From 388acd92a68f40ac37f746fc1c298b78e1724b47 Mon Sep 17 00:00:00 2001
From: Ben Ramsey <ben@ramsey.dev>
Date: Wed, 18 Dec 2024 14:36:42 -0600
Subject: [PATCH] Add types to all the things!

---
 src/Grant/AbstractGrant.php                   |  12 +-
 src/Grant/AuthorizationCode.php               |   7 +-
 src/Grant/ClientCredentials.php               |   7 +-
 src/Grant/GrantFactory.php                    |  32 +--
 src/Grant/Password.php                        |   7 +-
 src/Grant/RefreshToken.php                    |   7 +-
 .../OptionProviderInterface.php               |   2 +-
 src/OptionProvider/PostAuthOptionProvider.php |   4 +-
 src/Provider/AbstractProvider.php             | 200 ++++++------------
 .../Exception/IdentityProviderException.php   |   4 +-
 src/Provider/GenericProvider.php              |  49 ++---
 src/Provider/GenericResourceOwner.php         |   6 +-
 src/Provider/ResourceOwnerInterface.php       |   6 +-
 src/Token/AccessToken.php                     |  62 ++----
 src/Token/AccessTokenInterface.php            |  24 +--
 .../ResourceOwnerAccessTokenInterface.php     |   4 +-
 src/Token/SettableRefreshTokenInterface.php   |   4 +-
 src/Tool/ArrayAccessorTrait.php               |   4 +-
 src/Tool/BearerAuthorizationTrait.php         |   4 +-
 src/Tool/GuardedPropertyTrait.php             |   6 +-
 src/Tool/MacAuthorizationTrait.php            |  17 +-
 src/Tool/ProviderRedirectTrait.php            |  24 +--
 src/Tool/QueryBuilderTrait.php                |   4 +-
 src/Tool/RequiredParameterTrait.php           |   8 +-
 test/src/Grant/GrantFactoryTest.php           |  16 +-
 test/src/Grant/GrantTestCase.php              |   3 +-
 test/src/Provider/AbstractProviderTest.php    |  19 +-
 test/src/Provider/Fake.php                    |  39 +---
 .../Fake/ProviderWithAccessTokenHints.php     |  15 +-
 .../Fake/ProviderWithGuardedProperties.php    |   2 +-
 test/src/Provider/Fake/User.php               |   5 +-
 test/src/Provider/Generic.php                 |   2 +-
 test/src/Token/AccessTokenTest.php            |   2 -
 33 files changed, 183 insertions(+), 424 deletions(-)

diff --git a/src/Grant/AbstractGrant.php b/src/Grant/AbstractGrant.php
index 518d8171..f69fe386 100644
--- a/src/Grant/AbstractGrant.php
+++ b/src/Grant/AbstractGrant.php
@@ -40,25 +40,21 @@ abstract class AbstractGrant
     /**
      * Returns the name of this grant, eg. 'grant_name', which is used as the
      * grant type when encoding URL query parameters.
-     *
-     * @return string
      */
-    abstract protected function getName();
+    abstract protected function getName(): string;
 
     /**
      * Returns a list of all required request parameters.
      *
      * @return list<string>
      */
-    abstract protected function getRequiredRequestParameters();
+    abstract protected function getRequiredRequestParameters(): array;
 
     /**
      * Returns this grant's name as its string representation. This allows for
      * string interpolation when building URL query parameters.
-     *
-     * @return string
      */
-    public function __toString()
+    public function __toString(): string
     {
         return $this->getName();
     }
@@ -72,7 +68,7 @@ public function __toString()
      *
      * @return array<string, mixed>
      */
-    public function prepareRequestParameters(array $defaults, array $options)
+    public function prepareRequestParameters(array $defaults, array $options): array
     {
         $defaults['grant_type'] = $this->getName();
 
diff --git a/src/Grant/AuthorizationCode.php b/src/Grant/AuthorizationCode.php
index 846b1b5c..206f76b1 100644
--- a/src/Grant/AuthorizationCode.php
+++ b/src/Grant/AuthorizationCode.php
@@ -24,10 +24,7 @@
  */
 class AuthorizationCode extends AbstractGrant
 {
-    /**
-     * @inheritdoc
-     */
-    protected function getName()
+    protected function getName(): string
     {
         return 'authorization_code';
     }
@@ -35,7 +32,7 @@ protected function getName()
     /**
      * @inheritdoc
      */
-    protected function getRequiredRequestParameters()
+    protected function getRequiredRequestParameters(): array
     {
         return [
             'code',
diff --git a/src/Grant/ClientCredentials.php b/src/Grant/ClientCredentials.php
index c304a89a..f7a833a5 100644
--- a/src/Grant/ClientCredentials.php
+++ b/src/Grant/ClientCredentials.php
@@ -24,10 +24,7 @@
  */
 class ClientCredentials extends AbstractGrant
 {
-    /**
-     * @inheritdoc
-     */
-    protected function getName()
+    protected function getName(): string
     {
         return 'client_credentials';
     }
@@ -35,7 +32,7 @@ protected function getName()
     /**
      * @inheritdoc
      */
-    protected function getRequiredRequestParameters()
+    protected function getRequiredRequestParameters(): array
     {
         return [];
     }
diff --git a/src/Grant/GrantFactory.php b/src/Grant/GrantFactory.php
index 107f3c5d..1da9fa2d 100644
--- a/src/Grant/GrantFactory.php
+++ b/src/Grant/GrantFactory.php
@@ -41,10 +41,8 @@ class GrantFactory
 
     /**
      * Defines a grant singleton in the registry.
-     *
-     * @return self
      */
-    public function setGrant(string $name, AbstractGrant $grant)
+    public function setGrant(string $name, AbstractGrant $grant): static
     {
         $this->registry[$name] = $grant;
 
@@ -55,10 +53,8 @@ public function setGrant(string $name, AbstractGrant $grant)
      * Returns a grant singleton by name.
      *
      * If the grant has not be registered, a default grant will be loaded.
-     *
-     * @return AbstractGrant
      */
-    public function getGrant(string $name)
+    public function getGrant(string $name): AbstractGrant
     {
         if (!isset($this->registry[$name])) {
             $this->registerDefaultGrant($name);
@@ -70,10 +66,8 @@ public function getGrant(string $name)
 
     /**
      * Registers a default grant singleton by name.
-     *
-     * @return self
      */
-    protected function registerDefaultGrant(string $name)
+    protected function registerDefaultGrant(string $name): static
     {
         // PascalCase the grant. E.g: 'authorization_code' becomes 'AuthorizationCode'
         $class = str_replace(' ', '', ucwords(str_replace(['-', '_'], ' ', $name)));
@@ -87,11 +81,9 @@ protected function registerDefaultGrant(string $name)
     /**
      * Determines if a variable is a valid grant.
      *
-     * @return bool
-     *
      * @phpstan-assert-if-true class-string<AbstractGrant> | AbstractGrant $class
      */
-    public function isGrant(mixed $class)
+    public function isGrant(mixed $class): bool
     {
         if (!is_string($class) && !is_object($class)) {
             return false;
@@ -103,22 +95,18 @@ public function isGrant(mixed $class)
     /**
      * Checks if a variable is a valid grant.
      *
-     * @return void
-     *
      * @throws InvalidGrantException
      *
      * @phpstan-assert class-string<AbstractGrant> | AbstractGrant $class
      */
-    public function checkGrant(mixed $class)
+    public function checkGrant(mixed $class): void
     {
         if (!$this->isGrant($class)) {
-            if (is_object($class)) {
-                $type = $class::class;
-            } elseif (is_scalar($class)) {
-                $type = $class;
-            } else {
-                $type = gettype($class);
-            }
+            $type = match (true) {
+                is_object($class) => $class::class,
+                is_scalar($class) => $class,
+                default => gettype($class),
+            };
 
