From 110b9c5ad32b6e7870023fe26b15caaa10e7775d Mon Sep 17 00:00:00 2001
From: Brian <brian@brianhaas.li>
Date: Fri, 31 Jul 2026 23:55:14 +0200
Subject: [PATCH 1/3] validate against version 3

---
 phpstan.dist.neon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpstan.dist.neon b/phpstan.dist.neon
index 23ef496e..b435b320 100644
--- a/phpstan.dist.neon
+++ b/phpstan.dist.neon
@@ -1,7 +1,7 @@
 includes:
 	- vendor/szepeviktor/phpstan-wordpress/extension.neon
 parameters:
-	level: 2
+	level: 3
 	paths:
 		- includes
 		- providers

From 1846d8261cd3b054f898038f27be966fcf86c30a Mon Sep 17 00:00:00 2001
From: Brian <brian@brianhaas.li>
Date: Sat, 1 Aug 2026 09:14:11 +0200
Subject: [PATCH 2/3] Update phpstan.dist.neon

---
 phpstan.dist.neon | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/phpstan.dist.neon b/phpstan.dist.neon
index b435b320..82024922 100644
--- a/phpstan.dist.neon
+++ b/phpstan.dist.neon
@@ -1,7 +1,7 @@
 includes:
 	- vendor/szepeviktor/phpstan-wordpress/extension.neon
 parameters:
-	level: 3
+	level: 4
 	paths:
 		- includes
 		- providers

From 8205dc37fcecc28bd66525fc0ff9755a17fb99e1 Mon Sep 17 00:00:00 2001
From: Brian <brian@brianhaas.li>
Date: Sat, 1 Aug 2026 07:45:23 +0000
Subject: [PATCH 3/3] upgrade phpstan to level 5

---
 class-two-factor-compat.php                 |  8 +++++++-
 class-two-factor-core.php                   |  6 +++---
 phpstan.dist.neon                           |  2 +-
 providers/class-two-factor-backup-codes.php |  4 ++--
 providers/class-two-factor-email.php        |  2 +-
 providers/class-two-factor-totp.php         | 10 +++++-----
 settings/class-two-factor-settings.php      |  9 ++++++++-
 two-factor.php                              |  2 +-
 8 files changed, 28 insertions(+), 15 deletions(-)

diff --git a/class-two-factor-compat.php b/class-two-factor-compat.php
index 94e47f4d..355b9a58 100644
--- a/class-two-factor-compat.php
+++ b/class-two-factor-compat.php
@@ -58,6 +58,12 @@ public function jetpack_rememberme( $rememberme ) {
 	 * @return boolean
 	 */
 	public function jetpack_is_sso_active() {
-		return ( class_exists( 'Jetpack' ) && method_exists( 'Jetpack', 'is_module_active' ) && Jetpack::is_module_active( 'sso' ) );
+		if ( ! class_exists( 'Jetpack' ) ) {
+			return false;
+		}
+
+		$jetpack_is_module_active = array( 'Jetpack', 'is_module_active' );
+
+		return is_callable( $jetpack_is_module_active ) && (bool) call_user_func( $jetpack_is_module_active, 'sso' );
 	}
 }
diff --git a/class-two-factor-core.php b/class-two-factor-core.php
index de7e20ca..c9270db5 100644
--- a/class-two-factor-core.php
+++ b/class-two-factor-core.php
@@ -244,7 +244,7 @@ public static function uninstall() {
 		}
 
 		foreach ( $user_meta_keys as $meta_key ) {
-			delete_metadata( 'user', null, $meta_key, null, true );
+			delete_metadata( 'user', 0, $meta_key, '', true );
 		}
 	}
 
@@ -1152,14 +1152,14 @@ public static function login_html( $user, $login_nonce, $redirect_to, $error_msg
 
 		<form name="validate_2fa_form" id="loginform" action="<?php echo esc_url( self::login_url( array( 'action' => $action ), 'login_post' ) ); ?>" method="post" autocomplete="off">
 				<input type="hidden" name="provider"      id="provider"      value="<?php echo esc_attr( $provider_key ); ?>" />
-				<input type="hidden" name="wp-auth-id"    id="wp-auth-id"    value="<?php echo esc_attr( $user->ID ); ?>" />
+				<input type="hidden" name="wp-auth-id"    id="wp-auth-id"    value="<?php echo esc_attr( (string) $user->ID ); ?>" />
 				<input type="hidden" name="wp-auth-nonce" id="wp-auth-nonce" value="<?php echo esc_attr( $login_nonce ); ?>" />
 				<?php if ( $interim_login ) { ?>
 					<input type="hidden" name="interim-login" value="1" />
 				<?php } else { ?>
 					<input type="hidden" name="redirect_to" value="<?php echo esc_attr( $redirect_to ); ?>" />
 				<?php } ?>
-				<input type="hidden" name="rememberme"    id="rememberme"    value="<?php echo esc_attr( $rememberme ); ?>" />
+				<input type="hidden" name="rememberme"    id="rememberme"    value="<?php echo esc_attr( (string) $rememberme ); ?>" />
 
