refactor(authentication): Use constructor property promotionauthPropertyPromotion

fix: typos

49 files changed, 341 insertions, 696 deletions

diff --git a/lib/private/Authentication/Events/ARemoteWipeEvent.php b/lib/private/Authentication/Events/ARemoteWipeEvent.php
index ba1e93d26ae..39ecb206196 100644
--- a/lib/private/Authentication/Events/ARemoteWipeEvent.php
+++ b/lib/private/Authentication/Events/ARemoteWipeEvent.php
@@ -12,12 +12,11 @@ use OC\Authentication\Token\IToken;
 use OCP\EventDispatcher\Event;
 
 abstract class ARemoteWipeEvent extends Event {
-	/** @var IToken */
-	private $token;
 
-	public function __construct(IToken $token) {
+	public function __construct(
+		private IToken $token,
+	) {
 		parent::__construct();
-		$this->token = $token;
 	}
 
 	public function getToken(): IToken {
diff --git a/lib/private/Authentication/Events/LoginFailed.php b/lib/private/Authentication/Events/LoginFailed.php
index 23eeaef87ad..01233f42309 100644
--- a/lib/private/Authentication/Events/LoginFailed.php
+++ b/lib/private/Authentication/Events/LoginFailed.php
@@ -11,14 +11,12 @@ namespace OC\Authentication\Events;
 use OCP\EventDispatcher\Event;
 
 class LoginFailed extends Event {
-	private string $loginName;
-	private ?string $password;
 
-	public function __construct(string $loginName, ?string $password) {
+	public function __construct(
+		private string $loginName,
+		private ?string $password,
+	) {
 		parent::__construct();
-
-		$this->loginName = $loginName;
-		$this->password = $password;
 	}
 
 	public function getLoginName(): string {
diff --git a/lib/private/Authentication/Exceptions/InvalidProviderException.php b/lib/private/Authentication/Exceptions/InvalidProviderException.php
index 9dbf3a7782a..3c74be230cf 100644
--- a/lib/private/Authentication/Exceptions/InvalidProviderException.php
+++ b/lib/private/Authentication/Exceptions/InvalidProviderException.php
@@ -12,7 +12,10 @@ use Exception;
 use Throwable;
 
 class InvalidProviderException extends Exception {
-	public function __construct(string $providerId, ?Throwable $previous = null) {
+	public function __construct(
+		string $providerId,
+		?Throwable $previous = null,
+	) {
 		parent::__construct("The provider '$providerId' does not exist'", 0, $previous);
 	}
 }
diff --git a/lib/private/Authentication/Listeners/LoginFailedListener.php b/lib/private/Authentication/Listeners/LoginFailedListener.php
index 0358887bb86..08ad670f2f5 100644
--- a/lib/private/Authentication/Listeners/LoginFailedListener.php
+++ b/lib/private/Authentication/Listeners/LoginFailedListener.php
@@ -21,19 +21,15 @@ use OCP\Util;
  * @template-implements IEventListener<\OC\Authentication\Events\LoginFailed>
  */
 class LoginFailedListener implements IEventListener {
-	/** @var IEventDispatcher */
-	private $dispatcher;
 
-	/** @var IUserManager */
-	private $userManager;
-
-	public function __construct(IEventDispatcher $dispatcher, IUserManager $userManager) {
-		$this->dispatcher = $dispatcher;
-		$this->userManager = $userManager;
+	public function __construct(
+		private IEventDispatcher $dispatcher,
+		private IUserManager $userManager,
+	) {
 	}
 
 	public function handle(Event $event): void {
-		if (!($event instanceof LoginFailed)) {
+		if (!$event instanceof LoginFailed) {
 			return;
 		}
 
diff --git a/lib/private/Authentication/Listeners/RemoteWipeActivityListener.php b/lib/private/Authentication/Listeners/RemoteWipeActivityListener.php
index 457630eff27..c68ea4529f7 100644
--- a/lib/private/Authentication/Listeners/RemoteWipeActivityListener.php
+++ b/lib/private/Authentication/Listeners/RemoteWipeActivityListener.php
@@ -21,16 +21,11 @@ use Psr\Log\LoggerInterface;
  * @template-implements IEventListener<\OC\Authentication\Events\ARemoteWipeEvent>
  */
 class RemoteWipeActivityListener implements IEventListener {
-	/** @var IActvityManager */
-	private $activityManager;
 
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(IActvityManager $activityManager,
-		LoggerInterface $logger) {
-		$this->activityManager = $activityManager;
-		$this->logger = $logger;
+	public function __construct(
+		private IActvityManager $activityManager,
+		private LoggerInterface $logger,
+	) {
 	}
 
 	public function handle(Event $event): void {
@@ -42,11 +37,12 @@ class RemoteWipeActivityListener implements IEventListener {
 	}
 
 	private function publishActivity(string $event, IToken $token): void {
+		$tokenId = $token->getUID();
 		$activity = $this->activityManager->generateEvent();
 		$activity->setApp('core')
 			->setType('security')
-			->setAuthor($token->getUID())
-			->setAffectedUser($token->getUID())
+			->setAuthor($tokenId)
+			->setAffectedUser($tokenId)
 			->setSubject($event, [
 				'name' => $token->getName(),
 			]);
diff --git a/lib/private/Authentication/Listeners/RemoteWipeEmailListener.php b/lib/private/Authentication/Listeners/RemoteWipeEmailListener.php
index 96878c44123..f5a733dc41c 100644
--- a/lib/private/Authentication/Listeners/RemoteWipeEmailListener.php
+++ b/lib/private/Authentication/Listeners/RemoteWipeEmailListener.php
@@ -26,26 +26,17 @@ use function substr;
  * @template-implements IEventListener<\OC\Authentication\Events\ARemoteWipeEvent>
  */
 class RemoteWipeEmailListener implements IEventListener {
-	/** @var IMailer */
-	private $mailer;
-
-	/** @var IUserManager */
-	private $userManager;
 