             throw new InvalidGrantException(sprintf('Grant "%s" must extend AbstractGrant', $type));
         }
diff --git a/src/Grant/Password.php b/src/Grant/Password.php
index 575d778b..87d414f8 100644
--- a/src/Grant/Password.php
+++ b/src/Grant/Password.php
@@ -24,10 +24,7 @@
  */
 class Password extends AbstractGrant
 {
-    /**
-     * @inheritdoc
-     */
-    protected function getName()
+    protected function getName(): string
     {
         return 'password';
     }
@@ -35,7 +32,7 @@ protected function getName()
     /**
      * @inheritdoc
      */
-    protected function getRequiredRequestParameters()
+    protected function getRequiredRequestParameters(): array
     {
         return [
             'username',
diff --git a/src/Grant/RefreshToken.php b/src/Grant/RefreshToken.php
index b5bfb6dd..c8acdf38 100644
--- a/src/Grant/RefreshToken.php
+++ b/src/Grant/RefreshToken.php
@@ -24,10 +24,7 @@
  */
 class RefreshToken extends AbstractGrant
 {
-    /**
-     * @inheritdoc
-     */
-    protected function getName()
+    protected function getName(): string
     {
         return 'refresh_token';
     }
@@ -35,7 +32,7 @@ protected function getName()
     /**
      * @inheritdoc
      */
-    protected function getRequiredRequestParameters()
+    protected function getRequiredRequestParameters(): array
     {
         return [
             'refresh_token',
diff --git a/src/OptionProvider/OptionProviderInterface.php b/src/OptionProvider/OptionProviderInterface.php
index 25dd760c..e5242f90 100644
--- a/src/OptionProvider/OptionProviderInterface.php
+++ b/src/OptionProvider/OptionProviderInterface.php
@@ -29,5 +29,5 @@ interface OptionProviderInterface
      *
      * @return array<string, mixed>
      */
-    public function getAccessTokenOptions(string $method, array $params);
+    public function getAccessTokenOptions(string $method, array $params): array;
 }
diff --git a/src/OptionProvider/PostAuthOptionProvider.php b/src/OptionProvider/PostAuthOptionProvider.php
index 2afe6f67..be6ed66b 100644
--- a/src/OptionProvider/PostAuthOptionProvider.php
+++ b/src/OptionProvider/PostAuthOptionProvider.php
@@ -47,10 +47,8 @@ public function getAccessTokenOptions(string $method, array $params): array
      * Returns the request body for requesting an access token.
      *
      * @param array<string, mixed> $params
-     *
-     * @return string
      */
-    protected function getAccessTokenBody(array $params)
+    protected function getAccessTokenBody(array $params): string
     {
         return $this->buildQueryString($params);
     }
diff --git a/src/Provider/AbstractProvider.php b/src/Provider/AbstractProvider.php
index e35b89cb..c80e8cec 100644
--- a/src/Provider/AbstractProvider.php
+++ b/src/Provider/AbstractProvider.php
@@ -171,7 +171,7 @@ public function __construct(array $options = [], array $collaborators = [])
      *
      * @return list<string> The options to pass to the HttpClient constructor
      */
-    protected function getAllowedClientOptions(array $options)
+    protected function getAllowedClientOptions(array $options): array
     {
         $clientOptions = ['timeout', 'proxy'];
 
@@ -185,10 +185,8 @@ protected function getAllowedClientOptions(array $options)
 
     /**
      * Sets the grant factory instance.
-     *
-     * @return self
      */
-    public function setGrantFactory(GrantFactory $factory)
+    public function setGrantFactory(GrantFactory $factory): static
     {
         $this->grantFactory = $factory;
 
@@ -197,20 +195,16 @@ public function setGrantFactory(GrantFactory $factory)
 
     /**
      * Returns the current grant factory instance.
-     *
-     * @return GrantFactory
      */
-    public function getGrantFactory()
+    public function getGrantFactory(): GrantFactory
     {
         return $this->grantFactory;
     }
 
     /**
      * Sets the request factory instance.
-     *
-     * @return self
      */
-    public function setRequestFactory(RequestFactoryInterface $factory)
+    public function setRequestFactory(RequestFactoryInterface $factory): static
     {
         $this->requestFactory = $factory;
 
@@ -219,20 +213,16 @@ public function setRequestFactory(RequestFactoryInterface $factory)
 
     /**
      * Returns the request factory instance.
-     *
-     * @return RequestFactoryInterface
      */
-    public function getRequestFactory()
+    public function getRequestFactory(): RequestFactoryInterface
     {
         return $this->requestFactory;
     }
 
     /**
      * Sets the stream factory instance.
-     *
-     * @return self
      */
-    public function setStreamFactory(StreamFactoryInterface $factory)
+    public function setStreamFactory(StreamFactoryInterface $factory): static
     {
         $this->streamFactory = $factory;
 
@@ -241,20 +231,16 @@ public function setStreamFactory(StreamFactoryInterface $factory)
 
     /**
      * Returns the stream factory instance.
-     *
-     * @return StreamFactoryInterface
      */
-    public function getStreamFactory()
+    public function getStreamFactory(): StreamFactoryInterface
     {
         return $this->streamFactory;
     }
 
     /**
      * Sets the HTTP client instance.
-     *
-     * @return self
      */
-    public function setHttpClient(ClientInterface $client)
+    public function setHttpClient(ClientInterface $client): static
     {
         $this->httpClient = $client;
 
@@ -263,20 +249,16 @@ public function setHttpClient(ClientInterface $client)
 
     /**
      * Returns the HTTP client instance.
-     *
-     * @return ClientInterface
      */
-    public function getHttpClient()
+    public function getHttpClient(): ClientInterface
     {
         return $this->httpClient;
     }
 
     /**
      * Sets the option provider instance.
-     *
-     * @return self
      */
-    public function setOptionProvider(OptionProviderInterface $provider)
+    public function setOptionProvider(OptionProviderInterface $provider): static
     {
         $this->optionProvider = $provider;
 
@@ -285,10 +267,8 @@ public function setOptionProvider(OptionProviderInterface $provider)
 
     /**
      * Returns the option provider instance.
-     *
-     * @return OptionProviderInterface
      */
-    public function getOptionProvider()
+    public function getOptionProvider(): OptionProviderInterface
     {
         return $this->optionProvider;
     }
@@ -297,10 +277,8 @@ public function getOptionProvider()
      * Returns the current value of the state parameter.
      *
      * This can be accessed by the redirect handler during authorization.
-     *
-     * @return string
      */
-    public function getState()
+    public function getState(): string
     {
         return $this->state;
     }
@@ -309,10 +287,8 @@ public function getState()
      * Set the value of the pkceCode parameter.
      *
      * When using PKCE this should be set before requesting an access token.
-     *
-     * @return self
      */
-    public function setPkceCode(string $pkceCode)
+    public function setPkceCode(string $pkceCode): static
     {
         $this->pkceCode = $pkceCode;
 
@@ -323,10 +299,8 @@ public function setPkceCode(string $pkceCode)
      * Returns the current value of the pkceCode parameter.
      *
      * This can be accessed by the redirect handler during authorization.
-     *
-     * @return string | null
      */
-    public function getPkceCode()
+    public function getPkceCode(): ?string
     {
         return $this->pkceCode;
     }
@@ -335,10 +309,8 @@ public function getPkceCode()
      * Returns the base URL for authorizing a client.
      *
      * Eg. https://oauth.service.com/authorize
-     *
-     * @return string
      */
-    abstract public function getBaseAuthorizationUrl();
+    abstract public function getBaseAuthorizationUrl(): string;
 
