Improve vendor isolation (#37)

* Add TDD  tests for vendor path isolation and whitelisting in FileFilter

* Add test for differentiating application folders from vendor folder names in FileFilter

* Enhance vendor path handling in FileFilter and StreamWrapper to support explicit vendor whitelisting and improve test isolation with reset methods in Config and StreamWrapper.

* Improve code styling

* Add more edge cases test in vendor isolation tests suite

Author: rcalicdan

src/Contract/ContractParser.php

@@ -711,7 +711,7 @@ public static function substituteAliases(TypeNode $node, array $aliases): TypeNo
 
         if ($node instanceof CallableTypeNode) {
             $parameters = array_map(
-                fn(CallableTypeParameterNode $param) => new CallableTypeParameterNode(
+                fn (CallableTypeParameterNode $param) => new CallableTypeParameterNode(
                     self::substituteAliases($param->type, $aliases),
                     $param->isReference,
                     $param->isVariadic,
@@ -745,7 +745,7 @@ public static function substituteAliases(TypeNode $node, array $aliases): TypeNo
         if ($node instanceof GenericTypeNode) {
             $genericType = self::substituteAliases($node->type, $aliases);
             $genericTypes = array_map(
-                fn($t) => self::substituteAliases($t, $aliases),
+                fn ($t) => self::substituteAliases($t, $aliases),
                 $node->genericTypes
             );
 
@@ -762,14 +762,14 @@ public static function substituteAliases(TypeNode $node, array $aliases): TypeNo
 
         if ($node instanceof UnionTypeNode) {
             return new UnionTypeNode(array_map(
-                fn($t) => self::substituteAliases($t, $aliases),
+                fn ($t) => self::substituteAliases($t, $aliases),
                 $node->types
             ));
         }
 
         if ($node instanceof IntersectionTypeNode) {
             return new IntersectionTypeNode(array_map(
-                fn($t) => self::substituteAliases($t, $aliases),
+                fn ($t) => self::substituteAliases($t, $aliases),
                 $node->types
             ));
         }

src/Contract/DocblockExtractor.php

@@ -424,4 +424,4 @@ public static function extractMagicMethodContract(string $doc, string $methodNam
 
         return null;
     }
-}
+}

src/Contract/FileFilter.php

@@ -82,16 +82,31 @@ public static function isFileExcluded(string|false|null $fileName): bool
             self::compilePatterns();
         }
 
-        $longestIncludeMatch = 0;
         $isVendorPath = str_contains($normalizedPath, '/vendor/');
+        if ($isVendorPath) {
+            $hasExplicitVendorWhitelist = false;
+            /** @var array<int, array{pattern: string, len: int, regex: string}> $includes */
+            $includes = self::$compiledIncludes;
+            foreach ($includes as $compiled) {
+                if (str_starts_with($compiled['pattern'], 'vendor/') && preg_match($compiled['regex'], $normalizedPath) === 1) {
+                    $hasExplicitVendorWhitelist = true;
+
+                    break;
+                }
+            }
+
+            if (! $hasExplicitVendorWhitelist) {
+                return self::$pathFilterCache[$normalizedPath] = true; // Instantly exclude!
+            }
+        }
 
+        $longestIncludeMatch = 0;
         /** @var array<int, array{pattern: string, len: int, regex: string}> $includes */
         $includes = self::$compiledIncludes;
         foreach ($includes as $compiled) {
             $isExplicitVendorInclude = str_starts_with($compiled['pattern'], 'vendor/');
             $isWildcard = ($compiled['pattern'] === '*' || $compiled['pattern'] === '**');
 
-            // Application include rules (like src/**, src/Core/**) never match inside vendor directories
             if ($isVendorPath && ! $isExplicitVendorInclude && ! $isWildcard) {
                 continue;
             }
@@ -173,4 +188,4 @@ private static function compileGlobToRegex(string $glob, string $baseDir): strin
 
         return '#' . $pattern . '#i';
     }
-}
+}

src/Internal/Config.php

@@ -23,6 +23,9 @@ final class Config
      */
     private static ?array $cachedConfig = null;
 
+    /**
+     * Cached absolute project root path.
+     */
     private static ?string $projectRoot = null;
 
     private static bool $enabled = true;
@@ -208,6 +211,7 @@ public static function set(array $config): void
 
         ContractParser::reset();
         FileFilter::reset();
+        StreamWrapper::reset();
     }
 
     /**
@@ -228,6 +232,7 @@ public static function reset(): void
         TemplateManager::reset();
         HierarchyResolver::reset();
         FileFilter::reset();
+        StreamWrapper::reset();
     }
 
     /**
@@ -244,4 +249,4 @@ private static function syncFlags(array $config): void
         self::$magicMethods = (bool) ($config['magic_methods'] ?? true);
         self::$respectIgnoreTags = (bool) ($config['respect_ignore_tags'] ?? true);
     }
-}
+}

src/Internal/StreamWrapper.php

@@ -53,6 +53,17 @@ final class StreamWrapper implements StreamWrapperInterface
 
     private static string $cacheDir = '';
 
+    /**
+     * Resets the compiled pattern cache. Useful for test isolation.
+     */
+    public static function reset(): void
+    {
+        self::$isInitialized = false;
+        self::$includeRawPatterns = [];
+        self::$excludeRawPatterns = [];
+        self::$baseDir = '';
+    }
+
     /**
      * @param array<string, mixed> $config
      */
@@ -515,20 +526,32 @@ private static function isApplicationFile(string $path, string|false $resolvedPa
             return false;
         }
 
-        // Unconditionally prevent double-parsing cached files!
         $normalizedCacheDir = rtrim(str_replace('\\', '/', self::$cacheDir), '/') . '/';
         if (str_starts_with($normalizedPath, $normalizedCacheDir)) {
             return false;
         }
 
-        $longestIncludeMatch = 0;
         $isVendorPath = str_contains($normalizedPath, '/vendor/');
+        if ($isVendorPath) {
+            $hasExplicitVendorWhitelist = false;
+            foreach (self::$includeRawPatterns as $pattern => $regex) {
+                if (str_starts_with($pattern, 'vendor/') && preg_match($regex, $normalizedPath) === 1) {
+                    $hasExplicitVendorWhitelist = true;
 
+                    break;
+                }
+            }
+
+            if (! $hasExplicitVendorWhitelist) {
+                return false;
+            }
+        }
+
+        $longestIncludeMatch = 0;
         foreach (self::$includeRawPatterns as $pattern => $regex) {
             $isExplicitVendorInclude = str_starts_with($pattern, 'vendor/');
             $isWildcard = ($pattern === '*' || $pattern === '**');
 
-            // Application include rules (like src/**, src/Core/**) never match inside vendor directories
             if ($isVendorPath && ! $isExplicitVendorInclude && ! $isWildcard) {
                 continue;
             }
@@ -661,4 +684,4 @@ private static function extractAndSeedFileMetadata(array $stmts, string $filePat
 
         SpecialTypeResolver::seedFileMetadata($filePath, $namespace, $imports, $classTraitUseDocs);
     }
-}
+}

src/Resolver/SpecialTypeResolver.php

@@ -1061,4 +1061,4 @@ private static function parseFileMetadata(string $fileName, string $source): voi
             // Silently fall back to empty metadata if parsing fails
         }
     }
-}
+}

src/Validator/TypeValidatorRegistry.php

@@ -89,4 +89,4 @@ public function validate(mixed $value, TypeNode $node, string $context): ?ErrorM
 
         return $err;
     }
-}
+}