 	/** @var IL10N */
 	private $l10n;
 
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(IMailer $mailer,
-		IUserManager $userManager,
+	public function __construct(
+		private IMailer $mailer,
+		private IUserManager $userManager,
 		IL10nFactory $l10nFactory,
-		LoggerInterface $logger) {
-		$this->mailer = $mailer;
-		$this->userManager = $userManager;
+		private LoggerInterface $logger,
+	) {
 		$this->l10n = $l10nFactory->get('core');
-		$this->logger = $logger;
 	}
 
 	/**
diff --git a/lib/private/Authentication/Listeners/RemoteWipeNotificationsListener.php b/lib/private/Authentication/Listeners/RemoteWipeNotificationsListener.php
index 5781c1edf16..29d02969c63 100644
--- a/lib/private/Authentication/Listeners/RemoteWipeNotificationsListener.php
+++ b/lib/private/Authentication/Listeners/RemoteWipeNotificationsListener.php
@@ -20,16 +20,11 @@ use OCP\Notification\IManager as INotificationManager;
  * @template-implements IEventListener<\OC\Authentication\Events\ARemoteWipeEvent>
  */
 class RemoteWipeNotificationsListener implements IEventListener {
-	/** @var INotificationManager */
-	private $notificationManager;
 
-	/** @var ITimeFactory */
-	private $timeFactory;
-
-	public function __construct(INotificationManager $notificationManager,
-		ITimeFactory $timeFactory) {
-		$this->notificationManager = $notificationManager;
-		$this->timeFactory = $timeFactory;
+	public function __construct(
+		private INotificationManager $notificationManager,
+		private ITimeFactory $timeFactory,
+	) {
 	}
 
 	public function handle(Event $event): void {
diff --git a/lib/private/Authentication/Listeners/UserDeletedStoreCleanupListener.php b/lib/private/Authentication/Listeners/UserDeletedStoreCleanupListener.php
index 5f21c640780..5b46fde4bcf 100644
--- a/lib/private/Authentication/Listeners/UserDeletedStoreCleanupListener.php
+++ b/lib/private/Authentication/Listeners/UserDeletedStoreCleanupListener.php
@@ -17,15 +17,14 @@ use OCP\User\Events\UserDeletedEvent;
  * @template-implements IEventListener<\OCP\User\Events\UserDeletedEvent>
  */
 class UserDeletedStoreCleanupListener implements IEventListener {
-	/** @var Registry */
-	private $registry;
 
-	public function __construct(Registry $registry) {
-		$this->registry = $registry;
+	public function __construct(
+		private Registry $registry,
+	) {
 	}
 
 	public function handle(Event $event): void {
-		if (!($event instanceof UserDeletedEvent)) {
+		if (!$event instanceof UserDeletedEvent) {
 			return;
 		}
 
diff --git a/lib/private/Authentication/Listeners/UserDeletedTokenCleanupListener.php b/lib/private/Authentication/Listeners/UserDeletedTokenCleanupListener.php
index 3631c04432c..f78561b5b19 100644
--- a/lib/private/Authentication/Listeners/UserDeletedTokenCleanupListener.php
+++ b/lib/private/Authentication/Listeners/UserDeletedTokenCleanupListener.php
@@ -19,20 +19,15 @@ use Throwable;
  * @template-implements IEventListener<\OCP\User\Events\UserDeletedEvent>
  */
 class UserDeletedTokenCleanupListener implements IEventListener {
-	/** @var Manager */
-	private $manager;
 
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(Manager $manager,
-		LoggerInterface $logger) {
-		$this->manager = $manager;
-		$this->logger = $logger;
+	public function __construct(
+		private Manager $manager,
+		private LoggerInterface $logger,
+	) {
 	}
 
 	public function handle(Event $event): void {
-		if (!($event instanceof UserDeletedEvent)) {
+		if (!$event instanceof UserDeletedEvent) {
 			// Unrelated
 			return;
 		}
diff --git a/lib/private/Authentication/Listeners/UserDeletedWebAuthnCleanupListener.php b/lib/private/Authentication/Listeners/UserDeletedWebAuthnCleanupListener.php
index 67f8ff7cfcd..7ea66ff7082 100644
--- a/lib/private/Authentication/Listeners/UserDeletedWebAuthnCleanupListener.php
+++ b/lib/private/Authentication/Listeners/UserDeletedWebAuthnCleanupListener.php
@@ -16,18 +16,17 @@ use OCP\User\Events\UserDeletedEvent;
 
 /** @template-implements IEventListener<UserDeletedEvent> */
 class UserDeletedWebAuthnCleanupListener implements IEventListener {
-	/** @var PublicKeyCredentialMapper */
-	private $credentialMapper;
 
-	public function __construct(PublicKeyCredentialMapper $credentialMapper) {
-		$this->credentialMapper = $credentialMapper;
+	public function __construct(
+		private PublicKeyCredentialMapper $credentialMapper,
+	) {
 	}
 
 	public function handle(Event $event): void {
-		if (!($event instanceof UserDeletedEvent)) {
+		if (!$event instanceof UserDeletedEvent) {
 			return;
 		}
-
-		$this->credentialMapper->deleteByUid($event->getUser()->getUID());
+		$uid = $event->getUser()->getUID();
+		$this->credentialMapper->deleteByUid($uid);
 	}
 }
diff --git a/lib/private/Authentication/Listeners/UserLoggedInListener.php b/lib/private/Authentication/Listeners/UserLoggedInListener.php
index a8d4baeafa1..ee1482f68a5 100644
--- a/lib/private/Authentication/Listeners/UserLoggedInListener.php
+++ b/lib/private/Authentication/Listeners/UserLoggedInListener.php
@@ -17,15 +17,14 @@ use OCP\User\Events\PostLoginEvent;
  * @template-implements IEventListener<\OCP\User\Events\PostLoginEvent>
  */
 class UserLoggedInListener implements IEventListener {
-	/** @var Manager */
-	private $manager;
 
