fix(session): use Horde_Core_Secret_Cbc type hint in SessionLifecycle

[TDannhauer]

Fix SessionLifecycle secret type hint (Horde_Secret_Cbc → Horde_Core_Secret_Cbc)

Summary

• Change the $secret constructor parameter in SessionLifecycle from ?Horde_Secret_Cbc to ?Horde_Core_Secret_Cbc.
• Align the type hint with what SessionLifecycleFactory actually resolves from the injector.

Problem

After the SessionLifecycle work landed on FRAMEWORK_6_0 (2026-06-11), Horde fails at request bootstrap with:

Cannot create Horde\Core\Session\SessionLifecycle
Root cause: Horde\Core\Session\SessionLifecycle::__construct(): Argument #4 ($secret)
must be of type ?Horde_Secret_Cbc, Horde_Core_Secret_Cbc given,
called in .../SessionLifecycleFactory.php on line 60

Horde_Secret_Cbc is not a PHP class. It is the legacy injector binding name registered in DefaultInjectorBindings:

'Horde_Secret_Cbc' => 'Horde_Core_Factory_Secret_Cbc',

SessionLifecycleFactory::create() correctly resolves the service via that string binding and receives a Horde_Core_Secret_Cbc instance. HordeSessionFactory::create() uses the same pattern and documents why the binding name must not be confused with the concrete class.

The constructor type hint incorrectly referenced the binding name as if it were a class, so PHP 8 strict typing rejected the factory-built instance at runtime.

Unit tests did not catch this because SessionLifecycleTest::build() constructs the lifecycle without a secret (defaults to null).

Solution

Use Horde_Core_Secret_Cbc in the SessionLifecycle constructor type hint and update the related @param / @see docblocks. No behavioural change — only the declared type is corrected.

The factory continues to resolve 'Horde_Secret_Cbc' by binding name so the IV from $conf['secret_key'] is still applied via Horde_Core_Factory_Secret_Cbc.

Files changed

• src/Session/SessionLifecycle.php

Test plan

• Load any Horde web route with a configured secret_key; confirm no SessionLifecycle TypeError in the RDE log.
• Log in and log out; confirm session clean() / destroy() still re-key and clear the secret (setKey() / clearKey() on Horde_Core_Secret_Cbc).
• Run vendor/bin/phpunit test/Unit/Session/SessionLifecycleTest.php.
• Add a unit test that constructs SessionLifecycle with a Horde_Core_Secret_Cbc mock (mirroring HordeSessionFactoryTest) to prevent regression.

[ralflang]

No, Lifecycle should not be a shutdown task. That belongs into Horde_Session legacy shim as it's old-stuff plumbing we explicitly don't want in the modern stackm

[TDannhauer]

i'm fine with any other aproach, but current state breaks horde and horde-alarm (crontab spam)

[ralflang]

See #151 and particularly 919daee

[TDannhauer]

your fixes work, lets close this :)