First-class callables with parameter conditions

[spaze]

PHPStan detects first-class callable syntax at the point of func(...), where no arguments are present - they are supplied only when the callable is later invoked, which means parameter conditions configured on the disallowed call cannot be evaluated at the detection point.

This PR corrects the behavior across all param condition directives. Conditions that require a matching param value to allow a call - allowParamsAnywhere, allowParamsInAllowed, and their AnyValue and Flags variants - can never be satisfied without arguments, so first-class callables are always reported when any of these is configured, regardless of zone. Conditions that require a matching param value to disallow a call - allowExceptParamsAnywhere, allowExceptParamsInAllowed, and their variants and aliases - can never be triggered without arguments, so first-class callables are never reported in either allowIn* or allowExceptIn* zones when these are configured.

Previously, allowParamsAnywhere incorrectly allowed first-class callables because the null-args path in hasAllowedParams unconditionally returned true. allowExceptParamsInAllowed incorrectly disallowed first-class callables in allowed zones because the null-args path in hasAllowedParamsInAllowed treated it identically to allowParamsInAllowed. Both are fixed. A new section in docs/allow-with-parameters.md documents the complete behavior for all param condition directives.

Closes #415

[Copilot]

Pull request overview

Fixes how first-class callable syntax (func(...)) interacts with parameter-based allow/disallow conditions by treating “no args at call site” as an unsatisfiable param allow condition and an untriggerable param disallow condition. This aligns the rule behavior with PHPStan’s detection point for first-class callables and closes #415.

Changes:

• Adjusted Allowed param-check logic so args === null no longer incorrectly satisfies param conditions.
• Added targeted first-class-callable fixtures + rule tests for allowParamsAnywhere, allowParamsInAllowed, and allowExceptParamsInAllowed scenarios.
• Documented first-class callable behavior in docs/allow-with-parameters.md and updated lint exclusions for PHP < 8.1.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
src/Allowed/Allowed.php	Fix null-args handling for param conditions and make allowed/disallowed zone behavior explicit via allowedByDefault.
docs/allow-with-parameters.md	Adds documentation section describing first-class callable behavior with param directives.
composer.json	Excludes new PHP 8.1-only fixtures from lint runs on PHP 7.4/8.0.
tests/src/RoyaleExceptFirstClassCallable.php	Fixture covering allowExceptInMethods + param directives with first-class callables.
tests/src/RoyaleAllowInFirstClassCallable.php	Fixture covering allowInMethods + param directives with first-class callables.
tests/src/FirstClassCallableParamsAnywhere.php	Fixture covering allowParamsAnywhere/allowExceptParamsAnywhere with first-class callables.
tests/Calls/FunctionFirstClassCallablesParamsAnywhereTest.php	New test asserting first-class callable behavior under allowParamsAnywhere/allowExceptParamsAnywhere.
tests/Calls/FunctionFirstClassCallablesAllowInMethodsWithParamsTest.php	New test asserting allowInMethods + allowParamsInAllowed / allowExceptParamsInAllowed.
tests/Calls/FunctionFirstClassCallablesAllowExceptInMethodsWithParamsTest.php	New test asserting allowExceptInMethods + allowParamsInAllowed / allowExceptParamsInAllowed.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.