-	public function __construct(Manager $manager) {
-		$this->manager = $manager;
+	public function __construct(
+		private Manager $manager,
+	) {
 	}
 
 	public function handle(Event $event): void {
-		if (!($event instanceof PostLoginEvent)) {
+		if (!$event instanceof PostLoginEvent) {
 			return;
 		}
 
@@ -39,6 +38,7 @@ class UserLoggedInListener implements IEventListener {
 			return;
 		}
 
-		$this->manager->updatePasswords($event->getUser()->getUID(), $event->getPassword());
+		$uid = $event->getUser()->getUID();
+		$this->manager->updatePasswords($uid, $event->getPassword());
 	}
 }
diff --git a/lib/private/Authentication/Login/ALoginCommand.php b/lib/private/Authentication/Login/ALoginCommand.php
index a9f51f0da9e..16b92922dcf 100644
--- a/lib/private/Authentication/Login/ALoginCommand.php
+++ b/lib/private/Authentication/Login/ALoginCommand.php
@@ -20,9 +20,8 @@ abstract class ALoginCommand {
 	protected function processNextOrFinishSuccessfully(LoginData $loginData): LoginResult {
 		if ($this->next !== null) {
 			return $this->next->process($loginData);
-		} else {
-			return LoginResult::success($loginData);
 		}
+		return LoginResult::success($loginData);
 	}
 
 	abstract public function process(LoginData $loginData): LoginResult;
diff --git a/lib/private/Authentication/Login/Chain.php b/lib/private/Authentication/Login/Chain.php
index 3cba396afdd..ebd19058e48 100644
--- a/lib/private/Authentication/Login/Chain.php
+++ b/lib/private/Authentication/Login/Chain.php
@@ -9,67 +9,21 @@ declare(strict_types=1);
 namespace OC\Authentication\Login;
 
 class Chain {
-	/** @var PreLoginHookCommand */
-	private $preLoginHookCommand;
 
-	/** @var UserDisabledCheckCommand */
-	private $userDisabledCheckCommand;
-
-	/** @var UidLoginCommand */
-	private $uidLoginCommand;
-
-	/** @var EmailLoginCommand */
-	private $emailLoginCommand;
-
-	/** @var LoggedInCheckCommand */
-	private $loggedInCheckCommand;
-
-	/** @var CompleteLoginCommand */
-	private $completeLoginCommand;
-
-	/** @var CreateSessionTokenCommand */
-	private $createSessionTokenCommand;
-
-	/** @var ClearLostPasswordTokensCommand */
-	private $clearLostPasswordTokensCommand;
-
-	/** @var UpdateLastPasswordConfirmCommand */
-	private $updateLastPasswordConfirmCommand;
-
-	/** @var SetUserTimezoneCommand */
-	private $setUserTimezoneCommand;
-
-	/** @var TwoFactorCommand */
-	private $twoFactorCommand;
-
-	/** @var FinishRememberedLoginCommand */
-	private $finishRememberedLoginCommand;
-
-	public function __construct(PreLoginHookCommand $preLoginHookCommand,
-		UserDisabledCheckCommand $userDisabledCheckCommand,
-		UidLoginCommand $uidLoginCommand,
-		EmailLoginCommand $emailLoginCommand,
-		LoggedInCheckCommand $loggedInCheckCommand,
-		CompleteLoginCommand $completeLoginCommand,
-		CreateSessionTokenCommand $createSessionTokenCommand,
-		ClearLostPasswordTokensCommand $clearLostPasswordTokensCommand,
-		UpdateLastPasswordConfirmCommand $updateLastPasswordConfirmCommand,
-		SetUserTimezoneCommand $setUserTimezoneCommand,
-		TwoFactorCommand $twoFactorCommand,
-		FinishRememberedLoginCommand $finishRememberedLoginCommand,
+	public function __construct(
+		private PreLoginHookCommand $preLoginHookCommand,
+		private UserDisabledCheckCommand $userDisabledCheckCommand,
+		private UidLoginCommand $uidLoginCommand,
+		private EmailLoginCommand $emailLoginCommand,
+		private LoggedInCheckCommand $loggedInCheckCommand,
+		private CompleteLoginCommand $completeLoginCommand,
+		private CreateSessionTokenCommand $createSessionTokenCommand,
+		private ClearLostPasswordTokensCommand $clearLostPasswordTokensCommand,
+		private UpdateLastPasswordConfirmCommand $updateLastPasswordConfirmCommand,
+		private SetUserTimezoneCommand $setUserTimezoneCommand,
+		private TwoFactorCommand $twoFactorCommand,
+		private FinishRememberedLoginCommand $finishRememberedLoginCommand,
 	) {
-		$this->preLoginHookCommand = $preLoginHookCommand;
-		$this->userDisabledCheckCommand = $userDisabledCheckCommand;
-		$this->uidLoginCommand = $uidLoginCommand;
-		$this->emailLoginCommand = $emailLoginCommand;
-		$this->loggedInCheckCommand = $loggedInCheckCommand;
-		$this->completeLoginCommand = $completeLoginCommand;
-		$this->createSessionTokenCommand = $createSessionTokenCommand;
-		$this->clearLostPasswordTokensCommand = $clearLostPasswordTokensCommand;
-		$this->updateLastPasswordConfirmCommand = $updateLastPasswordConfirmCommand;
-		$this->setUserTimezoneCommand = $setUserTimezoneCommand;
-		$this->twoFactorCommand = $twoFactorCommand;
-		$this->finishRememberedLoginCommand = $finishRememberedLoginCommand;
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/ClearLostPasswordTokensCommand.php b/lib/private/Authentication/Login/ClearLostPasswordTokensCommand.php
index 40369c383ac..6e1c4a02387 100644
--- a/lib/private/Authentication/Login/ClearLostPasswordTokensCommand.php
+++ b/lib/private/Authentication/Login/ClearLostPasswordTokensCommand.php
@@ -11,11 +11,10 @@ namespace OC\Authentication\Login;
 use OCP\IConfig;
 
 class ClearLostPasswordTokensCommand extends ALoginCommand {
-	/** @var IConfig */
-	private $config;
 
