Fix QA PHPStan findings in OAuth examples and auth middleware

Author: sveneld

examples/server/oauth-keycloak/McpElements.php

@@ -30,6 +30,8 @@ final class McpElements
      * Confirms the user is authenticated.
      *
      * The fact that this tool executes means the request passed OAuth validation.
+     *
+     * @return array<string, mixed>
      */
     #[McpTool(
         name: 'get_auth_status',
@@ -65,6 +67,8 @@ public function getAuthStatus(RequestContext $context): array
 
     /**
      * Simulates calling a protected external API.
+     *
+     * @return array<string, mixed>
      */
     #[McpTool(
         name: 'call_protected_api',
@@ -91,6 +95,8 @@ public function callProtectedApi(
 
     /**
      * Returns the current server time and status.
+     *
+     * @return array<string, mixed>
      */
     #[McpResource(
         uri: 'server://status',

examples/server/oauth-microsoft/McpElements.php

@@ -28,6 +28,8 @@ final class McpElements
 {
     /**
      * Confirms the user is authenticated with Microsoft.
+     *
+     * @return array<string, mixed>
      */
     #[McpTool(
         name: 'get_auth_status',
@@ -64,6 +66,8 @@ public function getAuthStatus(RequestContext $context): array
 
     /**
      * Simulates calling Microsoft Graph API.
+     *
+     * @return array<string, mixed>
      */
     #[McpTool(
         name: 'call_graph_api',
@@ -89,6 +93,8 @@ public function callGraphApi(
 
     /**
      * Lists simulated emails.
+     *
+     * @return array<string, mixed>
      */
     #[McpTool(
         name: 'list_emails',
@@ -109,6 +115,8 @@ public function listEmails(int $count = 5): array
 
     /**
      * Returns the current server status.
+     *
+     * @return array<string, mixed>
      */
     #[McpResource(
         uri: 'server://status',

src/Server/Transport/Http/Middleware/AuthorizationMiddleware.php

@@ -79,14 +79,12 @@ private function buildErrorResponse(ServerRequestInterface $request, Authorizati
         $response = $this->responseFactory->createResponse($result->getStatusCode());
         $header = $this->buildAuthenticateHeader($request, $result);
 
-        if (null !== $header) {
-            $response = $response->withHeader('WWW-Authenticate', $header);
-        }
+        $response = $response->withHeader('WWW-Authenticate', $header);
 
         return $response;
     }
 
-    private function buildAuthenticateHeader(ServerRequestInterface $request, AuthorizationResult $result): ?string
+    private function buildAuthenticateHeader(ServerRequestInterface $request, AuthorizationResult $result): string
     {
         $parts = [];
 
@@ -105,10 +103,6 @@ private function buildAuthenticateHeader(ServerRequestInterface $request, Author
             $parts[] = 'error_description="'.$this->escapeHeaderValue($result->getErrorDescription()).'"';
         }
 
-        if ([] === $parts) {
-            return 'Bearer';
-        }
-
         return 'Bearer '.implode(', ', $parts);
     }