     /**
      * Returns the base URL for requesting an access token.
@@ -346,27 +318,21 @@ abstract public function getBaseAuthorizationUrl();
      * Eg. https://oauth.service.com/token
      *
      * @param array<string, mixed> $params
-     *
-     * @return string
      */
-    abstract public function getBaseAccessTokenUrl(array $params);
+    abstract public function getBaseAccessTokenUrl(array $params): string;
 
     /**
      * Returns the URL for requesting the resource owner's details.
-     *
-     * @return string
      */
-    abstract public function getResourceOwnerDetailsUrl(AccessToken $token);
+    abstract public function getResourceOwnerDetailsUrl(AccessToken $token): string;
 
     /**
      * Returns a new random string to use as the state parameter in an
      * authorization flow.
      *
      * @param int<1, max> $length Length of the random string to be generated.
-     *
-     * @return string
      */
-    protected function getRandomState(int $length = 32)
+    protected function getRandomState(int $length = 32): string
     {
         // Converting bytes to hex will always double length. Hence, we can reduce
         // the amount of bytes by half to produce the correct length.
@@ -382,9 +348,8 @@ protected function getRandomState(int $length = 32)
      * Must be between 43 and 128 characters long.
      *
      * @param int<1, max> $length Length of the random string to be generated.
-     * @return string
      */
-    protected function getRandomPkceCode(int $length = 64)
+    protected function getRandomPkceCode(int $length = 64): string
     {
         assert($length >= 1);
 
@@ -399,7 +364,7 @@ protected function getRandomPkceCode(int $length = 64)
      *
      * @return list<string>
      */
-    abstract protected function getDefaultScopes();
+    abstract protected function getDefaultScopes(): array;
 
     /**
      * Returns the string that should be used to separate scopes when building
@@ -407,15 +372,12 @@ abstract protected function getDefaultScopes();
      *
      * @return string Scope separator, defaults to ','
      */
-    protected function getScopeSeparator()
+    protected function getScopeSeparator(): string
     {
         return ',';
     }
 
-    /**
-     * @return string | null
-     */
-    protected function getPkceMethod()
+    protected function getPkceMethod(): ?string
     {
         return null;
     }
@@ -429,7 +391,7 @@ protected function getPkceMethod()
      *
      * @throws InvalidArgumentException
      */
-    protected function getAuthorizationParameters(array $options)
+    protected function getAuthorizationParameters(array $options): array
     {
         $options += [
             'response_type' => 'code',
@@ -491,7 +453,7 @@ protected function getAuthorizationParameters(array $options)
      *
      * @return string Query string
      */
-    protected function getAuthorizationQuery(array $params)
+    protected function getAuthorizationQuery(array $params): string
     {
         return $this->buildQueryString($params);
     }
@@ -505,7 +467,7 @@ protected function getAuthorizationQuery(array $params)
      *
      * @throws InvalidArgumentException
      */
-    public function getAuthorizationUrl(array $options = [])
+    public function getAuthorizationUrl(array $options = []): string
     {
         $base = $this->getBaseAuthorizationUrl();
         $params = $this->getAuthorizationParameters($options);
@@ -544,9 +506,10 @@ public function authorize(
      *
      * @param  string $url The URL to append the query to
      * @param  string $query The HTTP query string
+     *
      * @return string The resulting URL
      */
-    protected function appendQuery(string $url, string $query)
+    protected function appendQuery(string $url, string $query): string
     {
         $query = trim($query, '?&');
 
@@ -564,7 +527,7 @@ protected function appendQuery(string $url, string $query)
      *
      * @return string HTTP method
      */
-    protected function getAccessTokenMethod()
+    protected function getAccessTokenMethod(): string
     {
         return self::METHOD_POST;
     }
@@ -574,7 +537,7 @@ protected function getAccessTokenMethod()
      *
      * @return string | null Resource owner identifier key
      */
-    protected function getAccessTokenResourceOwnerId()
+    protected function getAccessTokenResourceOwnerId(): ?string
     {
         /** @var string | null */
         return static::ACCESS_TOKEN_RESOURCE_OWNER_ID;
@@ -587,7 +550,7 @@ protected function getAccessTokenResourceOwnerId()
      *
      * @return string Query string
      */
-    protected function getAccessTokenQuery(array $params)
+    protected function getAccessTokenQuery(array $params): string
     {
         return $this->buildQueryString($params);
     }
@@ -595,10 +558,8 @@ protected function getAccessTokenQuery(array $params)
     /**
      * Checks that a provided grant is valid, or attempts to produce one if the
      * provided grant is a string.
-     *
-     * @return AbstractGrant
      */
-    protected function verifyGrant(mixed $grant)
+    protected function verifyGrant(mixed $grant): AbstractGrant
     {
         if (is_string($grant)) {
             return $this->grantFactory->getGrant($grant);
@@ -613,10 +574,8 @@ protected function verifyGrant(mixed $grant)
      * Returns the full URL to use when requesting an access token.
      *
      * @param array<string, mixed> $params Query parameters
-     *
-     * @return string
      */
-    protected function getAccessTokenUrl(array $params)
+    protected function getAccessTokenUrl(array $params): string
     {
         $url = $this->getBaseAccessTokenUrl($params);
 
@@ -637,10 +596,8 @@ protected function getAccessTokenUrl(array $params)
      *     version?: string,
      *     body?: string,
      * } $params Any of "headers", "body", and "version".
-     *
-     * @return RequestInterface
      */
-    protected function getAccessTokenRequest(array $params)
+    protected function getAccessTokenRequest(array $params): RequestInterface
     {
         $method = $this->getAccessTokenMethod();
         $url = $this->getAccessTokenUrl($params);
@@ -662,13 +619,11 @@ protected function getAccessTokenRequest(array $params)
      *
      * @param array<string, mixed> $options
      *
-     * @return AccessTokenInterface
-     *
      * @throws ClientExceptionInterface
      * @throws IdentityProviderException
      * @throws UnexpectedValueException
      */
-    public function getAccessToken(mixed $grant, array $options = [])
+    public function getAccessToken(mixed $grant, array $options = []): AccessTokenInterface
     {
         $grant = $this->verifyGrant($grant);
 
@@ -701,15 +656,7 @@ public function getAccessToken(mixed $grant, array $options = [])
         $params = $grant->prepareRequestParameters($params, $options);
 
         $request = $this->getAccessTokenRequest($params);
-
-        /** @var array<string, mixed> $response */
         $response = $this->getParsedResponse($request);
-        if (is_array($response) === false) {
-            throw new UnexpectedValueException(
-                'Invalid response received from Authorization Server. Expected JSON.',
-            );
-        }
-
         $prepared = $this->prepareAccessTokenResponse($response);
 
         return $this->createAccessToken($prepared, $grant);
@@ -723,10 +670,8 @@ public function getAccessToken(mixed $grant, array $options = [])
      *     version?: string,
      *     body?: string,
      * } $options Any of "headers", "body", and "version".
-     *
-     * @return RequestInterface
      */
-    public function getRequest(string $method, string $url, array $options = [])
+    public function getRequest(string $method, string $url, array $options = []): RequestInterface
     {
         return $this->createRequest($method, $url, null, $options);
     }
@@ -739,15 +684,13 @@ public function getRequest(string $method, string $url, array $options = [])
      *     version?: string,
      *     body?: string,
      * } $options Any of "headers", "body", and "version".
-     *
-     * @return RequestInterface
      */
     public function getAuthenticatedRequest(
         string $method,
         string $url,
         AccessTokenInterface | string | null $token,
         array $options = [],
-    ) {
+    ): RequestInterface {
         return $this->createRequest($method, $url, $token, $options);
     }
 