-	public function __construct(IConfig $config) {
-		$this->config = $config;
+	public function __construct(
+		private IConfig $config,
+	) {
 	}
 
 	/**
diff --git a/lib/private/Authentication/Login/CompleteLoginCommand.php b/lib/private/Authentication/Login/CompleteLoginCommand.php
index ec6fdf75f40..1e622a5f682 100644
--- a/lib/private/Authentication/Login/CompleteLoginCommand.php
+++ b/lib/private/Authentication/Login/CompleteLoginCommand.php
@@ -11,11 +11,10 @@ namespace OC\Authentication\Login;
 use OC\User\Session;
 
 class CompleteLoginCommand extends ALoginCommand {
-	/** @var Session */
-	private $userSession;
 
-	public function __construct(Session $userSession) {
-		$this->userSession = $userSession;
+	public function __construct(
+		private Session $userSession,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/CreateSessionTokenCommand.php b/lib/private/Authentication/Login/CreateSessionTokenCommand.php
index 7619ad90d93..3dd4c633b28 100644
--- a/lib/private/Authentication/Login/CreateSessionTokenCommand.php
+++ b/lib/private/Authentication/Login/CreateSessionTokenCommand.php
@@ -13,16 +13,11 @@ use OC\User\Session;
 use OCP\IConfig;
 
 class CreateSessionTokenCommand extends ALoginCommand {
-	/** @var IConfig */
-	private $config;
 
-	/** @var Session */
-	private $userSession;
-
-	public function __construct(IConfig $config,
-		Session $userSession) {
-		$this->config = $config;
-		$this->userSession = $userSession;
+	public function __construct(
+		private IConfig $config,
+		private Session $userSession,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
@@ -32,28 +27,29 @@ class CreateSessionTokenCommand extends ALoginCommand {
 			$tokenType = IToken::DO_NOT_REMEMBER;
 		}
 
+		$userId = $loginData->getUser()->getUID();
 		if ($loginData->getPassword() === '') {
 			$this->userSession->createSessionToken(
 				$loginData->getRequest(),
-				$loginData->getUser()->getUID(),
+				$userId,
 				$loginData->getUsername(),
 				null,
 				$tokenType
 			);
 			$this->userSession->updateTokens(
-				$loginData->getUser()->getUID(),
+				$userId,
 				''
 			);
 		} else {
 			$this->userSession->createSessionToken(
 				$loginData->getRequest(),
-				$loginData->getUser()->getUID(),
+				$userId,
 				$loginData->getUsername(),
 				$loginData->getPassword(),
 				$tokenType
 			);
 			$this->userSession->updateTokens(
-				$loginData->getUser()->getUID(),
+				$userId,
 				$loginData->getPassword()
 			);
 		}
diff --git a/lib/private/Authentication/Login/EmailLoginCommand.php b/lib/private/Authentication/Login/EmailLoginCommand.php
index 96cb39277fd..35124b42e0e 100644
--- a/lib/private/Authentication/Login/EmailLoginCommand.php
+++ b/lib/private/Authentication/Login/EmailLoginCommand.php
@@ -11,11 +11,10 @@ namespace OC\Authentication\Login;
 use OCP\IUserManager;
 
 class EmailLoginCommand extends ALoginCommand {
-	/** @var IUserManager */
-	private $userManager;
 
-	public function __construct(IUserManager $userManager) {
-		$this->userManager = $userManager;
+	public function __construct(
+		private IUserManager $userManager,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/FinishRememberedLoginCommand.php b/lib/private/Authentication/Login/FinishRememberedLoginCommand.php
index 3eb1f8f1a65..ae2fb17afdc 100644
--- a/lib/private/Authentication/Login/FinishRememberedLoginCommand.php
+++ b/lib/private/Authentication/Login/FinishRememberedLoginCommand.php
@@ -12,14 +12,11 @@ use OC\User\Session;
 use OCP\IConfig;
 
 class FinishRememberedLoginCommand extends ALoginCommand {
-	/** @var Session */
-	private $userSession;
-	/** @var IConfig */
-	private $config;
 
-	public function __construct(Session $userSession, IConfig $config) {
-		$this->userSession = $userSession;
-		$this->config = $config;
+	public function __construct(
+		private Session $userSession,
+		private IConfig $config,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/LoggedInCheckCommand.php b/lib/private/Authentication/Login/LoggedInCheckCommand.php
index b6b59ced6ce..e70c13b083e 100644
--- a/lib/private/Authentication/Login/LoggedInCheckCommand.php
+++ b/lib/private/Authentication/Login/LoggedInCheckCommand.php
@@ -14,15 +14,11 @@ use OCP\EventDispatcher\IEventDispatcher;
 use Psr\Log\LoggerInterface;
 
 class LoggedInCheckCommand extends ALoginCommand {
-	/** @var LoggerInterface */
-	private $logger;
-	/** @var IEventDispatcher */
-	private $dispatcher;
-
-	public function __construct(LoggerInterface $logger,
-		IEventDispatcher $dispatcher) {
-		$this->logger = $logger;
-		$this->dispatcher = $dispatcher;
+
+	public function __construct(
+		private LoggerInterface $logger,
+		private IEventDispatcher $dispatcher,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/LoginData.php b/lib/private/Authentication/Login/LoginData.php
index 1ad97a9d559..5713e2ed249 100644
--- a/lib/private/Authentication/Login/LoginData.php
+++ b/lib/private/Authentication/Login/LoginData.php
@@ -12,23 +12,6 @@ use OCP\IRequest;
 use OCP\IUser;
 
 class LoginData {
-	/** @var IRequest */
-	private $request;
-
-	/** @var string */
-	private $username;
-
-	/** @var string */
-	private $password;
-
-	/** @var string */
-	private $redirectUrl;
-
-	/** @var string */
-	private $timeZone;
-
-	/** @var string */
-	private $timeZoneOffset;
 