 				<?php $provider->authentication_page( $user ); ?>
 		</form>
diff --git a/phpstan.dist.neon b/phpstan.dist.neon
index 82024922..b5df8a22 100644
--- a/phpstan.dist.neon
+++ b/phpstan.dist.neon
@@ -1,7 +1,7 @@
 includes:
 	- vendor/szepeviktor/phpstan-wordpress/extension.neon
 parameters:
-	level: 4
+	level: 5
 	paths:
 		- includes
 		- providers
diff --git a/providers/class-two-factor-backup-codes.php b/providers/class-two-factor-backup-codes.php
index d74592b3..79f33354 100644
--- a/providers/class-two-factor-backup-codes.php
+++ b/providers/class-two-factor-backup-codes.php
@@ -441,7 +441,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Recovery Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" data-digits="<?php echo esc_attr( $code_length ); ?>" />
+			<input type="text" inputmode="numeric" name="two-factor-backup-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="<?php echo esc_attr( $code_placeholder ); ?>" data-digits="<?php echo esc_attr( (string) $code_length ); ?>" />
 		</p>
 		<?php
 		/**
@@ -484,7 +484,7 @@ public function validate_authentication( $user ) {
 	 * @since 0.1-dev
 	 *
 	 * @param WP_User $user WP_User object of the logged-in user.
-	 * @param int     $code The backup code.
+	 * @param string  $code The backup code.
 	 * @return boolean
 	 */
 	public function validate_code( $user, $code ) {
diff --git a/providers/class-two-factor-email.php b/providers/class-two-factor-email.php
index 1af12016..5fc48081 100644
--- a/providers/class-two-factor-email.php
+++ b/providers/class-two-factor-email.php
@@ -364,7 +364,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Verification Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="two-factor-email-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" autocomplete="one-time-code" placeholder="<?php echo esc_attr( $token_placeholder ); ?>" data-digits="<?php echo esc_attr( $token_length ); ?>" />
+			<input type="text" inputmode="numeric" name="two-factor-email-code" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" autocomplete="one-time-code" placeholder="<?php echo esc_attr( $token_placeholder ); ?>" data-digits="<?php echo esc_attr( (string) $token_length ); ?>" />
 		</p>
 		<?php
 		/** This action is documented in providers/class-two-factor-backup-codes.php */
diff --git a/providers/class-two-factor-totp.php b/providers/class-two-factor-totp.php
index 2d78fef8..d467be85 100644
--- a/providers/class-two-factor-totp.php
+++ b/providers/class-two-factor-totp.php
@@ -532,7 +532,7 @@ public function validate_authentication( $user ) {
 	 * @since 0.8.0
 	 *
 	 * @param WP_User $user WP_User object of the logged-in user.
-	 * @param int     $code The TOTP token to validate.
+	 * @param string  $code The TOTP token to validate.
 	 *
 	 * @return bool Whether the code is valid for the user and a newer code has not been used.
 	 */
@@ -643,7 +643,7 @@ public static function get_authcode_valid_ticktime( $key, $authcode, $hash = sel
 	 */
 	public static function generate_key( $bitsize = self::DEFAULT_KEY_BIT_SIZE ) {
 		$bytes  = ceil( $bitsize / 8 );
-		$secret = wp_generate_password( $bytes, true, true );
+		$secret = wp_generate_password( (int) $bytes, true, true );
 
 		return self::base32_encode( $secret );
 	}
@@ -745,7 +745,7 @@ public static function calc_totp( $key, $step_count = false, $digits = self::DEF
 				( ord( $hash[ $offset + 3 ] ) & 0xff )
 			) % pow( 10, $digits );
 
-		return str_pad( $code, $digits, '0', STR_PAD_LEFT );
+		return str_pad( (string) $code, $digits, '0', STR_PAD_LEFT );
 	}
 
 	/**
@@ -789,7 +789,7 @@ public function authentication_page( $user ) {
 		?>
 		<p>
 			<label for="authcode"><?php esc_html_e( 'Authentication Code:', 'two-factor' ); ?></label>
-			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( self::DEFAULT_DIGIT_COUNT ); ?>" />
+			<input type="text" inputmode="numeric" name="authcode" id="authcode" class="input authcode" value="" size="20" pattern="[0-9 ]*" placeholder="123 456" autocomplete="one-time-code" data-digits="<?php echo esc_attr( (string) self::DEFAULT_DIGIT_COUNT ); ?>" />
 		</p>
 		<?php
 		/** This action is documented in providers/class-two-factor-backup-codes.php */
@@ -818,7 +818,7 @@ public static function base32_encode( $input ) {
 		$binary_string = '';
 
 		foreach ( str_split( $input ) as $character ) {
-			$binary_string .= str_pad( base_convert( ord( $character ), 10, 2 ), 8, '0', STR_PAD_LEFT );
+			$binary_string .= str_pad( base_convert( (string) ord( $character ), 10, 2 ), 8, '0', STR_PAD_LEFT );
 		}
 
 		$five_bit_sections = str_split( $binary_string, 5 );
diff --git a/settings/class-two-factor-settings.php b/settings/class-two-factor-settings.php
index fb824cae..6d66cfc8 100644
--- a/settings/class-two-factor-settings.php
+++ b/settings/class-two-factor-settings.php
@@ -37,7 +37,14 @@ public static function render_settings_page() {
 			// Sanitize posted values immediately.
 			$posted = array_map( 'sanitize_text_field', (array) $posted );
 			// Remove empty values.
-			$enabled = array_values( array_filter( $posted, 'strlen' ) );
+			$enabled = array_values(
+				array_filter(
+					$posted,
+					static function ( $value ) {
+						return '' !== $value;
+					}
+				)
+			);
 
 			update_option( Two_Factor_Core::ENABLED_PROVIDERS_OPTION_KEY, array_values( array_unique( $enabled ) ) );
 
diff --git a/two-factor.php b/two-factor.php
index fe22a4ff..05ce7d02 100644
--- a/two-factor.php
+++ b/two-factor.php
@@ -106,7 +106,7 @@ function two_factor_render_settings_page() {
 	}
 
 	// Prefer new settings class (keeps main file small).
-	if ( class_exists( 'Two_Factor_Settings' ) && is_callable( array( 'Two_Factor_Settings', 'render_settings_page' ) ) ) {
+	if ( class_exists( 'Two_Factor_Settings' ) ) {
 		Two_Factor_Settings::render_settings_page();
 		return;
 	}