From bc4379ac4ab104ae80d259f41c01321556c18de0 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Wed, 17 Jun 2026 18:33:29 +0200
Subject: [PATCH 1/4] rebase

---
 composer.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/composer.json b/composer.json
index c482897ee..69d8bce5e 100644
--- a/composer.json
+++ b/composer.json
@@ -30,7 +30,7 @@
     },
     "require-dev": {
         "boundwize/structarmed": "0.13.4",
-        "codeigniter/phpstan-codeigniter": "^1.3",
+        "codeigniter/phpstan-codeigniter": "^2.0",
         "codeigniter4/devkit": "^1.3",
         "codeigniter4/framework": ">=4.3.5 <4.5.0 || ^4.5.1",
         "firebase/php-jwt": "^7.0.3",

From 8eb271d2dd5d37053b01264122ea05e842aa19ef Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Wed, 17 Jun 2026 18:34:32 +0200
Subject: [PATCH 2/4] phpstan baseline

---
 phpstan-baseline.php                          | 144 ++----------------
 .../Authenticators/AccessTokens.php           |   2 -
 .../Authenticators/HmacSha256.php             |   2 -
 .../SessionAuthenticatorTest.php              |  11 +-
 tests/Controllers/ActionsTest.php             |   2 +-
 tests/Controllers/MagicLinkTest.php           |   2 +-
 6 files changed, 14 insertions(+), 149 deletions(-)

diff --git a/phpstan-baseline.php b/phpstan-baseline.php
index 80dd6ac01..c2fc4cb1f 100644
--- a/phpstan-baseline.php
+++ b/phpstan-baseline.php
@@ -1,42 +1,18 @@
 <?php declare(strict_types = 1);
 
 $ignoreErrors = [];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Authentication/Actions/Email2FA.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Construct empty() is not allowed. Use more strict comparison.',
 	'identifier' => 'empty.notAllowed',
 	'count' => 1,
 	'path' => __DIR__ . '/src/Authentication/Actions/Email2FA.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Authentication/Actions/EmailActivator.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Construct empty() is not allowed. Use more strict comparison.',
 	'identifier' => 'empty.notAllowed',
 	'count' => 1,
 	'path' => __DIR__ . '/src/Authentication/Authentication.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\TokenLoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/AccessTokens.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/AccessTokens.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Construct empty() is not allowed. Use more strict comparison.',
 	'identifier' => 'empty.notAllowed',
@@ -49,24 +25,6 @@
 	'count' => 1,
 	'path' => __DIR__ . '/src/Authentication/Authenticators/AccessTokens.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\TokenLoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/HmacSha256.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/HmacSha256.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\TokenLoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/JWT.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Parameter #1 $credentials (array{token?: string}) of method CodeIgniter\\Shield\\Authentication\\Authenticators\\JWT::attempt() should be contravariant with parameter $credentials (array) of method CodeIgniter\\Shield\\Authentication\\AuthenticatorInterface::attempt()',
 	'identifier' => 'method.childParameterType',
@@ -79,24 +37,6 @@
 	'count' => 1,
 	'path' => __DIR__ . '/src/Authentication/Authenticators/JWT.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\LoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/Session.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\RememberModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/Session.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Authentication/Authenticators/Session.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Construct empty() is not allowed. Use more strict comparison.',
 	'identifier' => 'empty.notAllowed',
@@ -163,30 +103,6 @@
 	'count' => 11,
 	'path' => __DIR__ . '/src/Commands/Hmac.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\GroupModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Commands/User.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 9,
-	'path' => __DIR__ . '/src/Commands/User.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\LoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Controllers/MagicLinkController.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Controllers/MagicLinkController.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Call to function assert() with false and \'Config Auth…\' will always evaluate to false.',
 	'identifier' => 'function.impossibleType',
@@ -217,30 +133,6 @@
 	'count' => 1,
 	'path' => __DIR__ . '/src/Database/Migrations/2020-12-28-223112_create_auth_tables.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\GroupModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 4,
-	'path' => __DIR__ . '/src/Entities/User.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\LoginModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Entities/User.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\PermissionModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Entities/User.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 23,
-	'path' => __DIR__ . '/src/Entities/User.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Only booleans are allowed in a ternary operator condition, int<0, max> given.',
 	'identifier' => 'ternary.condNotBoolean',
@@ -361,24 +253,6 @@
 	'count' => 1,
 	'path' => __DIR__ . '/src/Filters/TokenAuth.php',
 ];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\GroupModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 2,
-	'path' => __DIR__ . '/src/Models/UserModel.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\PermissionModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Models/UserModel.php',
-];
-$ignoreErrors[] = [
-	'rawMessage' => 'Call to function model with CodeIgniter\\Shield\\Models\\UserIdentityModel::class is discouraged.',
-	'identifier' => 'codeigniter.factoriesClassConstFetch',
-	'count' => 1,
-	'path' => __DIR__ . '/src/Models/UserModel.php',
-];
 $ignoreErrors[] = [
 	'rawMessage' => 'Construct empty() is not allowed. Use more strict comparison.',
 	'identifier' => 'empty.notAllowed',
@@ -424,7 +298,7 @@
 $ignoreErrors[] = [
 	'rawMessage' => 'Call to method setCookie() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
 	'identifier' => 'method.internalClass',
-	'count' => 1,
+	'count' => 2,
 	'path' => __DIR__ . '/tests/Authentication/Authenticators/SessionAuthenticatorTest.php',
 ];
 $ignoreErrors[] = [
@@ -446,25 +320,25 @@
 	'path' => __DIR__ . '/tests/Authentication/HasAccessTokensTest.php',
 ];
 $ignoreErrors[] = [
-	'rawMessage' => 'Accessing offset \'HTTP_USER_AGENT\' directly on $_SERVER is discouraged.',
-	'identifier' => 'codeigniter.superglobalAccess',
-	'count' => 1,
+	'rawMessage' => 'Call to method setServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
+	'identifier' => 'method.internalClass',
+	'count' => 2,
 	'path' => __DIR__ . '/tests/Controllers/ActionsTest.php',
 ];
 $ignoreErrors[] = [
-	'rawMessage' => 'Call to method setServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
+	'rawMessage' => 'Call to method unsetServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
 	'identifier' => 'method.internalClass',
-	'count' => 2,
+	'count' => 1,
 	'path' => __DIR__ . '/tests/Controllers/ActionsTest.php',
 ];
 $ignoreErrors[] = [
-	'rawMessage' => 'Accessing offset \'HTTP_USER_AGENT\' directly on $_SERVER is discouraged.',
-	'identifier' => 'codeigniter.superglobalAccess',
+	'rawMessage' => 'Call to method setServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
+	'identifier' => 'method.internalClass',
 	'count' => 1,
 	'path' => __DIR__ . '/tests/Controllers/MagicLinkTest.php',
 ];
 $ignoreErrors[] = [
-	'rawMessage' => 'Call to method setServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
+	'rawMessage' => 'Call to method unsetServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
 	'identifier' => 'method.internalClass',
 	'count' => 1,
 	'path' => __DIR__ . '/tests/Controllers/MagicLinkTest.php',
diff --git a/src/Authentication/Authenticators/AccessTokens.php b/src/Authentication/Authenticators/AccessTokens.php
index 4b471ada4..6f0dc427d 100644
--- a/src/Authentication/Authenticators/AccessTokens.php
+++ b/src/Authentication/Authenticators/AccessTokens.php
@@ -152,8 +152,6 @@ public function check(array $credentials): Result
             ]);
         }
 
