Keep the source visibility of properties the phar build makes public

The inlining step marks each property it opens up with
#[PHPStan\Reflection\Attribute\PrivateProperty] (or ProtectedProperty),
on the same line so line numbers stay put, and PhpClassReflectionExtension
reports such a property with its source visibility: code analysed against
the phar still cannot access it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SRLigetKoiZzYBe4iRQb3J

Author: ondrejmirtes

build/readonly-property.neon

@@ -1,3 +1,8 @@
 parameters:
 	excludePaths:
 		- ../tests/PHPStan/Rules/Properties/MissingReadOnlyPropertyAssignRuleTest.php
+
+	ignoreErrors:
+		-
+			message: '#^Class PrivatePropertyAttribute\\Foo not found\.$#'
+			path: ../tests/PHPStan/Reflection/ClassReflectionTest.php

compiler/src/InlineEditsApplier.php

@@ -10,7 +10,7 @@
 use function file_put_contents;
 use function json_decode;
 use function preg_quote;
-use function preg_replace;
+use function preg_replace_callback;
 use function sprintf;
 use function substr;
 use function usort;
@@ -81,10 +81,17 @@ public function apply(string $editsJsonFile): array
 			}
 			foreach (array_keys($names) as $name) {
 				// a declaration, a promoted constructor parameter or a trait property:
-				// visibility, optional modifiers and type, then the variable
-				$source = preg_replace(
+				// visibility, optional modifiers and type, then the variable — made
+				// public, with the source visibility recorded in an attribute PHPStan's
+				// own reflection honours (same line, so line numbers stay)
+				$source = preg_replace_callback(
 					'/\b(private|protected)(\s+(?:readonly\s+|static\s+)*(?:[?\w\\\\|&()]+\s+)?)\$' . preg_quote($name, '/') . '\b/',
-					'public$2$' . $name,
+					static fn (array $matches): string => sprintf(
+						'#[\PHPStan\Reflection\Attribute\%s] public%s$%s',
+						$matches[1] === 'private' ? 'PrivateProperty' : 'ProtectedProperty',
+						$matches[2],
+						$name,
+					),
 					$source,
 					-1,
 					$count,

compiler/tests/InlineEditsApplierTest.php

@@ -59,7 +59,7 @@ public function testApply(): void
 
 		self::assertSame(['edits' => 2, 'files' => 1, 'properties' => 2], $stats);
 		self::assertSame("<?php\n\$a = \$foo->bar;\n\$b = \$foo->bar;\n", file_get_contents($caller));
-		self::assertSame("<?php\nclass Foo {\n\tpublic int \$bar = 1;\n\tpublic function __construct(public readonly ?string \$baz = null)\n\t{\n\t}\n}\n", file_get_contents($callee));
+		self::assertSame("<?php\nclass Foo {\n\t#[\\PHPStan\\Reflection\\Attribute\\PrivateProperty] public int \$bar = 1;\n\tpublic function __construct(#[\\PHPStan\\Reflection\\Attribute\\PrivateProperty] public readonly ?string \$baz = null)\n\t{\n\t}\n}\n", file_get_contents($callee));
 
 		unlink($caller);
 		unlink($callee);

src/Reflection/Attribute/PrivateProperty.php

@@ -0,0 +1,19 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Reflection\Attribute;
+
+use Attribute;
+
+/**
+ * Marks a property the phar build made public that is private in the
+ * source. The build inlines single-return getters at their call sites
+ * (compiler's PrepareCommand), so the properties those getters read have to
+ * be readable from the callers; for PHPStan's own reflection the property
+ * stays private (PhpClassReflectionExtension), so code analysed against
+ * the phar cannot access it.
+ */
+#[Attribute(flags: Attribute::TARGET_PROPERTY | Attribute::TARGET_PARAMETER)]
+final class PrivateProperty
+{
+
+}

src/Reflection/Attribute/ProtectedProperty.php

@@ -0,0 +1,19 @@
+<?php declare(strict_types = 1);
+
+namespace PHPStan\Reflection\Attribute;
+
+use Attribute;
+
+/**
+ * Marks a property the phar build made public that is protected in the
+ * source. The build inlines single-return getters at their call sites
+ * (compiler's PrepareCommand), so the properties those getters read have to
+ * be readable from the callers; for PHPStan's own reflection the property
+ * stays protected (PhpClassReflectionExtension), so code analysed against
+ * the phar cannot access it from outside the class hierarchy.
+ */
+#[Attribute(flags: Attribute::TARGET_PROPERTY | Attribute::TARGET_PARAMETER)]
+final class ProtectedProperty
+{
+
+}