@@ -759,15 +702,13 @@ public function getAuthenticatedRequest(
      *     version?: string,
      *     body?: string,
      * } $options
-     *
-     * @return RequestInterface
      */
     protected function createRequest(
         string $method,
         string $url,
         AccessTokenInterface | string | null $token,
         array $options,
-    ) {
+    ): RequestInterface {
         $defaults = [
             'headers' => $this->getHeaders($token),
         ];
@@ -803,11 +744,9 @@ protected function createRequest(
      * WARNING: This method does not attempt to catch exceptions caused by HTTP
      * errors! It is recommended to wrap this method in a try/catch block.
      *
-     * @return ResponseInterface
-     *
      * @throws ClientExceptionInterface
      */
-    public function getResponse(RequestInterface $request)
+    public function getResponse(RequestInterface $request): ResponseInterface
     {
         return $this->getHttpClient()->sendRequest($request);
     }
@@ -815,13 +754,13 @@ public function getResponse(RequestInterface $request)
     /**
      * Sends a request and returns the parsed response.
      *
-     * @return mixed
+     * @return array<string, mixed>
      *
      * @throws ClientExceptionInterface
      * @throws IdentityProviderException
      * @throws UnexpectedValueException
      */
-    public function getParsedResponse(RequestInterface $request)
+    public function getParsedResponse(RequestInterface $request): array
     {
         try {
             $response = $this->getResponse($request);
@@ -832,6 +771,12 @@ public function getParsedResponse(RequestInterface $request)
         /** @var array<string, mixed> $parsed */
         $parsed = $this->parseResponse($response);
 
+        if (is_array($parsed) === false) {
+            throw new UnexpectedValueException(
+                'Invalid response received from Authorization Server. Expected JSON.',
+            );
+        }
+
         $this->checkResponse($response, $parsed);
 
         return $parsed;
@@ -846,7 +791,7 @@ public function getParsedResponse(RequestInterface $request)
      *
      * @throws UnexpectedValueException if the content could not be parsed
      */
-    protected function parseJson(string $content)
+    protected function parseJson(string $content): array
     {
         $content = json_decode($content, true);
 
@@ -866,7 +811,7 @@ protected function parseJson(string $content)
      *
      * @return string Semi-colon separated join of content-type headers.
      */
-    protected function getContentType(ResponseInterface $response)
+    protected function getContentType(ResponseInterface $response): string
     {
         return implode(';', $response->getHeader('content-type'));
     }
@@ -874,11 +819,11 @@ protected function getContentType(ResponseInterface $response)
     /**
      * Parses the response according to its content-type header.
      *
-     * @return mixed
+     * @return array<string, mixed> | string
      *
      * @throws UnexpectedValueException
      */
-    protected function parseResponse(ResponseInterface $response)
+    protected function parseResponse(ResponseInterface $response): array | string
     {
         $content = (string) $response->getBody();
         $type = $this->getContentType($response);
@@ -886,6 +831,7 @@ protected function parseResponse(ResponseInterface $response)
         if (strpos($type, 'urlencoded') !== false) {
             parse_str($content, $parsed);
 
+            /** @var array<string, string> */
             return $parsed;
         }
 
@@ -916,11 +862,9 @@ protected function parseResponse(ResponseInterface $response)
      *
      * @param mixed[] | string $data Parsed response data
      *
-     * @return void
-     *
      * @throws IdentityProviderException
      */
-    abstract protected function checkResponse(ResponseInterface $response, array | string $data);
+    abstract protected function checkResponse(ResponseInterface $response, array | string $data): void;
 
     /**
      * Prepares an parsed access token response for a grant.
@@ -932,7 +876,7 @@ abstract protected function checkResponse(ResponseInterface $response, array | s
      *
      * @return array<string, mixed>
      */
-    protected function prepareAccessTokenResponse(array $result)
+    protected function prepareAccessTokenResponse(array $result): array
     {
         if ($this->getAccessTokenResourceOwnerId() !== null) {
             $result['resource_owner_id'] = $this->getValueByKey(
@@ -951,10 +895,8 @@ protected function prepareAccessTokenResponse(array $result)
      * additional context.
      *
      * @param array<string, mixed> $response
-     *
-     * @return AccessTokenInterface
      */
-    protected function createAccessToken(array $response, AbstractGrant $grant)
+    protected function createAccessToken(array $response, AbstractGrant $grant): AccessTokenInterface
     {
         return new AccessToken($response);
     }
@@ -964,21 +906,17 @@ protected function createAccessToken(array $response, AbstractGrant $grant)
      * details request.
      *
      * @param array<string, mixed> $response
-     *
-     * @return ResourceOwnerInterface
      */
-    abstract protected function createResourceOwner(array $response, AccessToken $token);
+    abstract protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface;
 
     /**
      * Requests and returns the resource owner of given access token.
      *
-     * @return ResourceOwnerInterface
-     *
      * @throws ClientExceptionInterface
      * @throws IdentityProviderException
      * @throws UnexpectedValueException
      */
-    public function getResourceOwner(AccessToken $token)
+    public function getResourceOwner(AccessToken $token): ResourceOwnerInterface
     {
         $response = $this->fetchResourceOwnerDetails($token);
 
@@ -994,22 +932,12 @@ public function getResourceOwner(AccessToken $token)
      * @throws IdentityProviderException
      * @throws UnexpectedValueException
      */
-    protected function fetchResourceOwnerDetails(AccessToken $token)
+    protected function fetchResourceOwnerDetails(AccessToken $token): array
     {
         $url = $this->getResourceOwnerDetailsUrl($token);
-
         $request = $this->getAuthenticatedRequest(self::METHOD_GET, $url, $token);
 
-        $response = $this->getParsedResponse($request);
-
-        if (is_array($response) === false) {
-            throw new UnexpectedValueException(
-                'Invalid response received from Authorization Server. Expected JSON.',
-            );
-        }
-
-        /** @var array<string, mixed> */
-        return $response;
+        return $this->getParsedResponse($request);
     }
 
     /**
@@ -1017,9 +945,9 @@ protected function fetchResourceOwnerDetails(AccessToken $token)
      *
      * Typically this is used to set 'Accept' or 'Content-Type' headers.
      *
-     * @return array<string, mixed>
+     * @return array<string, string | string[]>
      */
-    protected function getDefaultHeaders()
+    protected function getDefaultHeaders(): array
     {
         return [];
     }
@@ -1035,9 +963,9 @@ protected function getDefaultHeaders()
      *
      * @param AccessTokenInterface | string | null $token Either a string or an access token instance
      *
-     * @return array<string, mixed>
+     * @return array<string, string | string[]>
      */
-    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null)
+    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null): array
     {
         return [];
     }
@@ -1049,9 +977,9 @@ protected function getAuthorizationHeaders(AccessTokenInterface | string | null
      *
      * @param AccessTokenInterface | string | null $token object or string
      *
-     * @return array<string, mixed>
+     * @return array<string, string | string[]>
      */
-    public function getHeaders(AccessTokenInterface | string | null $token = null)
+    public function getHeaders(AccessTokenInterface | string | null $token = null): array
     {
         if ($token) {
             return array_merge(
diff --git a/src/Provider/Exception/IdentityProviderException.php b/src/Provider/Exception/IdentityProviderException.php
index 88d5f0ea..fe47e2d4 100644
--- a/src/Provider/Exception/IdentityProviderException.php
+++ b/src/Provider/Exception/IdentityProviderException.php
@@ -38,10 +38,8 @@ public function __construct(string $message, int $code, mixed $response)
 