-        assert($token->last_used_at instanceof Time || $token->last_used_at === null);
-
         // Is expired ?
         if (
             $token->expires instanceof Time
diff --git a/src/Authentication/Authenticators/HmacSha256.php b/src/Authentication/Authenticators/HmacSha256.php
index 482562f01..d4dc5c5ff 100644
--- a/src/Authentication/Authenticators/HmacSha256.php
+++ b/src/Authentication/Authenticators/HmacSha256.php
@@ -168,8 +168,6 @@ public function check(array $credentials): Result
             ]);
         }
 
-        assert($token->last_used_at instanceof Time || $token->last_used_at === null);
-
         // Hasn't been used in a long time
         if (
             isset($token->last_used_at)
diff --git a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
index 71c068472..ecf489680 100644
--- a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
+++ b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
@@ -13,7 +13,6 @@
 
 namespace Tests\Authentication\Authenticators;
 
-use CodeIgniter\CodeIgniter;
 use CodeIgniter\Config\Factories;
 use CodeIgniter\Shield\Authentication\Authentication;
 use CodeIgniter\Shield\Authentication\AuthenticationException;
@@ -106,11 +105,7 @@ public function testLoggedInWithRememberCookie(): void
         // Set Cookie value for remember-me.
         $token      = $selector . ':' . $validator;
         $cookieName = $cookiePrefix . setting('Auth.sessionConfig')['rememberCookieName'];
-        if (version_compare(CodeIgniter::CI_VERSION, '4.7.0', '<')) {
-            $_COOKIE[$cookieName] = $token;
-        } else {
-            service('superglobals')->setCookie($cookieName, $token);
-        }
+        service('superglobals')->setCookie($cookieName, $token);
 
         $this->assertTrue($this->auth->loggedIn());
 
@@ -138,8 +133,8 @@ public function testLoggedInAsDeletedUserWithRememberCookie(): void
         $rememberModel->rememberUser($this->user, $selector, hash('sha256', $validator), $expires);
 
         // Set Cookie value for remember-me.
-        $token               = $selector . ':' . $validator;
-        $_COOKIE['remember'] = $token;
+        $token = $selector . ':' . $validator;
+        service('superglobals')->setCookie('remember', $token);
 
         // Delete the user.
         $users = model(UserModel::class);
diff --git a/tests/Controllers/ActionsTest.php b/tests/Controllers/ActionsTest.php
index 6f1a18d78..c58b7e619 100644
--- a/tests/Controllers/ActionsTest.php
+++ b/tests/Controllers/ActionsTest.php
@@ -63,7 +63,7 @@ protected function tearDown(): void
         parent::tearDown();
 
         // Clean up any robot user agent set in tests
-        unset($_SERVER['HTTP_USER_AGENT']);
+        service('superglobals')->unsetServer('HTTP_USER_AGENT');
     }
 
     public function testActionShowNoneAvailable(): void
diff --git a/tests/Controllers/MagicLinkTest.php b/tests/Controllers/MagicLinkTest.php
index 82628e5ce..e089c39a2 100644
--- a/tests/Controllers/MagicLinkTest.php
+++ b/tests/Controllers/MagicLinkTest.php
@@ -56,7 +56,7 @@ protected function tearDown(): void
         parent::tearDown();
 
