Harden PackApi

docs/api/inspectors.md

@@ -18,6 +18,18 @@
 ### SecurityInspector
 ### QualityInspector
 
+`QualityInspector` combines package metadata and repository contents into a score from 0 to 100. Each available quality signal contributes 15 points:
+
+- README
+- license
+- tests
+- description
+- repository URL
+- `.gitattributes`
+- `.gitignore`
+
+Ignored example, demo, documentation, test, and specification files reduce the score by 2 points each, up to a maximum 15-point penalty. Scores are capped between 0 and 100 and graded as follows: A from 90, B from 75, C from 60, D from 40, and F below 40.
+
 ## Usage Patterns
 
 ### Single Inspector Usage
@@ -40,4 +52,4 @@
 
 ### Provider Ordering
 ### Parallel Execution
-### Caching Strategy
+### Caching Strategy

docs/bridges/packagist.md

@@ -86,7 +86,7 @@ Determines latest release and commit time from available versions.
 Uses GitHub API as a fallback to fetch YAML advisories for the package path under `FriendsOfPHP/security-advisories`.
 
 ### **Content Provider**
-Downloads the distribution archive of the latest version using `SecureFileHandler` and analyses its files.
+Downloads the distribution archive of the latest version using `SecureFileHandler` and analyses its files. When constructing the provider directly, its optional third argument selects the parent directory for temporary extraction; it defaults to `sys_get_temp_dir()`.
 
 ### **Statistics Provider**
 `ComposerDownloadStatsProvider` wraps `PackagistApiClient` to expose download counts as `DownloadStats` models.

src/Auth/EnvAuthenticationManager.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Auth;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class EnvAuthenticationManager implements AuthenticationManagerInterface
 {
     public function __construct(private readonly string $githubTokenEnvVariable = 'GITHUB_TOKEN')

src/Bridge/BundlePhobia/BundlePhobiaApiClient.php

@@ -17,6 +17,9 @@
 use Symfony\Contracts\HttpClient\Exception\TransportExceptionInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class BundlePhobiaApiClient
 {
     public function __construct(

src/Bridge/BundlePhobia/BundlePhobiaProviderFactory.php

@@ -17,6 +17,9 @@
 use PackApi\Provider\BundleSizeProviderInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class BundlePhobiaProviderFactory
 {
     private readonly HttpClientInterface $scopedClient;

src/Bridge/BundlePhobia/BundlePhobiaSizeProvider.php

@@ -18,6 +18,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\BundleSizeProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class BundlePhobiaSizeProvider implements BundleSizeProviderInterface
 {
     public function __construct(private readonly BundlePhobiaApiClient $client)
@@ -73,7 +76,7 @@ public function getPackageHistory(Package $package): ?array
 
         try {
             return $this->client->getPackageHistory($package->getName());
-        } catch (\Exception $e) {
+        } catch (\Exception) {
             return null;
         }
     }

src/Bridge/GitHub/GitHubActivityProvider.php

@@ -17,6 +17,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\ActivityProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubActivityProvider implements ActivityProviderInterface
 {
     public function __construct(private GitHubApiClient $client)

src/Bridge/GitHub/GitHubApiClient.php

@@ -21,6 +21,9 @@
 use Symfony\Contracts\HttpClient\Exception\TransportExceptionInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubApiClient
 {
     public function __construct(

src/Bridge/GitHub/GitHubContentProvider.php

@@ -18,6 +18,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\ContentProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubContentProvider implements ContentProviderInterface
 {
     public function __construct(private GitHubApiClient $client)

src/Bridge/GitHub/GitHubMetadataProvider.php

@@ -18,6 +18,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\MetadataProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubMetadataProvider implements MetadataProviderInterface
 {
     public function __construct(

src/Bridge/GitHub/GitHubProviderFactory.php

@@ -15,6 +15,9 @@
 
 use PackApi\Http\HttpClientFactoryInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubProviderFactory
 {
     private readonly GitHubApiClient $apiClient;

src/Bridge/GitHub/GitHubSearchProvider.php

@@ -15,6 +15,9 @@
 
 use PackApi\Provider\PackageSearchInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubSearchProvider implements PackageSearchInterface
 {
     public function __construct(private readonly GitHubApiClient $client)

src/Bridge/GitHub/GitHubSecurityProvider.php

@@ -17,6 +17,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\SecurityProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubSecurityProvider implements SecurityProviderInterface
 {
     public function __construct(private GitHubApiClient $client)

src/Bridge/GitHub/GitHubStatisticProvider.php

@@ -19,6 +19,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\DownloadStatsProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class GitHubStatisticProvider implements DownloadStatsProviderInterface
 {
     public function __construct(
@@ -72,9 +75,6 @@ public function getStatsForPeriod(Package $package, DownloadPeriod $period): ?Do
                 return null;
             }
 