src/Reflection/Php/PhpClassReflectionExtension.php

@@ -25,6 +25,8 @@
 use PHPStan\Reflection\Annotations\AnnotationsMethodsClassReflectionExtension;
 use PHPStan\Reflection\Annotations\AnnotationsPropertiesClassReflectionExtension;
 use PHPStan\Reflection\Assertions;
+use PHPStan\Reflection\Attribute\PrivateProperty;
+use PHPStan\Reflection\Attribute\ProtectedProperty;
 use PHPStan\Reflection\AttributeReflectionFactory;
 use PHPStan\Reflection\ClassMemberAccessAnswerer;
 use PHPStan\Reflection\ClassReflection;
@@ -435,6 +437,16 @@ private function createProperty(
 			}
 		}
 
+		// a property the phar build made public for its inlined getters keeps its source visibility here
+		$isPrivate = $propertyReflection->isPrivate();
+		$isPublic = $propertyReflection->isPublic();
+		if ($isPublic && count($propertyReflection->getAttributes(PrivateProperty::class)) > 0) {
+			$isPrivate = true;
+			$isPublic = false;
+		} elseif ($isPublic && count($propertyReflection->getAttributes(ProtectedProperty::class)) > 0) {
+			$isPublic = false;
+		}
+
 		$nativeProperty = new PhpPropertyReflection(
 			$declaringClassReflection,
 			$declaringTrait,
@@ -454,8 +466,8 @@ private function createProperty(
 			$isFinal,
 			true,
 			true,
-			$propertyReflection->isPrivate(),
-			$propertyReflection->isPublic(),
+			$isPrivate,
+			$isPublic,
 		);
 
 		if (

tests/PHPStan/Reflection/ClassReflectionTest.php

@@ -112,6 +112,34 @@ public function testClassHierarchyDistances(
 		);
 	}
 
+	public function testPrivatePropertyAttribute(): void
+	{
+		// the phar build makes the properties its inlined getters read public
+		// and records the source visibility in an attribute
+		$reflectionProvider = self::createReflectionProvider();
+		$classReflection = $reflectionProvider->getClass(\PrivatePropertyAttribute\Foo::class);
+
+		$madePublic = $classReflection->getNativeProperty('madePublic');
+		$this->assertTrue($madePublic->isPrivate());
+		$this->assertFalse($madePublic->isPublic());
+
+		$madePublicFromProtected = $classReflection->getNativeProperty('madePublicFromProtected');
+		$this->assertFalse($madePublicFromProtected->isPrivate());
+		$this->assertFalse($madePublicFromProtected->isPublic());
+
+		$promoted = $classReflection->getNativeProperty('promoted');
+		$this->assertTrue($promoted->isPrivate());
+		$this->assertFalse($promoted->isPublic());
+
+		$reallyPublic = $classReflection->getNativeProperty('reallyPublic');
+		$this->assertFalse($reallyPublic->isPrivate());
+		$this->assertTrue($reallyPublic->isPublic());
+
+		$reallyPrivate = $classReflection->getNativeProperty('reallyPrivate');
+		$this->assertTrue($reallyPrivate->isPrivate());
+		$this->assertFalse($reallyPrivate->isPublic());
+	}
+
 	public function testVariadicTraitMethod(): void
 	{
 		$reflectionProvider = self::createReflectionProvider();

tests/PHPStan/Reflection/data/private-property-attribute.php

@@ -0,0 +1,30 @@
+<?php // lint >= 8.1
+
+declare(strict_types = 1);
+
+namespace PrivatePropertyAttribute;
+
+use PHPStan\Reflection\Attribute\PrivateProperty;
+use PHPStan\Reflection\Attribute\ProtectedProperty;
+
+class Foo
+{
+
+	#[PrivateProperty]
+	public int $madePublic = 1;
+
+	#[ProtectedProperty]
+	public int $madePublicFromProtected = 2;
+
+	public int $reallyPublic = 3;
+
+	private int $reallyPrivate = 4;
+
+	public function __construct(
+		#[PrivateProperty]
+		public readonly string $promoted = 'x',
+	)
+	{
+	}
+
+}