         // Clean up any robot user agent set in tests
-        unset($_SERVER['HTTP_USER_AGENT']);
+        service('superglobals')->unsetServer('HTTP_USER_AGENT');
     }
 
     public function testAfterLoggedInNotAllowDisplayMagicLink(): void

From 529a20fa14d7bc4c7597b0e4fec7df168285e019 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Wed, 17 Jun 2026 18:21:15 +0200
Subject: [PATCH 3/4] rector update

---
 rector.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/rector.php b/rector.php
index d2d9a6e6a..520d053ec 100644
--- a/rector.php
+++ b/rector.php
@@ -120,7 +120,9 @@
             __DIR__ . '/tests/Authentication/Authenticators/SessionAuthenticatorTest.php',
             __DIR__ . '/tests/Commands/SetupTest.php',
             __DIR__ . '/tests/Commands/UserModelGeneratorTest.php',
+            __DIR__ . '/tests/Controllers/ActionsTest.php',
             __DIR__ . '/tests/Controllers/LoginTest.php',
+            __DIR__ . '/tests/Controllers/MagicLinkTest.php',
         ],
         RemoveUnusedPrivatePropertyRector::class => [
             __DIR__ . '/src/Test/MockInputOutput.php',

From 8385aa222476a539d83226801fbb5ead71b92f14 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Wed, 17 Jun 2026 18:22:37 +0200
Subject: [PATCH 4/4] remove var annotations

---
 src/Authentication/Actions/Email2FA.php                  | 2 --
 src/Authentication/Actions/EmailActivator.php            | 2 --
 src/Authentication/Authenticators/AccessTokens.php       | 1 -
 src/Authentication/Authenticators/HmacSha256.php         | 1 -
 src/Authentication/Traits/HasAccessTokens.php            | 9 ---------
 src/Authentication/Traits/HasHmacTokens.php              | 8 --------
 src/Authorization/Traits/Authorizable.php                | 6 ------
 src/Commands/User.php                                    | 1 -
 src/Controllers/MagicLinkController.php                  | 3 ---
 src/Entities/User.php                                    | 6 ------
 src/Models/UserModel.php                                 | 4 ----
 .../Authenticators/AccessTokenAuthenticatorTest.php      | 4 +---
 .../Authenticators/HmacAuthenticatorTest.php             | 7 +------
 .../Authenticators/SessionAuthenticatorTest.php          | 3 ---
 tests/Authentication/Filters/GroupFilterTest.php         | 3 ---
 tests/Authentication/Filters/PermissionFilterTest.php    | 3 ---
 tests/Authentication/ForcePasswordResetTest.php          | 8 --------
 tests/Authentication/MagicLinkTest.php                   | 3 +--
 tests/Commands/HmacTest.php                              | 1 -
 tests/Commands/UserTest.php                              | 1 -
 tests/Controllers/MagicLinkTest.php                      | 6 ------
 tests/Controllers/RegisterTest.php                       | 2 +-
 .../Authentication/JWT/Adapters/FirebaseAdapaterTest.php | 2 --
 tests/Unit/Authentication/JWT/JWTManagerTest.php         | 3 ---
 tests/Unit/UserIdentityModelTest.php                     | 3 ---
 tests/Unit/UserTest.php                                  | 3 ---
 26 files changed, 4 insertions(+), 91 deletions(-)