-            // Map GitHub stats to download-like metrics
-            $stats = $activityData['activity_stats'];
-
             $count = (int) ($repoData['stargazers_count'] ?? 0);
             $computedPeriod = new DownloadPeriod(
                 $period->getType(),

src/Bridge/Npm/NpmApiClient.php

@@ -17,6 +17,9 @@
 use Symfony\Contracts\HttpClient\Exception\TransportExceptionInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class NpmApiClient
 {
     public function __construct(

src/Bridge/Npm/NpmProviderFactory.php

@@ -22,6 +22,9 @@
 use PackApi\System\Npm\NpmMetadataProvider;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class NpmProviderFactory
 {
     private readonly HttpClientInterface $registryClient;

src/Bridge/OSV/OSVApiClient.php

@@ -17,6 +17,9 @@
 use Symfony\Contracts\HttpClient\Exception\TransportExceptionInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class OSVApiClient
 {
     public function __construct(

src/Bridge/OSV/OSVProviderFactory.php

@@ -17,6 +17,9 @@
 use PackApi\Provider\SecurityProviderInterface;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class OSVProviderFactory
 {
     private readonly HttpClientInterface $scopedClient;

src/Bridge/OSV/OSVSecurityProvider.php

@@ -19,6 +19,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\SecurityProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class OSVSecurityProvider implements SecurityProviderInterface
 {
     public function __construct(private readonly OSVApiClient $client)
@@ -156,11 +159,6 @@ private function extractSeverity(array $vulnerability): string
             return strtoupper($vulnerability['database_specific']['severity']);
         }
 
-        if (isset($vulnerability['database_specific']['github_reviewed'])
-            && isset($vulnerability['database_specific']['severity'])) {
-            return strtoupper($vulnerability['database_specific']['severity']);
-        }
-
         return 'MEDIUM';
     }
 

src/Bridge/Packagist/PackagistActivityProvider.php

@@ -17,6 +17,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\ActivityProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistActivityProvider implements ActivityProviderInterface
 {
     public function __construct(private PackagistApiClient $client)

src/Bridge/Packagist/PackagistApiClient.php

@@ -15,6 +15,9 @@
 
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistApiClient
 {
     public function __construct(

src/Bridge/Packagist/PackagistContentProvider.php

@@ -20,12 +20,19 @@
 use PackApi\Provider\ContentProviderInterface;
 use PackApi\Security\SecureFileHandlerInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistContentProvider implements ContentProviderInterface
 {
+    private readonly string $tempDir;
+
     public function __construct(
         private readonly PackagistApiClient $client,
         private readonly SecureFileHandlerInterface $fileHandler,
+        ?string $tempDir = null,
     ) {
+        $this->tempDir = $tempDir ?? sys_get_temp_dir();
     }
 
     public function supports(Package $package): bool
@@ -51,8 +58,8 @@ public function getContentOverview(Package $package): ?ContentOverview
 
             $tarPath = $this->fileHandler->downloadSafely($distUrl);
 
-            $tmp = sys_get_temp_dir().'/packapi_'.uniqid('', true);
-            if (!mkdir($tmp, 0755, true) && !is_dir($tmp)) {
+            $tmp = $this->tempDir.'/packapi_'.uniqid('', true);
+            if (!@mkdir($tmp, 0755, true) && !is_dir($tmp)) {
                 throw new ValidationException('Cannot create extraction directory');
             }
 
@@ -116,10 +123,6 @@ public function getContentOverview(Package $package): ?ContentOverview
 
     private function cleanupDirectory(string $path): void
     {
-        if (!is_dir($path)) {
-            return;
-        }
-
         $files = new \RecursiveIteratorIterator(
             new \RecursiveDirectoryIterator($path, \RecursiveDirectoryIterator::SKIP_DOTS),
             \RecursiveIteratorIterator::CHILD_FIRST

src/Bridge/Packagist/PackagistMetadataProvider.php

@@ -17,6 +17,9 @@
 use PackApi\Package\Package;
 use PackApi\Provider\MetadataProviderInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistMetadataProvider implements MetadataProviderInterface
 {
     public function __construct(private PackagistApiClient $client)

src/Bridge/Packagist/PackagistProviderFactory.php

@@ -17,6 +17,9 @@
 use PackApi\Security\SecureFileHandler;
 use Symfony\Contracts\HttpClient\HttpClientInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistProviderFactory
 {
     private readonly HttpClientInterface $scopedClient;

src/Bridge/Packagist/PackagistSearchProvider.php

@@ -15,6 +15,9 @@
 
 use PackApi\Provider\PackageSearchInterface;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistSearchProvider implements PackageSearchInterface
 {
     public function __construct(private readonly PackagistApiClient $client)

src/Bridge/Packagist/PackagistSecurityProvider.php

@@ -19,6 +19,9 @@
 use PackApi\Provider\SecurityProviderInterface;
 use Symfony\Component\Yaml\Yaml;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistSecurityProvider implements SecurityProviderInterface
 {
     public function __construct(

src/Bridge/Packagist/PackagistStatisticsProvider.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Bridge\Packagist;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class PackagistStatisticsProvider
 {
 }

src/Exception/ApiException.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Exception;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class ApiException extends \RuntimeException
 {
     /**

src/Exception/NetworkException.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Exception;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class NetworkException extends \RuntimeException
 {
 }

src/Exception/PackageNotFoundException.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Exception;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class PackageNotFoundException extends \Exception implements PackageExceptionInterface
 {
 }

src/Exception/RateLimitException.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Exception;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 class RateLimitException extends \Exception implements ProviderExceptionInterface
 {
 }

src/Exception/UnsupportedPackageException.php

@@ -13,6 +13,9 @@
 
 namespace PackApi\Exception;
 
+/**
+ * @author Simon André <smn.andre@gmail.com>
+ */
 final class UnsupportedPackageException extends \LogicException
 {
     public function __construct(string $packageClass)