 	/** @var IUser|false|null */
 	private $user = null;
@@ -36,18 +19,14 @@ class LoginData {
 	/** @var bool */
 	private $rememberLogin = true;
 
-	public function __construct(IRequest $request,
-		string $username,
-		?string $password,
-		?string $redirectUrl = null,
-		string $timeZone = '',
-		string $timeZoneOffset = '') {
-		$this->request = $request;
-		$this->username = $username;
-		$this->password = $password;
-		$this->redirectUrl = $redirectUrl;
-		$this->timeZone = $timeZone;
-		$this->timeZoneOffset = $timeZoneOffset;
+	public function __construct(
+		private IRequest $request,
+		private string $username,
+		private ?string $password,
+		private ?string $redirectUrl = null,
+		private string $timeZone = '',
+		private string $timeZoneOffset = '',
+	) {
 	}
 
 	public function getRequest(): IRequest {
diff --git a/lib/private/Authentication/Login/LoginResult.php b/lib/private/Authentication/Login/LoginResult.php
index 95e87b520e3..a71ff6da555 100644
--- a/lib/private/Authentication/Login/LoginResult.php
+++ b/lib/private/Authentication/Login/LoginResult.php
@@ -11,21 +11,16 @@ namespace OC\Authentication\Login;
 use OC\Core\Controller\LoginController;
 
 class LoginResult {
-	/** @var bool */
-	private $success;
-
-	/** @var LoginData */
-	private $loginData;
-
 	/** @var string|null */
 	private $redirectUrl;
 
 	/** @var string|null */
 	private $errorMessage;
 
-	private function __construct(bool $success, LoginData $loginData) {
-		$this->success = $success;
-		$this->loginData = $loginData;
+	private function __construct(
+		private bool $success,
+		private LoginData $loginData,
+	) {
 	}
 
 	private function setRedirectUrl(string $url) {
diff --git a/lib/private/Authentication/Login/PreLoginHookCommand.php b/lib/private/Authentication/Login/PreLoginHookCommand.php
index d5aa174094d..68319f1cd3b 100644
--- a/lib/private/Authentication/Login/PreLoginHookCommand.php
+++ b/lib/private/Authentication/Login/PreLoginHookCommand.php
@@ -12,11 +12,10 @@ use OC\Hooks\PublicEmitter;
 use OCP\IUserManager;
 
 class PreLoginHookCommand extends ALoginCommand {
-	/** @var IUserManager */
-	private $userManager;
 
-	public function __construct(IUserManager $userManager) {
-		$this->userManager = $userManager;
+	public function __construct(
+		private IUserManager $userManager,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/SetUserTimezoneCommand.php b/lib/private/Authentication/Login/SetUserTimezoneCommand.php
index 90bc444ae7d..ff030d7980b 100644
--- a/lib/private/Authentication/Login/SetUserTimezoneCommand.php
+++ b/lib/private/Authentication/Login/SetUserTimezoneCommand.php
@@ -12,16 +12,11 @@ use OCP\IConfig;
 use OCP\ISession;
 
 class SetUserTimezoneCommand extends ALoginCommand {
-	/** @var IConfig */
-	private $config;
 
-	/** @var ISession */
-	private $session;
-
-	public function __construct(IConfig $config,
-		ISession $session) {
-		$this->config = $config;
-		$this->session = $session;
+	public function __construct(
+		private IConfig $config,
+		private ISession $session,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/TwoFactorCommand.php b/lib/private/Authentication/Login/TwoFactorCommand.php
index fc5285221a2..b19610eb6d6 100644
--- a/lib/private/Authentication/Login/TwoFactorCommand.php
+++ b/lib/private/Authentication/Login/TwoFactorCommand.php
@@ -16,37 +16,29 @@ use function array_pop;
 use function count;
 
 class TwoFactorCommand extends ALoginCommand {
-	/** @var Manager */
-	private $twoFactorManager;
 
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
-
-	/** @var IURLGenerator */
-	private $urlGenerator;
-
-	public function __construct(Manager $twoFactorManager,
-		MandatoryTwoFactor $mandatoryTwoFactor,
-		IURLGenerator $urlGenerator) {
-		$this->twoFactorManager = $twoFactorManager;
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-		$this->urlGenerator = $urlGenerator;
+	public function __construct(
+		private Manager $twoFactorManager,
+		private MandatoryTwoFactor $mandatoryTwoFactor,
+		private IURLGenerator $urlGenerator,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
-		if (!$this->twoFactorManager->isTwoFactorAuthenticated($loginData->getUser())) {
+		$loginDataUser = $loginData->getUser();
+		if (!$this->twoFactorManager->isTwoFactorAuthenticated($loginDataUser)) {
 			return $this->processNextOrFinishSuccessfully($loginData);
 		}
 
-		$this->twoFactorManager->prepareTwoFactorLogin($loginData->getUser(), $loginData->isRememberLogin());
+		$this->twoFactorManager->prepareTwoFactorLogin($loginDataUser, $loginData->isRememberLogin());
 