diff --git a/src/Authentication/Actions/Email2FA.php b/src/Authentication/Actions/Email2FA.php
index f7bf42717..ab5ab42d0 100644
--- a/src/Authentication/Actions/Email2FA.php
+++ b/src/Authentication/Actions/Email2FA.php
@@ -145,7 +145,6 @@ public function verify(IncomingRequest $request)
      */
     public function createIdentity(User $user): string
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         // Delete any previous identities for action
@@ -169,7 +168,6 @@ public function createIdentity(User $user): string
      */
     private function getIdentity(User $user): ?UserIdentity
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getIdentityByType(
diff --git a/src/Authentication/Actions/EmailActivator.php b/src/Authentication/Actions/EmailActivator.php
index 2ca9aa611..d974213f5 100644
--- a/src/Authentication/Actions/EmailActivator.php
+++ b/src/Authentication/Actions/EmailActivator.php
@@ -137,7 +137,6 @@ public function verify(IncomingRequest $request)
      */
     public function createIdentity(User $user): string
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         // Delete any previous identities for action
@@ -161,7 +160,6 @@ public function createIdentity(User $user): string
      */
     private function getIdentity(User $user): ?UserIdentity
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getIdentityByType(
diff --git a/src/Authentication/Authenticators/AccessTokens.php b/src/Authentication/Authenticators/AccessTokens.php
index 6f0dc427d..30b6975a4 100644
--- a/src/Authentication/Authenticators/AccessTokens.php
+++ b/src/Authentication/Authenticators/AccessTokens.php
@@ -140,7 +140,6 @@ public function check(array $credentials): Result
             $credentials['token'] = trim(substr((string) $credentials['token'], 6));
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $token = $identityModel->getAccessTokenByRawToken($credentials['token']);
diff --git a/src/Authentication/Authenticators/HmacSha256.php b/src/Authentication/Authenticators/HmacSha256.php
index d4dc5c5ff..39687b6f1 100644
--- a/src/Authentication/Authenticators/HmacSha256.php
+++ b/src/Authentication/Authenticators/HmacSha256.php
@@ -144,7 +144,6 @@ public function check(array $credentials): Result
         // Extract UserToken and HMACSHA256 Signature from Authorization token
         [$userToken, $signature] = $this->getHmacAuthTokens($credentials['token']);
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $token = $identityModel->getHmacTokenByKey($userToken);
diff --git a/src/Authentication/Traits/HasAccessTokens.php b/src/Authentication/Traits/HasAccessTokens.php
index b4fa52cbb..5e2322bc4 100644
--- a/src/Authentication/Traits/HasAccessTokens.php
+++ b/src/Authentication/Traits/HasAccessTokens.php
@@ -45,7 +45,6 @@ trait HasAccessTokens
      */
     public function generateAccessToken(string $name, array $scopes = ['*'], ?Time $expiresAt = null): AccessToken
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->generateAccessToken($this, $name, $scopes, $expiresAt);
@@ -56,7 +55,6 @@ public function generateAccessToken(string $name, array $scopes = ['*'], ?Time $
      */
     public function revokeAccessToken(string $rawToken): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->revokeAccessToken($this, $rawToken);
@@ -67,7 +65,6 @@ public function revokeAccessToken(string $rawToken): void
      */
     public function revokeAccessTokenBySecret(string $secretToken): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->revokeAccessTokenBySecret($this, $secretToken);
@@ -78,7 +75,6 @@ public function revokeAccessTokenBySecret(string $secretToken): void
      */
     public function revokeAllAccessTokens(): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->revokeAllAccessTokens($this);
@@ -91,7 +87,6 @@ public function revokeAllAccessTokens(): void
      */
     public function accessTokens(): array
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getAllAccessTokens($this);
@@ -107,7 +102,6 @@ public function getAccessToken(?string $rawToken): ?AccessToken
             return null;
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getAccessToken($this, $rawToken);
@@ -118,7 +112,6 @@ public function getAccessToken(?string $rawToken): ?AccessToken
      */
     public function getAccessTokenById(int $id): ?AccessToken
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getAccessTokenById($id, $this);
@@ -190,7 +183,6 @@ public function isAccessTokenExpired(AccessToken $accessToken): bool
      */
     public function updateAccessTokenExpiration(int $id, Time $expiresAt): bool
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
         $result        = $identityModel->setIdentityExpirationById($id, $this, $expiresAt);
 
@@ -211,7 +203,6 @@ public function updateAccessTokenExpiration(int $id, Time $expiresAt): bool
      */
     public function removeAccessTokenExpiration(int $id): bool
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
         $result        = $identityModel->setIdentityExpirationById($id, $this);
 
diff --git a/src/Authentication/Traits/HasHmacTokens.php b/src/Authentication/Traits/HasHmacTokens.php
index 137cea9a3..4bea21825 100644
--- a/src/Authentication/Traits/HasHmacTokens.php
+++ b/src/Authentication/Traits/HasHmacTokens.php
@@ -46,7 +46,6 @@ trait HasHmacTokens
      */
     public function generateHmacToken(string $name, array $scopes = ['*'], ?Time $expiresAt = null): AccessToken
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->generateHmacToken($this, $name, $scopes, $expiresAt);
@@ -57,7 +56,6 @@ public function generateHmacToken(string $name, array $scopes = ['*'], ?Time $ex
      */
     public function revokeHmacToken(string $key): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->revokeHmacToken($this, $key);
@@ -68,7 +66,6 @@ public function revokeHmacToken(string $key): void
      */
     public function revokeAllHmacTokens(): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->revokeAllHmacTokens($this);
@@ -81,7 +78,6 @@ public function revokeAllHmacTokens(): void
      */
     public function hmacTokens(): array
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getAllHmacTokens($this);
@@ -96,7 +92,6 @@ public function getHmacToken(?string $key): ?AccessToken
             return null;
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getHmacToken($this, $key);
@@ -107,7 +102,6 @@ public function getHmacToken(?string $key): ?AccessToken
      */
     public function getHmacTokenById(int $id): ?AccessToken
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         return $identityModel->getHmacTokenById($id, $this);
@@ -179,7 +173,6 @@ public function isHmacTokenExpired(AccessToken $hmacToken): bool
      */
     public function updateHmacTokenExpiration(int $id, Time $expiresAt): bool
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
         $result        = $identityModel->setIdentityExpirationById($id, $this, $expiresAt);
 
@@ -200,7 +193,6 @@ public function updateHmacTokenExpiration(int $id, Time $expiresAt): bool
      */
     public function removeHmacTokenExpiration(int $id): bool
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
         $result        = $identityModel->setIdentityExpirationById($id, $this);
 
diff --git a/src/Authorization/Traits/Authorizable.php b/src/Authorization/Traits/Authorizable.php
index ac3228082..c9e40d1d0 100644
--- a/src/Authorization/Traits/Authorizable.php
+++ b/src/Authorization/Traits/Authorizable.php
@@ -43,7 +43,6 @@ public function addGroup(string ...$groups): self
                 continue;
             }
 
-            /** @var GroupModel $groupModel */
             $groupModel = model(GroupModel::class);
 
             // make sure it's a valid group
@@ -97,7 +96,6 @@ public function syncGroups(string ...$groups): self
     {
         $this->populateGroups();
 
-        /** @var GroupModel $groupModel */
         $groupModel = model(GroupModel::class);
 
         foreach ($groups as $group) {
@@ -313,7 +311,6 @@ private function populateGroups(): void
             return;
         }
 
