Make Options, HelperOptions, and SafeString final

Author: theodorejb

src/HelperOptions.php

@@ -14,7 +14,7 @@ enum Scope
 /**
  * @phpstan-import-type Template from Handlebars
  */
-class HelperOptions
+final class HelperOptions
 {
     /**
      * @param array<mixed> $data
@@ -46,7 +46,7 @@ public function hasPartial(string $name): bool
      * Typically used alongside hasPartial() to implement lazy partial loading.
      * @param Template $partial
      */
-    public function registerPartial(string $name, \Closure $partial): void
+    public function registerPartial(string $name, Closure $partial): void
     {
         $this->cx->partials[$name] = $partial;
     }
@@ -69,6 +69,7 @@ public function fn(mixed $context = Scope::Use, mixed $data = null): string
             if ($this->inv === null) {
                 throw new \Exception('fn() is not supported for inline helpers');
             }
+            // Occurs when blockHelperMissing routes a truthy context through fn() for an inverted block.
             return '';
         }
         return $this->invokeBlock($this->cb, $context, $data);
@@ -85,7 +86,7 @@ public function inverse(mixed $context = Scope::Use, mixed $data = null): string
         return $this->invokeBlock($this->inv, $context, $data);
     }
 
-    private function invokeBlock(\Closure $closure, mixed $context, mixed $data): string
+    private function invokeBlock(Closure $closure, mixed $context, mixed $data): string
     {
         $cx = $this->cx;
         // Save inlinePartials so that any {{#* inline}} partials registered inside the block body

src/Options.php

@@ -4,7 +4,7 @@
 
 use Closure;
 
-readonly class Options
+final readonly class Options
 {
     /** @var array<string, bool> */
     public array $knownHelpers;
@@ -27,6 +27,6 @@ public function __construct(
         public ?Closure $partialResolver = null,
     ) {
         $builtIn = ['if' => true, 'unless' => true, 'each' => true, 'with' => true, 'lookup' => true, 'log' => true];
-        $this->knownHelpers = array_replace($builtIn, $knownHelpers);
+        $this->knownHelpers = $knownHelpers ? array_replace($builtIn, $knownHelpers) : $builtIn;
     }
 }

src/SafeString.php

@@ -4,17 +4,15 @@
 
 /**
  * Can be returned from a custom helper to prevent an HTML string from being escaped
- * when the template is rendered. When constructing, any external content should be
- * properly escaped using Handlebars::escapeExpression() to avoid potential security concerns.
+ * when the template is rendered. Because SafeString bypasses the automatic HTML escaping
+ * that {{ }} applies, any user-supplied content embedded in it must first be escaped with
+ * Handlebars::escapeExpression() to prevent XSS vulnerabilities.
  */
-class SafeString implements \Stringable
+final readonly class SafeString implements \Stringable
 {
-    private string $string;
-
-    public function __construct(string $string)
-    {
-        $this->string = $string;
-    }
+    public function __construct(
+        private string $string,
+    ) {}
 
     public function __toString(): string
     {