-		$providerSet = $this->twoFactorManager->getProviderSet($loginData->getUser());
-		$loginProviders = $this->twoFactorManager->getLoginSetupProviders($loginData->getUser());
+		$providerSet = $this->twoFactorManager->getProviderSet($loginDataUser);
+		$loginProviders = $this->twoFactorManager->getLoginSetupProviders($loginDataUser);
 		$providers = $providerSet->getPrimaryProviders();
 		if (empty($providers)
 			&& !$providerSet->isProviderMissing()
 			&& !empty($loginProviders)
-			&& $this->mandatoryTwoFactor->isEnforcedFor($loginData->getUser())) {
+			&& $this->mandatoryTwoFactor->isEnforcedFor($loginDataUser)) {
 			// No providers set up, but 2FA is enforced and setup providers are available
 			$url = 'core.TwoFactorChallenge.setupProviders';
 			$urlParams = [];
diff --git a/lib/private/Authentication/Login/UidLoginCommand.php b/lib/private/Authentication/Login/UidLoginCommand.php
index 511b5f61e0e..90cb469c3e0 100644
--- a/lib/private/Authentication/Login/UidLoginCommand.php
+++ b/lib/private/Authentication/Login/UidLoginCommand.php
@@ -12,11 +12,10 @@ use OC\User\Manager;
 use OCP\IUser;
 
 class UidLoginCommand extends ALoginCommand {
-	/** @var Manager */
-	private $userManager;
 
-	public function __construct(Manager $userManager) {
-		$this->userManager = $userManager;
+	public function __construct(
+		private Manager $userManager,
+	) {
 	}
 
 	/**
diff --git a/lib/private/Authentication/Login/UpdateLastPasswordConfirmCommand.php b/lib/private/Authentication/Login/UpdateLastPasswordConfirmCommand.php
index 0582239e9de..b9883acca53 100644
--- a/lib/private/Authentication/Login/UpdateLastPasswordConfirmCommand.php
+++ b/lib/private/Authentication/Login/UpdateLastPasswordConfirmCommand.php
@@ -11,11 +11,10 @@ namespace OC\Authentication\Login;
 use OCP\ISession;
 
 class UpdateLastPasswordConfirmCommand extends ALoginCommand {
-	/** @var ISession */
-	private $session;
 
-	public function __construct(ISession $session) {
-		$this->session = $session;
+	public function __construct(
+		private ISession $session,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/UserDisabledCheckCommand.php b/lib/private/Authentication/Login/UserDisabledCheckCommand.php
index 8777aa6dcea..142bf9c6b06 100644
--- a/lib/private/Authentication/Login/UserDisabledCheckCommand.php
+++ b/lib/private/Authentication/Login/UserDisabledCheckCommand.php
@@ -13,16 +13,11 @@ use OCP\IUserManager;
 use Psr\Log\LoggerInterface;
 
 class UserDisabledCheckCommand extends ALoginCommand {
-	/** @var IUserManager */
-	private $userManager;
 
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(IUserManager $userManager,
-		LoggerInterface $logger) {
-		$this->userManager = $userManager;
-		$this->logger = $logger;
+	public function __construct(
+		private IUserManager $userManager,
+		private LoggerInterface $logger,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/WebAuthnChain.php b/lib/private/Authentication/Login/WebAuthnChain.php
index ae523c43da6..49b6a82febc 100644
--- a/lib/private/Authentication/Login/WebAuthnChain.php
+++ b/lib/private/Authentication/Login/WebAuthnChain.php
@@ -9,57 +9,19 @@ declare(strict_types=1);
 namespace OC\Authentication\Login;
 
 class WebAuthnChain {
-	/** @var UserDisabledCheckCommand */
-	private $userDisabledCheckCommand;
 
-	/** @var LoggedInCheckCommand */
-	private $loggedInCheckCommand;
-
-	/** @var CompleteLoginCommand */
-	private $completeLoginCommand;
-
-	/** @var CreateSessionTokenCommand */
-	private $createSessionTokenCommand;
-
-	/** @var ClearLostPasswordTokensCommand */
-	private $clearLostPasswordTokensCommand;
-
-	/** @var UpdateLastPasswordConfirmCommand */
-	private $updateLastPasswordConfirmCommand;
-
-	/** @var SetUserTimezoneCommand */
-	private $setUserTimezoneCommand;
-
-	/** @var TwoFactorCommand */
-	private $twoFactorCommand;
-
-	/** @var FinishRememberedLoginCommand */
-	private $finishRememberedLoginCommand;
-
-	/** @var WebAuthnLoginCommand */
-	private $webAuthnLoginCommand;
-
-	public function __construct(UserDisabledCheckCommand $userDisabledCheckCommand,
-		WebAuthnLoginCommand $webAuthnLoginCommand,
-		LoggedInCheckCommand $loggedInCheckCommand,
-		CompleteLoginCommand $completeLoginCommand,
-		CreateSessionTokenCommand $createSessionTokenCommand,
-		ClearLostPasswordTokensCommand $clearLostPasswordTokensCommand,
-		UpdateLastPasswordConfirmCommand $updateLastPasswordConfirmCommand,
-		SetUserTimezoneCommand $setUserTimezoneCommand,
-		TwoFactorCommand $twoFactorCommand,
-		FinishRememberedLoginCommand $finishRememberedLoginCommand,
+	public function __construct(
+		private UserDisabledCheckCommand $userDisabledCheckCommand,
+		private WebAuthnLoginCommand $webAuthnLoginCommand,
+		private LoggedInCheckCommand $loggedInCheckCommand,
+		private CompleteLoginCommand $completeLoginCommand,
+		private CreateSessionTokenCommand $createSessionTokenCommand,
+		private ClearLostPasswordTokensCommand $clearLostPasswordTokensCommand,
+		private UpdateLastPasswordConfirmCommand $updateLastPasswordConfirmCommand,
+		private SetUserTimezoneCommand $setUserTimezoneCommand,
+		private TwoFactorCommand $twoFactorCommand,
+		private FinishRememberedLoginCommand $finishRememberedLoginCommand,
 	) {
-		$this->userDisabledCheckCommand = $userDisabledCheckCommand;
-		$this->webAuthnLoginCommand = $webAuthnLoginCommand;
-		$this->loggedInCheckCommand = $loggedInCheckCommand;
-		$this->completeLoginCommand = $completeLoginCommand;
-		$this->createSessionTokenCommand = $createSessionTokenCommand;
-		$this->clearLostPasswordTokensCommand = $clearLostPasswordTokensCommand;
-		$this->updateLastPasswordConfirmCommand = $updateLastPasswordConfirmCommand;
-		$this->setUserTimezoneCommand = $setUserTimezoneCommand;
-		$this->twoFactorCommand = $twoFactorCommand;
-		$this->finishRememberedLoginCommand = $finishRememberedLoginCommand;
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/Login/WebAuthnLoginCommand.php b/lib/private/Authentication/Login/WebAuthnLoginCommand.php
index 8f14e5b3f6d..dc9fc9c0ef5 100644
--- a/lib/private/Authentication/Login/WebAuthnLoginCommand.php
+++ b/lib/private/Authentication/Login/WebAuthnLoginCommand.php
@@ -11,11 +11,10 @@ namespace OC\Authentication\Login;
 use OCP\IUserManager;
 