-        /** @var GroupModel $groupModel */
         $groupModel = model(GroupModel::class);
 
         $this->groupCache = $groupModel->getForUser($this);
@@ -329,7 +326,6 @@ private function populatePermissions(): void
             return;
         }
 
-        /** @var PermissionModel $permissionModel */
         $permissionModel = model(PermissionModel::class);
 
         $this->permissionsCache = $permissionModel->getForUser($this);
@@ -340,7 +336,6 @@ private function populatePermissions(): void
      */
     private function saveGroups(): void
     {
-        /** @var GroupModel $model */
         $model = model(GroupModel::class);
 
         $cache = $this->groupCache;
@@ -353,7 +348,6 @@ private function saveGroups(): void
      */
     private function savePermissions(): void
     {
-        /** @var PermissionModel $model */
         $model = model(PermissionModel::class);
 
         $cache = $this->permissionsCache;
diff --git a/src/Commands/User.php b/src/Commands/User.php
index ad9748df4..1f763408c 100644
--- a/src/Commands/User.php
+++ b/src/Commands/User.php
@@ -335,7 +335,6 @@ private function create(?string $username = null, ?string $email = null, ?string
 
     private function validateGroup(string $group): bool
     {
-        /** @var GroupModel $groupModel */
         $groupModel = model(GroupModel::class);
 
         return $groupModel->isValidGroup($group);
diff --git a/src/Controllers/MagicLinkController.php b/src/Controllers/MagicLinkController.php
index 7f1853895..7ad0febc9 100644
--- a/src/Controllers/MagicLinkController.php
+++ b/src/Controllers/MagicLinkController.php
@@ -97,7 +97,6 @@ public function loginAction()
             return redirect()->route('magic-link')->with('error', lang('Auth.invalidEmail', [$email]));
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         // Delete any previous magic-link identities
@@ -168,7 +167,6 @@ public function verify(): RedirectResponse
 
         $token = $this->request->getGet('token');
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identity = $identityModel->getIdentityBySecret(Session::ID_TYPE_MAGIC_LINK, $token);
@@ -237,7 +235,6 @@ private function recordLoginAttempt(
         bool $success,
         $userId = null,
     ): void {
-        /** @var LoginModel $loginModel */
         $loginModel = model(LoginModel::class);
 
         $loginModel->recordLoginAttempt(
diff --git a/src/Entities/User.php b/src/Entities/User.php
index c40dda40a..cb4a069b1 100644
--- a/src/Entities/User.php
+++ b/src/Entities/User.php
@@ -93,7 +93,6 @@ public function getIdentity(string $type): ?UserIdentity
     private function populateIdentities(): void
     {
         if ($this->identities === null) {
-            /** @var UserIdentityModel $identityModel */
             $identityModel = model(UserIdentityModel::class);
 
             $this->identities = $identityModel->getIdentities($this);
@@ -140,7 +139,6 @@ public function setIdentities(array $identities): void
      */
     public function createEmailIdentity(array $credentials): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->createEmailIdentity($this, $credentials);
@@ -193,7 +191,6 @@ public function saveEmailIdentity(): bool
             $identity->secret2 = $this->password_hash;
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         try {
@@ -220,7 +217,6 @@ public function saveEmailIdentity(): bool
      */
     public function touchIdentity(UserIdentity $identity): void
     {
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         $identityModel->touchIdentity($identity);
@@ -283,7 +279,6 @@ public function getPasswordHash(): ?string
      */
     public function previousLogin(): ?Login
     {
-        /** @var LoginModel $logins */
         $logins = model(LoginModel::class);
 
         return $logins->previousLogin($this);
@@ -294,7 +289,6 @@ public function previousLogin(): ?Login
      */
     public function lastLogin(): ?Login
     {
-        /** @var LoginModel $logins */
         $logins = model(LoginModel::class);
 
         return $logins->lastLogin($this);
diff --git a/src/Models/UserModel.php b/src/Models/UserModel.php
index 6a55655a5..c2f689bfb 100644
--- a/src/Models/UserModel.php
+++ b/src/Models/UserModel.php
@@ -131,7 +131,6 @@ protected function fetchIdentities(array $data): array
             return $data;
         }
 
-        /** @var UserIdentityModel $identityModel */
         $identityModel = model(UserIdentityModel::class);
 
         // Get our identities for all users
@@ -209,7 +208,6 @@ protected function fetchGroups(array $data): array
             return $data;
         }
 
-        /** @var GroupModel $groupModel */
         $groupModel = model(GroupModel::class);
 
         // Get our groups for all users
@@ -247,7 +245,6 @@ protected function fetchPermissions(array $data): array
             return $data;
         }
 
-        /** @var PermissionModel $permissionModel */
         $permissionModel = model(PermissionModel::class);
 
         $permissions = $permissionModel->getPermissionsByUserIds($userIds);
@@ -304,7 +301,6 @@ public function addToDefaultGroup(User $user): void
     {
         $defaultGroup = setting('AuthGroups.defaultGroup');
 