     /**
      * Returns the exception's response body.
-     *
-     * @return mixed
      */
-    public function getResponseBody()
+    public function getResponseBody(): mixed
     {
         return $this->response;
     }
diff --git a/src/Provider/GenericProvider.php b/src/Provider/GenericProvider.php
index dbf6cdab..6b103eb7 100644
--- a/src/Provider/GenericProvider.php
+++ b/src/Provider/GenericProvider.php
@@ -101,7 +101,7 @@ public function __construct(array $options = [], array $collaborators = [])
      *
      * @return list<string>
      */
-    protected function getConfigurableOptions()
+    protected function getConfigurableOptions(): array
     {
         return array_merge($this->getRequiredOptions(), [
             'accessTokenMethod',
@@ -120,7 +120,7 @@ protected function getConfigurableOptions()
      *
      * @return list<string>
      */
-    protected function getRequiredOptions()
+    protected function getRequiredOptions(): array
     {
         return [
             'urlAuthorize',
@@ -134,11 +134,9 @@ protected function getRequiredOptions()
      *
      * @param array<string, mixed> $options
      *
-     * @return void
-     *
      * @throws InvalidArgumentException
      */
-    private function assertRequiredOptions(array $options)
+    private function assertRequiredOptions(array $options): void
     {
         $missing = array_diff_key(array_flip($this->getRequiredOptions()), $options);
 
@@ -149,10 +147,7 @@ private function assertRequiredOptions(array $options)
         }
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getBaseAuthorizationUrl()
+    public function getBaseAuthorizationUrl(): string
     {
         return $this->urlAuthorize;
     }
@@ -160,15 +155,12 @@ public function getBaseAuthorizationUrl()
     /**
      * @inheritdoc
      */
-    public function getBaseAccessTokenUrl(array $params)
+    public function getBaseAccessTokenUrl(array $params): string
     {
         return $this->urlAccessToken;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getResourceOwnerDetailsUrl(AccessToken $token)
+    public function getResourceOwnerDetailsUrl(AccessToken $token): string
     {
         return $this->urlResourceOwnerDetails;
     }
@@ -176,47 +168,32 @@ public function getResourceOwnerDetailsUrl(AccessToken $token)
     /**
      * @inheritdoc
      */
-    public function getDefaultScopes()
+    public function getDefaultScopes(): array
     {
         return $this->scopes ?? [];
     }
 
-    /**
-     * @inheritdoc
-     */
-    protected function getAccessTokenMethod()
+    protected function getAccessTokenMethod(): string
     {
         return $this->accessTokenMethod ?: parent::getAccessTokenMethod();
     }
 
-    /**
-     * @inheritdoc
-     */
-    protected function getAccessTokenResourceOwnerId()
+    protected function getAccessTokenResourceOwnerId(): ?string
     {
         return $this->accessTokenResourceOwnerId ?: parent::getAccessTokenResourceOwnerId();
     }
 
-    /**
-     * @inheritdoc
-     */
-    protected function getScopeSeparator()
+    protected function getScopeSeparator(): string
     {
         return $this->scopeSeparator ?: parent::getScopeSeparator();
     }
 
-    /**
-     * @inheritdoc
-     */
-    protected function getPkceMethod()
+    protected function getPkceMethod(): ?string
     {
         return $this->pkceMethod ?: parent::getPkceMethod();
     }
 
-    /**
-     * @inheritdoc
-     */
-    protected function checkResponse(ResponseInterface $response, $data)
+    protected function checkResponse(ResponseInterface $response, array | string $data): void
     {
         if (isset($data[$this->responseError])) {
             $error = $data[$this->responseError];
@@ -238,7 +215,7 @@ protected function checkResponse(ResponseInterface $response, $data)
     /**
      * @inheritdoc
      */
-    protected function createResourceOwner(array $response, AccessToken $token)
+    protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface
     {
         return new GenericResourceOwner($response, $this->responseResourceOwnerId);
     }
diff --git a/src/Provider/GenericResourceOwner.php b/src/Provider/GenericResourceOwner.php
index dbafb466..3b6292bf 100644
--- a/src/Provider/GenericResourceOwner.php
+++ b/src/Provider/GenericResourceOwner.php
@@ -40,10 +40,8 @@ public function __construct(array $response, string $resourceOwnerId)
 
     /**
      * Returns the identifier of the authorized resource owner.
-     *
-     * @return mixed
      */
-    public function getId()
+    public function getId(): mixed
     {
         return $this->response[$this->resourceOwnerId] ?? null;
     }
@@ -53,7 +51,7 @@ public function getId()
      *
      * @return mixed[]
      */
-    public function toArray()
+    public function toArray(): array
     {
         return $this->response;
     }
diff --git a/src/Provider/ResourceOwnerInterface.php b/src/Provider/ResourceOwnerInterface.php
index 1d2d99c0..3dacccac 100644
--- a/src/Provider/ResourceOwnerInterface.php
+++ b/src/Provider/ResourceOwnerInterface.php
@@ -25,15 +25,13 @@ interface ResourceOwnerInterface
 {
     /**
      * Returns the identifier of the authorized resource owner.
-     *
-     * @return mixed
      */
-    public function getId();
+    public function getId(): mixed;
 
     /**
      * Return all of the owner details available as an array.
      *
      * @return mixed[]
      */
-    public function toArray();
+    public function toArray(): array;
 }
diff --git a/src/Token/AccessToken.php b/src/Token/AccessToken.php
index a706a422..3df3fd27 100644
--- a/src/Token/AccessToken.php
+++ b/src/Token/AccessToken.php
@@ -18,7 +18,6 @@
 namespace League\OAuth2\Client\Token;
 
 use InvalidArgumentException;
-use ReturnTypeWillChange;
 use RuntimeException;
 
 use function array_diff_key;
@@ -52,30 +51,23 @@ class AccessToken implements AccessTokenInterface, ResourceOwnerAccessTokenInter
      * Set the time now. This should only be used for testing purposes.
      *
      * @param int $timeNow the time in seconds since epoch
-     *
-     * @return void
      */
-    public static function setTimeNow(int $timeNow)
+    public static function setTimeNow(int $timeNow): void
     {
         self::$timeNow = $timeNow;
     }
 
     /**
      * Reset the time now if it was set for test purposes.
-     *
-     * @return void
      */
-    public static function resetTimeNow()
+    public static function resetTimeNow(): void
     {
         self::$timeNow = null;
     }
 
-    /**
-     * @return int
-     */
-    public function getTimeNow()
+    public function getTimeNow(): int
     {
-        return self::$timeNow ? self::$timeNow : time();
+        return self::$timeNow ?? time();
     }
 
     /**
@@ -139,10 +131,8 @@ public function __construct(array $options = [])
 
     /**
      * Check if a value is an expiration timestamp or second value.
-     *
-     * @return bool
      */
-    protected function isExpirationTimestamp(int $value)
+    protected function isExpirationTimestamp(int $value): bool
     {
         // If the given value is larger than the original OAuth 2 draft date,
         // assume that it is meant to be a (possible expired) timestamp.
@@ -151,50 +141,32 @@ protected function isExpirationTimestamp(int $value)
         return $value > $oauth2InceptionDate;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getToken()
+    public function getToken(): string
     {
         return $this->accessToken;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getRefreshToken()
+    public function getRefreshToken(): ?string
     {
         return $this->refreshToken;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function setRefreshToken(string $refreshToken)
+    public function setRefreshToken(string $refreshToken): void
     {
         $this->refreshToken = $refreshToken;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getExpires()
+    public function getExpires(): ?int
     {
         return $this->expires;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function getResourceOwnerId()
+    public function getResourceOwnerId(): int | string | null
     {
         return $this->resourceOwnerId;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function hasExpired()
+    public function hasExpired(): bool
     {
         $expires = $this->getExpires();
 
@@ -208,24 +180,20 @@ public function hasExpired()
     /**
      * @inheritdoc
      */
-    public function getValues()
+    public function getValues(): array
     {
         return $this->values;
     }
 
-    /**
-     * @inheritdoc
-     */
-    public function __toString()
+    public function __toString(): string
     {
-        return (string) $this->getToken();
+        return $this->getToken();
     }
 
