomainManagerTest extends TestCase {
         self::assertFalse($manager->matchesAuth('example.com'));
     }
 
-    public function testMatchesAuthWithCoJpTld(): void {
+    public function testMatchesAuthWithCoJpTld(): void
+    {
         // co.jp is NOT in the TLD table (table has jpn under com, not jp under co)
         // so base = co.jp
         $manager = $this->createManager(true, 'auth.example.co.jp');
@@ -162,7 +188,8 @@ final class DomainManagerTest extends TestCase {
         self::assertTrue($manager->matchesAuth('www.example.co.jp'));
     }
 
-    public function testMatchesAuthWithComBrTld(): void {
+    public function testMatchesAuthWithComBrTld(): void
+    {
         // com.br: TLD table has com => [br], meaning *.br.com is multi-part
         // but com.br has last=br, TLD['br'] doesn't exist, so base = com.br
         $manager = $this->createManager(true, 'auth.example.com.br');
@@ -170,35 +197,40 @@ final class DomainManagerTest extends TestCase {
         self::assertTrue($manager->matchesAuth('app.example.com.br'));
     }
 
-    public function testMatchesAuthWithCoNzTld(): void {
+    public function testMatchesAuthWithCoNzTld(): void
+    {
         // co.nz is NOT in the TLD table (nz => [co,net,org], so *.co.nz IS multi-part)
         $manager = $this->createManager(true, 'auth.example.co.nz');
         self::assertSame('example.co.nz', $manager->authBase());
         self::assertTrue($manager->matchesAuth('sub.example.co.nz'));
     }
 
-    public function testMatchesAuthWithComMxTld(): void {
+    public function testMatchesAuthWithComMxTld(): void
+    {
         // com.mx is NOT in the TLD table (mx => [com,net,org], so *.com.mx IS multi-part)
         $manager = $this->createManager(true, 'auth.example.com.mx');
         self::assertSame('example.com.mx', $manager->authBase());
         self::assertTrue($manager->matchesAuth('app.example.com.mx'));
     }
 
-    public function testMatchesAuthWithCoInTld(): void {
+    public function testMatchesAuthWithCoInTld(): void
+    {
         // co.in: in => [co,...], so *.co.in IS multi-part
         $manager = $this->createManager(true, 'auth.example.co.in');
         self::assertSame('example.co.in', $manager->authBase());
         self::assertTrue($manager->matchesAuth('app.example.co.in'));
     }
 
-    public function testMatchesAuthWithBrComTld(): void {
+    public function testMatchesAuthWithBrComTld(): void
+    {
         // br.com: TLD table has com => [br], so *.br.com IS multi-part
         $manager = $this->createManager(true, 'auth.example.br.com');
         self::assertSame('example.br.com', $manager->authBase());
         self::assertTrue($manager->matchesAuth('app.example.br.com'));
     }
 
-    public function testSimpleTldNotTreatedAsMultiPart(): void {
+    public function testSimpleTldNotTreatedAsMultiPart(): void
+    {
         // example.com is a standard 2-part domain, not multi-part
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertSame('example.com', $manager->authBase());
@@ -208,7 +240,8 @@ final class DomainManagerTest extends TestCase {
 
     /* ── baseDomain edge cases ───────────────────────────────────────────── */
 
-    public function testMatchesAuthWithSingleLabelHost(): void {
+    public function testMatchesAuthWithSingleLabelHost(): void
+    {
         // a single-label domain (not localhost, not IP) has baseLength 1
         // so 'myhost' has baseDomain 'myhost', while 'auth.local' has base 'auth.local'
         // they won't match unless the auth subdomain itself is single-label
@@ -219,22 +252,26 @@ final class DomainManagerTest extends TestCase {
         self::assertTrue($manager->matchesAuth('app.auth.local'));
     }
 
-    public function testMatchesAuthWithEmptyStringHost(): void {
+    public function testMatchesAuthWithEmptyStringHost(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->matchesAuth(''));
     }
 
-    public function testValidReturnAcceptsUrlWithPort(): void {
+    public function testValidReturnAcceptsUrlWithPort(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertTrue($manager->validReturn('https://example.com:8080/path'));
     }
 
-    public function testValidReturnAcceptsUrlWithoutPath(): void {
+    public function testValidReturnAcceptsUrlWithoutPath(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertTrue($manager->validReturn('https://example.com'));
     }
 
-    public function testValidReturnRejectsDifferentDomainWithPort(): void {
+    public function testValidReturnRejectsDifferentDomainWithPort(): void
+    {
         $manager = $this->createManager(true, 'auth.example.com');
         self::assertFalse($manager->validReturn('https://evil.com:8080/path'));
     }