-        /** @var GroupModel $groupModel */
         $groupModel = model(GroupModel::class);
 
         if (empty($defaultGroup) || ! $groupModel->isValidGroup($defaultGroup)) {
diff --git a/tests/Authentication/Authenticators/AccessTokenAuthenticatorTest.php b/tests/Authentication/Authenticators/AccessTokenAuthenticatorTest.php
index 4fafbd7e3..57d16f9b7 100644
--- a/tests/Authentication/Authenticators/AccessTokenAuthenticatorTest.php
+++ b/tests/Authentication/Authenticators/AccessTokenAuthenticatorTest.php
@@ -135,9 +135,7 @@ public function testCheckBadToken(): void
 
     public function testCheckOldToken(): void
     {
-        /** @var User $user */
-        $user = fake(UserModel::class);
-        /** @var UserIdentityModel $identities */
+        $user       = fake(UserModel::class);
         $identities = model(UserIdentityModel::class);
         $token      = $user->generateAccessToken('foo');
         // CI 4.2 uses the Chicago timezone that has Daylight Saving Time,
diff --git a/tests/Authentication/Authenticators/HmacAuthenticatorTest.php b/tests/Authentication/Authenticators/HmacAuthenticatorTest.php
index 790a7291a..53679bf60 100644
--- a/tests/Authentication/Authenticators/HmacAuthenticatorTest.php
+++ b/tests/Authentication/Authenticators/HmacAuthenticatorTest.php
@@ -52,7 +52,6 @@ protected function setUp(): void
 
     public function testLogin(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
 
         $this->auth->login($user);
@@ -76,7 +75,6 @@ public function testLogout(): void
 
     public function testLoginByIdNoToken(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
 
         $this->assertFalse($this->auth->loggedIn());
@@ -159,9 +157,7 @@ public function testCheckBadSignature(): void
 
     public function testCheckOldToken(): void
     {
-        /** @var User $user */
-        $user = fake(UserModel::class);
-        /** @var UserIdentityModel $identities */
+        $user       = fake(UserModel::class);
         $identities = model(UserIdentityModel::class);
         $token      = $user->generateHmacToken('foo');
         // CI 4.2 uses the Chicago timezone that has Daylight Saving Time,
@@ -289,7 +285,6 @@ public function testAttemptSuccess(): void
 
     public function testAttemptBanned(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->ban('Test ban.');
 
diff --git a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
index ecf489680..24dd6d69e 100644
--- a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
+++ b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php
@@ -95,7 +95,6 @@ public function testLoggedInWithRememberCookie(): void
         $this->user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret']);
 
         // Insert remember-me token.
-        /** @var RememberModel $rememberModel */
         $rememberModel = model(RememberModel::class);
         $selector      = 'selector';
         $validator     = 'validator';
@@ -125,7 +124,6 @@ public function testLoggedInAsDeletedUserWithRememberCookie(): void
         $this->user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret']);
 
         // Insert remember-me token.
-        /** @var RememberModel $rememberModel */
         $rememberModel = model(RememberModel::class);
         $selector      = 'selector';
         $validator     = 'validator';
@@ -416,7 +414,6 @@ public function testAttemptUsernameOnly(): void
         $config->validFields = ['email', 'username'];
         Factories::injectMock('config', 'Auth', $config);
 
-        /** @var User $user */
         $user = fake(UserModel::class, ['username' => 'foorog']);
         $user->createEmailIdentity([
             'email'    => 'FOO@example.com',
diff --git a/tests/Authentication/Filters/GroupFilterTest.php b/tests/Authentication/Filters/GroupFilterTest.php
index 3e0d2a905..bc6e1d233 100644
--- a/tests/Authentication/Filters/GroupFilterTest.php
+++ b/tests/Authentication/Filters/GroupFilterTest.php
@@ -13,7 +13,6 @@
 
 namespace Tests\Authentication\Filters;
 
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Filters\GroupFilter;
 use CodeIgniter\Shield\Models\UserModel;
 use CodeIgniter\Test\DatabaseTestTrait;
@@ -52,7 +51,6 @@ public function testFilterNotAuthorizedStoresRedirectToEntranceUrlIntoSession():
 
     public function testFilterSuccess(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->addGroup('admin');
 
@@ -69,7 +67,6 @@ public function testFilterSuccess(): void
 
     public function testFilterIncorrectGroupNoPrevious(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->addGroup('beta');
 
diff --git a/tests/Authentication/Filters/PermissionFilterTest.php b/tests/Authentication/Filters/PermissionFilterTest.php
index 67564fcdf..5ca3039c1 100644
--- a/tests/Authentication/Filters/PermissionFilterTest.php
+++ b/tests/Authentication/Filters/PermissionFilterTest.php
@@ -13,7 +13,6 @@
 
 namespace Tests\Authentication\Filters;
 
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Filters\PermissionFilter;
 use CodeIgniter\Shield\Models\UserModel;
 use CodeIgniter\Test\DatabaseTestTrait;
@@ -52,7 +51,6 @@ public function testFilterNotAuthorizedStoresRedirectToEntranceUrlIntoSession():
 
     public function testFilterSuccess(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->addPermission('admin.access');
 
@@ -69,7 +67,6 @@ public function testFilterSuccess(): void
 
     public function testFilterIncorrectGroupNoPrevious(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->addPermission('beta.access');
 
diff --git a/tests/Authentication/ForcePasswordResetTest.php b/tests/Authentication/ForcePasswordResetTest.php
index 582961f92..527230e32 100644
--- a/tests/Authentication/ForcePasswordResetTest.php
+++ b/tests/Authentication/ForcePasswordResetTest.php
@@ -13,7 +13,6 @@
 
 namespace Tests\Authentication;
 