     /**
      * @inheritdoc
      */
-    #[ReturnTypeWillChange]
-    public function jsonSerialize()
+    public function jsonSerialize(): array
     {
         $parameters = $this->values;
 
diff --git a/src/Token/AccessTokenInterface.php b/src/Token/AccessTokenInterface.php
index 17955f30..a90623d2 100644
--- a/src/Token/AccessTokenInterface.php
+++ b/src/Token/AccessTokenInterface.php
@@ -18,31 +18,24 @@
 namespace League\OAuth2\Client\Token;
 
 use JsonSerializable;
-use ReturnTypeWillChange;
 use RuntimeException;
 
 interface AccessTokenInterface extends JsonSerializable
 {
     /**
      * Returns the access token string of this instance.
-     *
-     * @return string
      */
-    public function getToken();
+    public function getToken(): string;
 
     /**
      * Returns the refresh token, if defined.
-     *
-     * @return string | null
      */
-    public function getRefreshToken();
+    public function getRefreshToken(): ?string;
 
     /**
      * Returns the expiration timestamp in seconds, if defined.
-     *
-     * @return int | null
      */
-    public function getExpires();
+    public function getExpires(): ?int;
 
     /**
      * Checks if this token has expired.
@@ -51,21 +44,19 @@ public function getExpires();
      *
      * @throws RuntimeException if 'expires' is not set on the token.
      */
-    public function hasExpired();
+    public function hasExpired(): bool;
 
     /**
      * Returns additional vendor values stored in the token.
      *
      * @return array<string, mixed>
      */
-    public function getValues();
+    public function getValues(): array;
 
     /**
      * Returns a string representation of the access token
-     *
-     * @return string
      */
-    public function __toString();
+    public function __toString(): string;
 
     /**
      * Returns an array of parameters to serialize when this is serialized with
@@ -73,6 +64,5 @@ public function __toString();
      *
      * @return array<string, mixed>
      */
-    #[ReturnTypeWillChange]
-    public function jsonSerialize();
+    public function jsonSerialize(): array;
 }
diff --git a/src/Token/ResourceOwnerAccessTokenInterface.php b/src/Token/ResourceOwnerAccessTokenInterface.php
index 5d217aae..f2a53c37 100644
--- a/src/Token/ResourceOwnerAccessTokenInterface.php
+++ b/src/Token/ResourceOwnerAccessTokenInterface.php
@@ -21,8 +21,6 @@ interface ResourceOwnerAccessTokenInterface extends AccessTokenInterface
 {
     /**
      * Returns the resource owner identifier, if defined.
-     *
-     * @return int | string | null
      */
-    public function getResourceOwnerId();
+    public function getResourceOwnerId(): int | string | null;
 }
diff --git a/src/Token/SettableRefreshTokenInterface.php b/src/Token/SettableRefreshTokenInterface.php
index f50483e9..c623938a 100644
--- a/src/Token/SettableRefreshTokenInterface.php
+++ b/src/Token/SettableRefreshTokenInterface.php
@@ -21,8 +21,6 @@ interface SettableRefreshTokenInterface
 {
     /**
      * Sets or replaces the refresh token with the provided refresh token.
-     *
-     * @return void
      */
-    public function setRefreshToken(string $refreshToken);
+    public function setRefreshToken(string $refreshToken): void;
 }
diff --git a/src/Tool/ArrayAccessorTrait.php b/src/Tool/ArrayAccessorTrait.php
index 46836624..e2b84661 100644
--- a/src/Tool/ArrayAccessorTrait.php
+++ b/src/Tool/ArrayAccessorTrait.php
@@ -33,10 +33,8 @@ trait ArrayAccessorTrait
      * Returns a value by key using dot notation.
      *
      * @param array<string, mixed> $data
-     *
-     * @return mixed
      */
-    private function getValueByKey(array $data, mixed $key, mixed $default = null)
+    private function getValueByKey(array $data, mixed $key, mixed $default = null): mixed
     {
         if (!is_string($key) || !count($data)) {
             return $default;
diff --git a/src/Tool/BearerAuthorizationTrait.php b/src/Tool/BearerAuthorizationTrait.php
index b58f30c8..31d71caa 100644
--- a/src/Tool/BearerAuthorizationTrait.php
+++ b/src/Tool/BearerAuthorizationTrait.php
@@ -31,9 +31,9 @@ trait BearerAuthorizationTrait
      *
      * @param AccessTokenInterface | string | null $token Either a string or an access token instance
      *
-     * @return array<string, mixed>
+     * @return array<string, string>
      */
-    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null)
+    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null): array
     {
         return ['Authorization' => 'Bearer ' . $token];
     }
diff --git a/src/Tool/GuardedPropertyTrait.php b/src/Tool/GuardedPropertyTrait.php
index 53bf234b..8d95aae2 100644
--- a/src/Tool/GuardedPropertyTrait.php
+++ b/src/Tool/GuardedPropertyTrait.php
@@ -57,17 +57,15 @@ protected function fillProperties(array $options = []): void
      *
      * @return list<string>
      */
-    public function getGuarded()
+    public function getGuarded(): array
     {
         return $this->guarded;
     }
 
     /**
      * Determines if the given property is guarded.
-     *
-     * @return bool
      */
-    public function isGuarded(string $property)
+    public function isGuarded(string $property): bool
     {
         return in_array($property, $this->getGuarded());
     }
diff --git a/src/Tool/MacAuthorizationTrait.php b/src/Tool/MacAuthorizationTrait.php
index 14c293c7..30c2a308 100644
--- a/src/Tool/MacAuthorizationTrait.php
+++ b/src/Tool/MacAuthorizationTrait.php
@@ -33,33 +33,28 @@ trait MacAuthorizationTrait
 {
     /**
      * Returns the id of this token for MAC generation.
-     *
-     * @return string
      */
-    abstract protected function getTokenId(AccessTokenInterface | string | null $token);
+    abstract protected function getTokenId(AccessTokenInterface | string | null $token): string;
 
     /**
      * Returns the MAC signature for the current request.
-     *
-     * @return string
      */
-    abstract protected function getMacSignature(string $id, int $ts, string $nonce);
+    abstract protected function getMacSignature(string $id, int $ts, string $nonce): string;
 
     /**
      * Returns a new random string to use as the state parameter in an
      * authorization flow.
      *
-     * @param  int $length Length of the random string to be generated.
-     * @return string
+     * @param int<1, max> $length Length of the random string to be generated.
      */
-    abstract protected function getRandomState(int $length = 32);
+    abstract protected function getRandomState(int $length = 32): string;
 
     /**
      * Returns the authorization headers for the 'mac' grant.
      *
      * @param AccessTokenInterface | string | null $token Either a string or an access token instance
      *
-     * @return array<string, mixed>
+     * @return array<string, string>
      *
      * @codeCoverageIgnore
      *
@@ -68,7 +63,7 @@ abstract protected function getRandomState(int $length = 32);
      *       complete the implementation, please create a pull request for
      *       https://github.com/thephpleague/oauth2-client
      */
-    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null)
+    protected function getAuthorizationHeaders(AccessTokenInterface | string | null $token = null): array
     {
         if ($token === null) {
             return [];
diff --git a/src/Tool/ProviderRedirectTrait.php b/src/Tool/ProviderRedirectTrait.php
index 2a126211..a9b14269 100644
--- a/src/Tool/ProviderRedirectTrait.php
+++ b/src/Tool/ProviderRedirectTrait.php
@@ -39,12 +39,10 @@ trait ProviderRedirectTrait
      * Retrieves a response for a given request and retrieves subsequent
      * responses, with authorization headers, if a redirect is detected.
      *
-     * @return ResponseInterface | null
-     *
      * @throws ClientExceptionInterface
      * @throws RuntimeException
      */
-    protected function followRequestRedirects(RequestInterface $request)
+    protected function followRequestRedirects(RequestInterface $request): ?ResponseInterface
     {
         $response = null;
         $attempts = 0;
@@ -67,27 +65,21 @@ protected function followRequestRedirects(RequestInterface $request)
 
