Incorrect behavior of AnnotationToAttributeRector, parameters are lost

[come-nc]

Bug Report

Subject	Details
Rector version	last dev-main
Installed as	composer dependency

Minimal PHP Code Causing Issue

See https://getrector.com/demo/efca927e-4095-4113-b668-bb172720d9e7

<?php

declare(strict_types=1);

namespace OCP\AppFramework\Http\Attribute;

use Attribute;

/**
 * Attribute for controller methods that want to protect passwords, keys, tokens
 * or other data against brute force
 *
 * @since 27.0.0
 */
#[Attribute(Attribute::TARGET_METHOD | Attribute::IS_REPEATABLE)]
class BruteForceProtection {
	/**
	 * @since 27.0.0
	 */
	public function __construct(
		protected string $action
	) {
	}

	/**
	 * @since 27.0.0
	 */
	public function getAction(): string {
		return $this->action;
	}
}

namespace App\Test\Cases\Domain\Value;

use PHPUnit\Framework\TestCase;
final class RectorTest extends TestCase
{
	/**
	 * @BruteForceProtection(action=login)
	 */
    public function testMethod() {
    }
}

Responsible rules

• AnnotationToAttributeRector

Expected Behavior

Rector should keep the parameters for the annotation, according to the rule documentation: https://getrector.com/rule-detail/annotation-to-attribute-rector

But currently it loses the parameters. I tried setting useValueAsAttributeArgument to true, but that passes all parameters as one string.

I see that in some situation previous annotations were already classes, but in our case that’s not true, it was standard phpdoc tags that we are replacing with attributes. Is there any way to do that?

[samsonasik]

The tag parameter class name need to be exists, in that case, you need to provide real class name, for example, just use tag as class name, for example:

• https://getrector.com/demo/cf03037c-ec68-4a39-a0f5-faba751993a3

if it different namespace, check if it on use statement, not just same last name, see fixture and config

• https://github.com/rectorphp/rector-src/blob/a2b010d3152c065aeb91bdbcd5437b8645a3f7c7/rules-tests/Php80/Rector/Class_/AnnotationToAttributeRector/Fixture/first_param_is_silent.php.inc
• https://github.com/rectorphp/rector-src/blob/a2b010d3152c065aeb91bdbcd5437b8645a3f7c7/rules-tests/Php80/Rector/Class_/AnnotationToAttributeRector/config/configured_rule.php#L25

[samsonasik]

Oh, I see, you want to change normal annotation (by name) to attribute, in that case, you need to pass useValueAsAttributeArgument: true, see this example

https://getrector.com/demo/652f52d2-4d07-4bb3-9b77-e84fb91eadb2

[samsonasik]

On normal string annotation without quote, it become inside parentheses as no quote, see

https://getrector.com/demo/88a6edf4-9c6b-4e6c-b473-b8b3f3ad082c

[come-nc]

On normal string annotation without quote, it become inside parentheses as no quote, see

https://getrector.com/demo/88a6edf4-9c6b-4e6c-b473-b8b3f3ad082c

This is the problem I have.

We used tags that do not match an existing class. We changed for attribute classes (those do exist).
For some of them, the name of the class is not even the same one as the name of the obsolete tag.

This is the before/after what I’m trying to obtain:

<?php

namespace Nextcloud\Rector\Test\Set\Nextcloud27\Fixture;

class SomeController
{
    /**
     * @AnonRateThrottle(limit=10, period=100)
     * @UserRateThrottle(limit=20, period=200)
     * @AuthorizedAdminSetting(settings=OCA\NotesTutorial\Settings\NotesAdmin;OCA\NotesTutorial\Settings\NotesSubAdmin)
     * @BruteForceProtection(action=login)
     * @CORS
     * @NoAdminRequired
     * @NoCSRFRequired
     * @PasswordConfirmationRequired
     * @PublicPage
     * @StrictCookiesRequired
     * @SubAdminRequired
     */
    public function foo()
    {}
}

?>
-----
<?php

namespace Nextcloud\Rector\Test\Set\Nextcloud27\Fixture;

class SomeController
{
    #[\OCP\AppFramework\Http\Attribute\AnonRateLimit(limit: 10, period: 100)]
    #[\OCP\AppFramework\Http\Attribute\UserRateLimit(limit: 20, period: 200)]
    #[\OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting(settings: 'OCA\NotesTutorial\Settings\NotesAdmin')]
    #[\OCP\AppFramework\Http\Attribute\AuthorizedAdminSetting(settings: 'OCA\NotesTutorial\Settings\NotesSubAdmin')]
    #[\OCP\AppFramework\Http\Attribute\BruteForceProtection(action: 'login')]
    #[\OCP\AppFramework\Http\Attribute\CORS]
    #[\OCP\AppFramework\Http\Attribute\NoAdminRequired]
    #[\OCP\AppFramework\Http\Attribute\NoCSRFRequired]
    #[\OCP\AppFramework\Http\Attribute\PasswordConfirmationRequired]
    #[\OCP\AppFramework\Http\Attribute\PublicPage]
    #[\OCP\AppFramework\Http\Attribute\StrictCookiesRequired]
    #[\OCP\AppFramework\Http\Attribute\SubAdminRequired]
    public function foo()
    {}
}

?>

The AuthorizedAdminSetting one is too specific I suppose, but for the rate limit and bruteforce ones I was expecting to be able to achieve that without writing my own rector.

[samsonasik]

could you create failing fixture for it? add fixture at

https://github.com/rectorphp/rector-src/tree/a2b010d3152c065aeb91bdbcd5437b8645a3f7c7/rules-tests/Php80/Rector/Class_/AnnotationToAttributeRector/Fixture

use/add class source example at

https://github.com/rectorphp/rector-src/tree/a2b010d3152c065aeb91bdbcd5437b8645a3f7c7/rules-tests/Php80/Rector/Class_/AnnotationToAttributeRector/Source

and add config at

https://github.com/rectorphp/rector-src/blob/a2b010d3152c065aeb91bdbcd5437b8645a3f7c7/rules-tests/Php80/Rector/Class_/AnnotationToAttributeRector/config/configured_rule.php

thank you.

[come-nc]

Here it is: https://github.com/rectorphp/rector-src/actions/runs/13768864773/job/38502148692?pr=6777

[github-actions]

This issue has been automatically locked because it has been closed for 150 days. Please open a new issue if you have a similar problem.