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Models\UserIdentityModel;
 use CodeIgniter\Shield\Models\UserModel;
 use CodeIgniter\Shield\Test\AuthenticationTesting;
@@ -52,11 +51,9 @@ protected function setUp(): void
 
     public function testUserRequiresPasswordReset(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
-        /** @var UserIdentityModel $identity */
         $identity = model(UserIdentityModel::class);
         $identity->set('force_reset', 1);
         $identity->where('user_id', $user->id);
@@ -67,7 +64,6 @@ public function testUserRequiresPasswordReset(): void
 
     public function testForcePasswordResetOnUser(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
         $user->forcePasswordReset();
@@ -77,7 +73,6 @@ public function testForcePasswordResetOnUser(): void
 
     public function testUndoForcePasswordResetOnUser(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
         $user->forcePasswordReset();
@@ -88,7 +83,6 @@ public function testUndoForcePasswordResetOnUser(): void
 
     public function testRequiresPasswordResetRedirect(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
         $user->forcePasswordReset();
@@ -103,7 +97,6 @@ public function testRequiresPasswordResetRedirect(): void
     public function testForceGlobalPasswordReset(): void
     {
         for ($i = 0; $i < 3; $i++) {
-            /** @var User $user */
             $user = fake(UserModel::class);
             $user->createEmailIdentity([
                 'email' => 'foo' . $i . '@example.com', 'password' => $i . 'secret123',
@@ -112,7 +105,6 @@ public function testForceGlobalPasswordReset(): void
             $users[$i] = $user;
         }
 
-        /** @var UserIdentityModel $identities */
         $identities = model(UserIdentityModel::class);
         $identities->forceGlobalPasswordReset();
 
diff --git a/tests/Authentication/MagicLinkTest.php b/tests/Authentication/MagicLinkTest.php
index f421a03fd..272e276e6 100644
--- a/tests/Authentication/MagicLinkTest.php
+++ b/tests/Authentication/MagicLinkTest.php
@@ -126,8 +126,7 @@ public function testMagicLinkVerifyExpired(): void
     public function testMagicLinkVerifySuccess(): void
     {
         $identities = new UserIdentityModel();
-        /** @var User $user */
-        $user = fake(UserModel::class);
+        $user       = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
         $identities->insert([
             'user_id' => $user->id,
diff --git a/tests/Commands/HmacTest.php b/tests/Commands/HmacTest.php
index 270aa6f5e..405fbcaae 100644
--- a/tests/Commands/HmacTest.php
+++ b/tests/Commands/HmacTest.php
@@ -149,7 +149,6 @@ public function testExpireAll(): void
     {
         $tokenExpiration = Time::parse('2024-11-03 12:00:00');
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->generateHmacToken('foo', ['*'], $tokenExpiration);
         $user->generateHmacToken('bar');
diff --git a/tests/Commands/UserTest.php b/tests/Commands/UserTest.php
index 51cc6ec5d..738c06e05 100644
--- a/tests/Commands/UserTest.php
+++ b/tests/Commands/UserTest.php
@@ -212,7 +212,6 @@ public function testCreatePasswordNotMatch(): void
      */
     private function createUser(array $userData): UserEntity
     {
-        /** @var UserEntity $user */
         $user = fake(UserModel::class, ['username' => $userData['username']]);
         $user->createEmailIdentity([
             'email'    => $userData['email'],
diff --git a/tests/Controllers/MagicLinkTest.php b/tests/Controllers/MagicLinkTest.php
index e089c39a2..5ec3aef19 100644
--- a/tests/Controllers/MagicLinkTest.php
+++ b/tests/Controllers/MagicLinkTest.php
@@ -96,7 +96,6 @@ public function testMagicLinkVerifyPendingRegistrationActivation(): void
         $config->actions['register'] = EmailActivator::class;
         Factories::injectMock('config', 'Auth', $config);
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
@@ -142,7 +141,6 @@ public function testMagicLinkVerifyPendingConditionalRegistrationActivation(): v
         $config->actions['register'] = AdminEmailActivator::class;
         Factories::injectMock('config', 'Auth', $config);
 
-        /** @var User $user */
         $user = fake(UserModel::class, ['active' => false]);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
@@ -181,7 +179,6 @@ public function testMagicLinkVerifyStartsLoginAction(): void
     {
         setting('Auth.actions', ['login' => Email2FA::class, 'register' => null]);
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
@@ -217,7 +214,6 @@ public function testMagicLinkVerifyStartsConditionalLoginActionWhenItApplies():
     {
         setting('Auth.actions', ['login' => AdminEmail2FA::class, 'register' => null]);
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->addGroup('admin');
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
@@ -237,7 +233,6 @@ public function testMagicLinkVerifySkipsConditionalLoginActionWhenItDoesNotApply
     {
         setting('Auth.actions', ['login' => AdminEmail2FA::class, 'register' => null]);
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
@@ -313,7 +308,6 @@ public function testMagicLinkVerifyReturns404ForRobotUserAgent(): void
     {
         $this->expectException(PageNotFoundException::class);
 
-        /** @var User $user */
         $user = fake(UserModel::class);
         $user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret123']);
 
diff --git a/tests/Controllers/RegisterTest.php b/tests/Controllers/RegisterTest.php
index bfc92b2bf..2b43717c3 100644
--- a/tests/Controllers/RegisterTest.php
+++ b/tests/Controllers/RegisterTest.php
@@ -74,7 +74,6 @@ public function testRegisterActionSuccess(): void
         ]);
 
         // User has email/password identity
-        /** @var User $user */
         $user = model(UserModel::class)->where('username', 'JohnDoe')->first();
 