     /**
      * Returns the HTTP client instance.
-     *
-     * @return ClientInterface
      */
-    abstract public function getHttpClient();
+    abstract public function getHttpClient(): ClientInterface;
 
     /**
      * Retrieves current redirect limit.
-     *
-     * @return int
      */
-    public function getRedirectLimit()
+    public function getRedirectLimit(): int
     {
         return $this->redirectLimit;
     }
 
     /**
      * Determines if a given response is a redirect.
-     *
-     * @return bool
      */
-    protected function isRedirect(ResponseInterface $response)
+    protected function isRedirect(ResponseInterface $response): bool
     {
         $statusCode = $response->getStatusCode();
 
@@ -100,11 +92,9 @@ protected function isRedirect(ResponseInterface $response)
      * WARNING: This method does not attempt to catch exceptions caused by HTTP
      * errors! It is recommended to wrap this method in a try/catch block.
      *
-     * @return ResponseInterface | null
-     *
      * @throws ClientExceptionInterface
      */
-    public function getResponse(RequestInterface $request)
+    public function getResponse(RequestInterface $request): ?ResponseInterface
     {
         try {
             $response = $this->followRequestRedirects($request);
@@ -118,11 +108,9 @@ public function getResponse(RequestInterface $request)
     /**
      * Updates the redirect limit.
      *
-     * @return self
-     *
      * @throws InvalidArgumentException
      */
-    public function setRedirectLimit(int $limit)
+    public function setRedirectLimit(int $limit): static
     {
         if ($limit < 1) {
             throw new InvalidArgumentException('redirectLimit must be greater than or equal to one.');
diff --git a/src/Tool/QueryBuilderTrait.php b/src/Tool/QueryBuilderTrait.php
index 4b3a47e8..3b577e0b 100644
--- a/src/Tool/QueryBuilderTrait.php
+++ b/src/Tool/QueryBuilderTrait.php
@@ -30,10 +30,8 @@ trait QueryBuilderTrait
      * Build a query string from an array.
      *
      * @param array<string, mixed> $params
-     *
-     * @return string
      */
-    protected function buildQueryString(array $params)
+    protected function buildQueryString(array $params): string
     {
         return http_build_query($params, '', '&', PHP_QUERY_RFC3986);
     }
diff --git a/src/Tool/RequiredParameterTrait.php b/src/Tool/RequiredParameterTrait.php
index 0c9746fb..ae610aec 100644
--- a/src/Tool/RequiredParameterTrait.php
+++ b/src/Tool/RequiredParameterTrait.php
@@ -31,11 +31,9 @@ trait RequiredParameterTrait
      *
      * @param array<string, mixed> $params
      *
-     * @return void
-     *
      * @throws BadMethodCallException
      */
-    private function checkRequiredParameter(string $name, array $params)
+    private function checkRequiredParameter(string $name, array $params): void
     {
         if (!isset($params[$name])) {
             throw new BadMethodCallException(sprintf(
@@ -51,11 +49,9 @@ private function checkRequiredParameter(string $name, array $params)
      * @param list<string> $names
      * @param array<string, mixed> $params
      *
-     * @return void
-     *
      * @throws BadMethodCallException
      */
-    private function checkRequiredParameters(array $names, array $params)
+    private function checkRequiredParameters(array $names, array $params): void
     {
         foreach ($names as $name) {
             $this->checkRequiredParameter($name, $params);
diff --git a/test/src/Grant/GrantFactoryTest.php b/test/src/Grant/GrantFactoryTest.php
index 344a8ae4..840b9517 100644
--- a/test/src/Grant/GrantFactoryTest.php
+++ b/test/src/Grant/GrantFactoryTest.php
@@ -18,6 +18,8 @@ public function testGetGrantDefaults(string $name): void
     {
         $factory = new GrantFactory();
         $grant = $factory->getGrant($name);
+
+        /** @phpstan-ignore method.alreadyNarrowedType */
         $this->assertInstanceOf(AbstractGrant::class, $grant);
     }
 
@@ -71,6 +73,7 @@ public function testIsGrant(): void
         $factory = new GrantFactory();
         $grant = $factory->getGrant('password');
 
+        /** @phpstan-ignore method.alreadyNarrowedType */
         $this->assertTrue($factory->isGrant($grant));
 
         /** @phpstan-ignore method.impossibleType */
@@ -79,11 +82,18 @@ public function testIsGrant(): void
 
     public function testCheckGrant(): void
     {
-        $this->expectNotToPerformAssertions();
-
         $factory = new GrantFactory();
         $grant = $factory->getGrant('password');
-        $factory->checkGrant($grant);
+
+        $e = null;
+        try {
+            /** @phpstan-ignore method.alreadyNarrowedType */
+            $factory->checkGrant($grant);
+        } catch (InvalidGrantException $e) {
+            // Check that we don't have an exception.
+        }
+
+        $this->assertNull($e);
     }
 
     public function testCheckGrantInvalidFails(): void
diff --git a/test/src/Grant/GrantTestCase.php b/test/src/Grant/GrantTestCase.php
index 7e888e6e..4400bddf 100644
--- a/test/src/Grant/GrantTestCase.php
+++ b/test/src/Grant/GrantTestCase.php
@@ -8,7 +8,6 @@
 use GuzzleHttp\Client;
 use GuzzleHttp\Psr7\HttpFactory;
 use League\OAuth2\Client\Test\Provider\Fake as MockProvider;
-use League\OAuth2\Client\Token\AccessTokenInterface;
 use Mockery;
 use Mockery\MockInterface;
 use PHPUnit\Framework\Attributes\DataProvider;
@@ -103,6 +102,6 @@ public function testGetAccessToken(string $grant, array $params = []): void
         $provider->setHttpClient($client);
         $token = $provider->getAccessToken($grant, $params);
 
-        $this->assertInstanceOf(AccessTokenInterface::class, $token);
+        $this->assertSame('mock_access_token', $token->getToken());
     }
 }
diff --git a/test/src/Provider/AbstractProviderTest.php b/test/src/Provider/AbstractProviderTest.php
index 3141ced7..a57c4a18 100644
--- a/test/src/Provider/AbstractProviderTest.php
+++ b/test/src/Provider/AbstractProviderTest.php
@@ -673,8 +673,7 @@ public function testAuthenticatedRequestAndResponse(): void
         $result = $provider->getParsedResponse($request);
 
         $this->assertSame(['example' => 'response'], $result);
-
-        $this->assertInstanceOf(RequestInterface::class, $request);
+        $this->assertSame('GET', $request->getMethod());
 
         // Authorization header should contain the token
         $header = $request->getHeader('Authorization');
@@ -950,22 +949,6 @@ public function testPrepareAccessTokenResponseWithDotNotation(): void
         $this->assertEquals($result['user']['id'], $newResult['resource_owner_id']);
     }
 