 class WebAuthnLoginCommand extends ALoginCommand {
-	/** @var IUserManager */
-	private $userManager;
 
-	public function __construct(IUserManager $userManager) {
-		$this->userManager = $userManager;
+	public function __construct(
+		private IUserManager $userManager,
+	) {
 	}
 
 	public function process(LoginData $loginData): LoginResult {
diff --git a/lib/private/Authentication/LoginCredentials/Credentials.php b/lib/private/Authentication/LoginCredentials/Credentials.php
index 2d7ed3adfd0..79b3d9cd4b0 100644
--- a/lib/private/Authentication/LoginCredentials/Credentials.php
+++ b/lib/private/Authentication/LoginCredentials/Credentials.php
@@ -1,4 +1,7 @@
 <?php
+
+declare(strict_types=1);
+
 /**
  * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: AGPL-3.0-or-later
@@ -8,44 +11,23 @@ namespace OC\Authentication\LoginCredentials;
 use OCP\Authentication\LoginCredentials\ICredentials;
 
 class Credentials implements ICredentials {
-	/** @var string */
-	private $uid;
-
-	/** @var string */
-	private $loginName;
-
-	/** @var string */
-	private $password;
-
-	/**
-	 * @param string $uid
-	 * @param string $loginName
-	 * @param string $password
-	 */
-	public function __construct($uid, $loginName, $password) {
-		$this->uid = $uid;
-		$this->loginName = $loginName;
-		$this->password = $password;
+
+	public function __construct(
+		private string $uid,
+		private string $loginName,
+		private string $password,
+	) {
 	}
 
-	/**
-	 * @return string
-	 */
-	public function getUID() {
+	public function getUID(): string {
 		return $this->uid;
 	}
 
-	/**
-	 * @return string
-	 */
-	public function getLoginName() {
+	public function getLoginName(): string {
 		return $this->loginName;
 	}
 
-	/**
-	 * @return string
-	 */
-	public function getPassword() {
+	public function getPassword(): string {
 		return $this->password;
 	}
 }
diff --git a/lib/private/Authentication/LoginCredentials/Store.php b/lib/private/Authentication/LoginCredentials/Store.php
index b6f22ce345f..e9db99d51fa 100644
--- a/lib/private/Authentication/LoginCredentials/Store.php
+++ b/lib/private/Authentication/LoginCredentials/Store.php
@@ -22,51 +22,34 @@ use OCP\Util;
 use Psr\Log\LoggerInterface;
 
 class Store implements IStore {
-	/** @var ISession */
-	private $session;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var IProvider|null */
-	private $tokenProvider;
 
 	public function __construct(
-		ISession $session,
-		LoggerInterface $logger,
+		private ISession $session,
+		private LoggerInterface $logger,
 		private readonly ICrypto $crypto,
-		?IProvider $tokenProvider = null,
+		private ?IProvider $tokenProvider = null,
 	) {
-		$this->session = $session;
-		$this->logger = $logger;
-		$this->tokenProvider = $tokenProvider;
-
 		Util::connectHook('OC_User', 'post_login', $this, 'authenticate');
 	}
 
 	/**
 	 * Hook listener on post login
-	 *
-	 * @param array $params
 	 */
-	public function authenticate(array $params) {
+	public function authenticate(array $params): void {
 		$params['password'] = $this->crypto->encrypt((string)$params['password']);
 		$this->session->set('login_credentials', json_encode($params));
 	}
 
 	/**
 	 * Replace the session implementation
-	 *
-	 * @param ISession $session
 	 */
-	public function setSession(ISession $session) {
+	public function setSession(ISession $session): void {
 		$this->session = $session;
 	}
 
 	/**
 	 * @since 12
 	 *
-	 * @return ICredentials the login credentials of the current user
 	 * @throws CredentialsUnavailableException
 	 */
 	public function getLoginCredentials(): ICredentials {
diff --git a/lib/private/Authentication/Notifications/Notifier.php b/lib/private/Authentication/Notifications/Notifier.php
index a81e385d8b1..72326f5bb1c 100644
--- a/lib/private/Authentication/Notifications/Notifier.php
+++ b/lib/private/Authentication/Notifications/Notifier.php
@@ -14,11 +14,10 @@ use OCP\Notification\INotifier;
 use OCP\Notification\UnknownNotificationException;
 
 class Notifier implements INotifier {
-	/** @var IL10nFactory */
-	private $factory;
 
-	public function __construct(IL10nFactory $l10nFactory) {
-		$this->factory = $l10nFactory;
+	public function __construct(
+		private IL10nFactory $l10nFactory,
+	) {
 	}
 