         $this->seeInDatabase($this->tables['identities'], [
@@ -82,6 +81,7 @@ public function testRegisterActionSuccess(): void
             'type'    => Session::ID_TYPE_EMAIL_PASSWORD,
             'secret'  => 'john.doe@example.com',
         ]);
+        $this->assertInstanceOf(User::class, $user);
 
         // User added to default group
         $this->assertTrue($user->inGroup(config('AuthGroups')->defaultGroup));
diff --git a/tests/Unit/Authentication/JWT/Adapters/FirebaseAdapaterTest.php b/tests/Unit/Authentication/JWT/Adapters/FirebaseAdapaterTest.php
index 188e33348..18c987f2c 100644
--- a/tests/Unit/Authentication/JWT/Adapters/FirebaseAdapaterTest.php
+++ b/tests/Unit/Authentication/JWT/Adapters/FirebaseAdapaterTest.php
@@ -18,7 +18,6 @@
 use CodeIgniter\Shield\Authentication\JWT\Exceptions\InvalidTokenException;
 use CodeIgniter\Shield\Authentication\JWTManager;
 use CodeIgniter\Shield\Config\AuthJWT;
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Exceptions\InvalidArgumentException as ShieldInvalidArgumentException;
 use CodeIgniter\Shield\Exceptions\LogicException as ShieldLogicException;
 use CodeIgniter\Shield\Models\UserModel;
@@ -51,7 +50,6 @@ public function testDecode(): void
      */
     public static function generateJWT(?Time $clock = null): string
     {
-        /** @var User $user */
         $user = fake(UserModel::class, ['id' => 1, 'username' => 'John Smith'], false);
 
         $generator = new JWTManager($clock);
diff --git a/tests/Unit/Authentication/JWT/JWTManagerTest.php b/tests/Unit/Authentication/JWT/JWTManagerTest.php
index 24e381775..cd32ef077 100644
--- a/tests/Unit/Authentication/JWT/JWTManagerTest.php
+++ b/tests/Unit/Authentication/JWT/JWTManagerTest.php
@@ -16,7 +16,6 @@
 use CodeIgniter\I18n\Time;
 use CodeIgniter\Shield\Authentication\JWTManager;
 use CodeIgniter\Shield\Config\AuthJWT;
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Models\UserModel;
 use PHPUnit\Framework\Attributes\Depends;
 use Tests\Support\TestCase;
@@ -33,7 +32,6 @@ private function createJWTManager(?Time $clock = null): JWTManager
 
     public function testGenerateToken(): array
     {
-        /** @var User $user */
         $user = fake(UserModel::class, ['id' => 1, 'username' => 'John Smith'], false);
 
         // Fix the current time for testing.
@@ -76,7 +74,6 @@ public function testGenerateTokenPayload(array $data): void
 
     public function testGenerateTokenAddClaims(): void
     {
-        /** @var User $user */
         $user = fake(UserModel::class, ['id' => 1, 'username' => 'John Smith'], false);
 
         $manager = $this->createJWTManager();
diff --git a/tests/Unit/UserIdentityModelTest.php b/tests/Unit/UserIdentityModelTest.php
index e552a3b19..ac9794ea8 100644
--- a/tests/Unit/UserIdentityModelTest.php
+++ b/tests/Unit/UserIdentityModelTest.php
@@ -14,7 +14,6 @@
 namespace Tests\Unit;
 
 use CodeIgniter\Shield\Authentication\Authenticators\Session;
-use CodeIgniter\Shield\Entities\User;
 use CodeIgniter\Shield\Models\DatabaseException;
 use CodeIgniter\Shield\Models\UserIdentityModel;
 use CodeIgniter\Shield\Models\UserModel;
@@ -64,7 +63,6 @@ public function testCreateCodeIdentityThrowsExceptionIfUniqueCodeIsNotGot(): voi
     {
         $this->expectException(DatabaseException::class);
 
-        /** @var User $user */
         $user = fake(UserModel::class, ['id' => '1']);
         fake(UserIdentityModel::class, ['user_id' => 2, 'type' => Session::ID_TYPE_EMAIL_ACTIVATE, 'secret' => '666666']);
 
@@ -88,7 +86,6 @@ public function testForceMultiplePasswordReset(): void
         $fabricator = new Fabricator(UserIdentityModel::class);
         $fabricator->create(10);
 
-        /** @var UserIdentityModel $identities */
         $identities = model(UserIdentityModel::class);
         $result     = $identities->select('user_id')->findAll();
         $userIds    = [];
diff --git a/tests/Unit/UserTest.php b/tests/Unit/UserTest.php
index 4325a2b13..8397846af 100644
--- a/tests/Unit/UserTest.php
+++ b/tests/Unit/UserTest.php
@@ -590,13 +590,11 @@ public function testIsActivatedWhenRequired(): void
         $user = $this->user;
 
         $user->deactivate();
-        /** @var User $user */
         $user = model(UserModel::class)->find($user->id);
 
         $this->assertFalse($user->isActivated());
 
         $user->activate();
-        /** @var User $user */
         $user = model(UserModel::class)->find($user->id);
 
         $this->assertTrue($user->isActivated());
@@ -610,7 +608,6 @@ public function testIsNotActivated(): void
         $user->active = false;
         model(UserModel::class)->save($user);
 
-        /** @var User $user */
         $user = model(UserModel::class)->find($user->id);
 
         $this->assertFalse($user->isActivated());