[TypeDeclaration] Skip string param inference in ScalarParamTypeByMethodCallTypeRector to avoid unsafe scalar coercion

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Fixture/also_arrow_function.php.inc

@@ -13,7 +13,7 @@ final class AlsoArrowFunction
 
     public function go()
     {
-        $closure = fn ($value) => $this->someTypedService->run($value);
+        $closure = fn ($value) => $this->someTypedService->runInt($value);
     }
 }
 
@@ -34,7 +34,7 @@ final class AlsoArrowFunction
 
     public function go()
     {
-        $closure = fn (string $value) => $this->someTypedService->run($value);
+        $closure = fn (int $value) => $this->someTypedService->runInt($value);
     }
 }
 

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Fixture/also_closure.php.inc

@@ -14,7 +14,7 @@ final class AlsoClosure
     public function go()
     {
         $closure = function ($value) {
-            $this->someTypedService->run($value);
+            $this->someTypedService->runInt($value);
         };
     }
 }
@@ -36,8 +36,8 @@ final class AlsoClosure
 
     public function go()
     {
-        $closure = function (string $value) {
-            $this->someTypedService->run($value);
+        $closure = function (int $value) {
+            $this->someTypedService->runInt($value);
         };
     }
 }

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Fixture/skip_string_caller_param.php.inc

@@ -0,0 +1,19 @@
+<?php
+
+namespace Rector\Tests\TypeDeclaration\Rector\ClassMethod\ScalarParamTypeByMethodCallTypeRector\Fixture;
+
+use Rector\Tests\TypeDeclaration\Rector\ClassMethod\ScalarParamTypeByMethodCallTypeRector\Source\SomeTypedService;
+
+final class SkipStringCallerParam
+{
+    public function __construct(
+        private SomeTypedService $someTypedService
+    ) {
+    }
+
+    public function go($value)
+    {
+        // string param accepts int/float/bool via coercion, so caller type stays open
+        $this->someTypedService->run($value);
+    }
+}

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Fixture/some_class.php.inc

@@ -13,7 +13,7 @@ final class UseDependency
 
     public function go($value)
     {
-        $this->someTypedService->run($value);
+        $this->someTypedService->runInt($value);
     }
 }
 
@@ -32,9 +32,9 @@ final class UseDependency
     ) {
     }
 
-    public function go(string $value)
+    public function go(int $value)
     {
-        $this->someTypedService->run($value);
+        $this->someTypedService->runInt($value);
     }
 }
 

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Fixture/static_call_elsewhere.php.inc

@@ -8,7 +8,7 @@ final class StaticCallElsewhere
 {
     public function go($value, $first)
     {
-        SomeTypedService::fun($first, $value);
+        SomeTypedService::funInt($first, $value);
     }
 }
 
@@ -22,9 +22,9 @@ use Rector\Tests\TypeDeclaration\Rector\ClassMethod\ScalarParamTypeByMethodCallT
 
 final class StaticCallElsewhere
 {
-    public function go(string $value, $first)
+    public function go(int $value, $first)
     {
-        SomeTypedService::fun($first, $value);
+        SomeTypedService::funInt($first, $value);
     }
 }
 

rules-tests/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector/Source/SomeTypedService.php

@@ -10,10 +10,18 @@ public function run(string $name)
     {
     }
 
+    public function runInt(int $count)
+    {
+    }
+
     public static function fun($surname, string $name)
     {
     }
 
+    public static function funInt($surname, int $count)
+    {
+    }
+
     public function withDefaultNullUnion(bool|string $name = null)
     {
     }

rules/TypeDeclaration/Rector/ClassMethod/ScalarParamTypeByMethodCallTypeRector.php

@@ -23,7 +23,7 @@ public function getRuleDefinition(): RuleDefinition
                 <<<'CODE_SAMPLE'
 class SomeTypedService
 {
-    public function run(string $name)
+    public function run(int $value)
     {
     }
 }
@@ -45,7 +45,7 @@ public function go($value)
                 <<<'CODE_SAMPLE'
 class SomeTypedService
 {
-    public function run(string $name)
+    public function run(int $value)
     {
     }
 }
@@ -57,7 +57,7 @@ public function __construct(
     ) {
     }
 
-    public function go(string $value)
+    public function go(int $value)
     {
         $this->someTypedService->run($value);
     }
@@ -69,7 +69,14 @@ public function go(string $value)
 
     protected function isMatchingParamType(Type $type): bool
     {
-        return TypeCombinator::removeNull($type)->isScalar()
+        $type = TypeCombinator::removeNull($type);
+        if (! $type->isScalar()->yes()) {
+            return false;
+        }
+
+        // a string param accepts int/float/bool via scalar coercion, so a caller
+        // may pass another scalar - inferring string from it would be unsafe
+        return ! $type->isString()
             ->yes();
     }
 }