-    public function testPrepareAccessTokenResponseWithInvalidKeyType(): void
-    {
-        $provider = Mockery::mock(Fake\ProviderWithAccessTokenResourceOwnerId::class)->makePartial();
-        $provider->shouldAllowMockingProtectedMethods();
-        $provider
-            ->shouldReceive('getAccessTokenResourceOwnerId')
-            ->andReturn(new stdClass());
-
-        $result = ['user_id' => uniqid()];
-
-        /** @phpstan-ignore method.protected */
-        $newResult = $provider->prepareAccessTokenResponse($result);
-
-        $this->assertFalse(isset($newResult['resource_owner_id']));
-    }
-
     public function testPrepareAccessTokenResponseWithInvalidKeyPath(): void
     {
         $provider = Mockery::mock(Fake\ProviderWithAccessTokenResourceOwnerId::class)->makePartial();
diff --git a/test/src/Provider/Fake.php b/test/src/Provider/Fake.php
index edf77c99..28691c7c 100644
--- a/test/src/Provider/Fake.php
+++ b/test/src/Provider/Fake.php
@@ -6,6 +6,7 @@
 
 use League\OAuth2\Client\Provider\AbstractProvider;
 use League\OAuth2\Client\Provider\Exception\IdentityProviderException;
+use League\OAuth2\Client\Provider\ResourceOwnerInterface;
 use League\OAuth2\Client\Token\AccessToken;
 use League\OAuth2\Client\Tool\BearerAuthorizationTrait;
 use Psr\Http\Message\ResponseInterface;
@@ -37,10 +38,7 @@ public function getRedirectUri(): string
         return $this->redirectUri;
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getBaseAuthorizationUrl()
+    public function getBaseAuthorizationUrl(): string
     {
         return 'http://example.com/oauth/authorize';
     }
@@ -48,15 +46,12 @@ public function getBaseAuthorizationUrl()
     /**
      * @inheritDoc
      */
-    public function getBaseAccessTokenUrl(array $params)
+    public function getBaseAccessTokenUrl(array $params): string
     {
         return 'http://example.com/oauth/token';
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getResourceOwnerDetailsUrl(AccessToken $token)
+    public function getResourceOwnerDetailsUrl(AccessToken $token): string
     {
         return 'http://example.com/oauth/user';
     }
@@ -64,7 +59,7 @@ public function getResourceOwnerDetailsUrl(AccessToken $token)
     /**
      * @inheritDoc
      */
-    protected function getDefaultScopes()
+    protected function getDefaultScopes(): array
     {
         return ['test'];
     }
@@ -74,10 +69,7 @@ public function setAccessTokenMethod(string $method): void
         $this->accessTokenMethod = $method;
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getAccessTokenMethod()
+    public function getAccessTokenMethod(): string
     {
         return $this->accessTokenMethod;
     }
@@ -87,10 +79,7 @@ public function setPkceMethod(string $method): void
         $this->pkceMethod = $method;
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getPkceMethod()
+    public function getPkceMethod(): ?string
     {
         return $this->pkceMethod;
     }
@@ -100,28 +89,20 @@ public function setFixedPkceCode(string $code): string
         return $this->fixedPkceCode = $code;
     }
 
-    /**
-     * @inheritDoc
-     */
-    protected function getRandomPkceCode($length = 64)
+    protected function getRandomPkceCode(int $length = 64): string
     {
         return $this->fixedPkceCode ?: parent::getRandomPkceCode($length);
     }
 
     /**
-     * @param array<string, mixed> $response
-     *
      * @inheritDoc
      */
-    protected function createResourceOwner(array $response, AccessToken $token)
+    protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface
     {
         return new Fake\User($response);
     }
 
-    /**
-     * @inheritDoc
-     */
-    protected function checkResponse(ResponseInterface $response, $data)
+    protected function checkResponse(ResponseInterface $response, array | string $data): void
     {
         if (isset($data['error'])) {
             assert(is_string($data['error']));
diff --git a/test/src/Provider/Fake/ProviderWithAccessTokenHints.php b/test/src/Provider/Fake/ProviderWithAccessTokenHints.php
index 297981a1..ab18fe1c 100644
--- a/test/src/Provider/Fake/ProviderWithAccessTokenHints.php
+++ b/test/src/Provider/Fake/ProviderWithAccessTokenHints.php
@@ -6,6 +6,7 @@
 
 use League\OAuth2\Client\Provider\GenericProvider;
 use League\OAuth2\Client\Provider\GenericResourceOwner;
+use League\OAuth2\Client\Provider\ResourceOwnerInterface;
 use League\OAuth2\Client\Token\AccessToken;
 use League\OAuth2\Client\Token\AccessTokenInterface;
 use League\OAuth2\Client\Tool\MacAuthorizationTrait;
@@ -14,10 +15,7 @@ class ProviderWithAccessTokenHints extends GenericProvider
 {
     use MacAuthorizationTrait;
 
-    /**
-     * @inheritDoc
-     */
-    public function getResourceOwnerDetailsUrl(AccessToken $token)
+    public function getResourceOwnerDetailsUrl(AccessToken $token): string
     {
         return 'https://api.example.com/owner/' . $token->getResourceOwnerId();
     }
@@ -25,15 +23,12 @@ public function getResourceOwnerDetailsUrl(AccessToken $token)
     /**
      * @inheritDoc
      */
-    protected function createResourceOwner(array $response, AccessToken $token)
+    protected function createResourceOwner(array $response, AccessToken $token): ResourceOwnerInterface
     {
         return new GenericResourceOwner($response, (string) $token->getResourceOwnerId());
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getResourceOwner(AccessToken $token)
+    public function getResourceOwner(AccessToken $token): ResourceOwnerInterface
     {
         return $this->createResourceOwner([], $token);
     }
@@ -41,7 +36,7 @@ public function getResourceOwner(AccessToken $token)
     /**
      * @inheritDoc
      */
-    protected function fetchResourceOwnerDetails(AccessToken $token)
+    protected function fetchResourceOwnerDetails(AccessToken $token): array
     {
         return [];
     }
diff --git a/test/src/Provider/Fake/ProviderWithGuardedProperties.php b/test/src/Provider/Fake/ProviderWithGuardedProperties.php
index 0646475d..bed3b05c 100644
--- a/test/src/Provider/Fake/ProviderWithGuardedProperties.php
+++ b/test/src/Provider/Fake/ProviderWithGuardedProperties.php
@@ -23,7 +23,7 @@ class ProviderWithGuardedProperties extends MockProvider
     /**
      * @inheritDoc
      */
-    public function getGuarded()
+    public function getGuarded(): array
     {
         return $this->guarded;
     }
diff --git a/test/src/Provider/Fake/User.php b/test/src/Provider/Fake/User.php
index dbd89ff3..d6575528 100644
--- a/test/src/Provider/Fake/User.php
+++ b/test/src/Provider/Fake/User.php
@@ -23,10 +23,7 @@ public function __construct(array $response)
         $this->response = $response;
     }
 
-    /**
-     * @inheritDoc
-     */
-    public function getId()
+    public function getId(): mixed
     {
         return $this->response['id'] ?? null;
     }
diff --git a/test/src/Provider/Generic.php b/test/src/Provider/Generic.php
index 2bd6f0f3..54463a43 100644
--- a/test/src/Provider/Generic.php
+++ b/test/src/Provider/Generic.php
@@ -39,7 +39,7 @@ public function __construct(array $options = [], array $collaborators = [])
     /**
      * @inheritDoc
      */
-    protected function fetchResourceOwnerDetails(AccessToken $token)
+    protected function fetchResourceOwnerDetails(AccessToken $token): array
     {
         return [
             'mock_response_uid' => 1,
diff --git a/test/src/Token/AccessTokenTest.php b/test/src/Token/AccessTokenTest.php
index 1126db80..73278253 100644
--- a/test/src/Token/AccessTokenTest.php
+++ b/test/src/Token/AccessTokenTest.php
@@ -10,7 +10,6 @@
 use PHPUnit\Framework\TestCase;
 use RuntimeException;
 
-use function is_array;
 use function json_decode;
 use function json_encode;
 use function strtotime;
@@ -290,7 +289,6 @@ public function testValues(): void
 
         $values = $token->getValues();
 
-        $this->assertTrue(is_array($values));
         $this->assertArrayHasKey('custom_thing', $values);
         $this->assertSame($options['custom_thing'], $values['custom_thing']);