 	/**
@@ -59,7 +58,6 @@ class Notifier implements INotifier {
 	/**
 	 * Identifier of the notifier, only use [a-z0-9_]
 	 *
-	 * @return string
 	 * @since 17.0.0
 	 */
 	public function getID(): string {
@@ -69,7 +67,6 @@ class Notifier implements INotifier {
 	/**
 	 * Human readable name describing the notifier
 	 *
-	 * @return string
 	 * @since 17.0.0
 	 */
 	public function getName(): string {
diff --git a/lib/private/Authentication/Token/IProvider.php b/lib/private/Authentication/Token/IProvider.php
index d47427e79bf..4a30406e76b 100644
--- a/lib/private/Authentication/Token/IProvider.php
+++ b/lib/private/Authentication/Token/IProvider.php
@@ -19,12 +19,7 @@ interface IProvider {
 	/**
 	 * Create and persist a new token
 	 *
-	 * @param string $token
-	 * @param string $uid
-	 * @param string $loginName
-	 * @param string|null $password
 	 * @param string $name Name will be trimmed to 120 chars when longer
-	 * @param int $type token type
 	 * @param int $remember whether the session token should be used for remember-me
 	 * @return OCPIToken
 	 * @throws \RuntimeException when OpenSSL reports a problem
diff --git a/lib/private/Authentication/Token/Manager.php b/lib/private/Authentication/Token/Manager.php
index 6953f47b004..9418f326f4c 100644
--- a/lib/private/Authentication/Token/Manager.php
+++ b/lib/private/Authentication/Token/Manager.php
@@ -1,6 +1,7 @@
 <?php
 
 declare(strict_types=1);
+
 /**
  * SPDX-FileCopyrightText: 2018 Nextcloud GmbH and Nextcloud contributors
  * SPDX-License-Identifier: AGPL-3.0-or-later
@@ -17,29 +18,23 @@ use OCP\Authentication\Token\IProvider as OCPIProvider;
 use OCP\Authentication\Token\IToken as OCPIToken;
 
 class Manager implements IProvider, OCPIProvider {
-	/** @var PublicKeyTokenProvider */
-	private $publicKeyTokenProvider;
 
-	public function __construct(PublicKeyTokenProvider $publicKeyTokenProvider) {
-		$this->publicKeyTokenProvider = $publicKeyTokenProvider;
+	public function __construct(
+		private PublicKeyTokenProvider $publicKeyTokenProvider,
+	) {
 	}
 
 	/**
 	 * Create and persist a new token
 	 *
-	 * @param string $token
-	 * @param string $uid
-	 * @param string $loginName
-	 * @param string|null $password
 	 * @param string $name Name will be trimmed to 120 chars when longer
-	 * @param int $type token type
 	 * @param int $remember whether the session token should be used for remember-me
 	 * @return OCPIToken
 	 */
 	public function generateToken(string $token,
 		string $uid,
 		string $loginName,
-		$password,
+		?string $password,
 		string $name,
 		int $type = OCPIToken::TEMPORARY_TOKEN,
 		int $remember = OCPIToken::DO_NOT_REMEMBER,
@@ -81,7 +76,7 @@ class Manager implements IProvider, OCPIProvider {
 	 * @param OCPIToken $token
 	 * @throws InvalidTokenException
 	 */
-	public function updateToken(OCPIToken $token) {
+	public function updateToken(OCPIToken $token): void {
 		$provider = $this->getProvider($token);
 		$provider->updateToken($token);
 	}
@@ -92,7 +87,7 @@ class Manager implements IProvider, OCPIProvider {
 	 * @throws InvalidTokenException
 	 * @param OCPIToken $token
 	 */
-	public function updateTokenActivity(OCPIToken $token) {
+	public function updateTokenActivity(OCPIToken $token): void {
 		$provider = $this->getProvider($token);
 		$provider->updateTokenActivity($token);
 	}
@@ -108,10 +103,8 @@ class Manager implements IProvider, OCPIProvider {
 	/**
 	 * Get a token by token
 	 *
-	 * @param string $tokenId
 	 * @throws InvalidTokenException
 	 * @throws \RuntimeException when OpenSSL reports a problem
-	 * @return OCPIToken
 	 */
 	public function getToken(string $tokenId): OCPIToken {
 		try {
@@ -128,9 +121,7 @@ class Manager implements IProvider, OCPIProvider {
 	/**
 	 * Get a token by token id
 	 *
-	 * @param int $tokenId
 	 * @throws InvalidTokenException
-	 * @return OCPIToken
 	 */
 	public function getTokenById(int $tokenId): OCPIToken {
 		try {
@@ -145,10 +136,7 @@ class Manager implements IProvider, OCPIProvider {
 	}
 
 	/**
-	 * @param string $oldSessionId
-	 * @param string $sessionId
 	 * @throws InvalidTokenException
-	 * @return OCPIToken
 	 */
 	public function renewSessionToken(string $oldSessionId, string $sessionId): OCPIToken {
 		try {
@@ -161,31 +149,28 @@ class Manager implements IProvider, OCPIProvider {
 	}
 
 	/**
-	 * @param OCPIToken $savedToken
-	 * @param string $tokenId session token
 	 * @throws InvalidTokenException
 	 * @throws PasswordlessTokenException
-	 * @return string
 	 */
 	public function getPassword(OCPIToken $savedToken, string $tokenId): string {
 		$provider = $this->getProvider($savedToken);
 		return $provider->getPassword($savedToken, $tokenId);
 	}
 
-	public function setPassword(OCPIToken $token, string $tokenId, string $password) {
+	public function setPassword(OCPIToken $token, string $tokenId, string $password): void {
 		$provider = $this->getProvider($token);
 		$provider->setPassword($token, $tokenId, $password);
 	}
 
-	public function invalidateToken(string $token) {
+	public function invalidateToken(string $token): void {
 		$this->publicKeyTokenProvider->invalidateToken($token);
 	}
 
-	public function invalidateTokenById(string $uid, int $id) {
+	public function invalidateTokenById(string $uid, int $id): void {
 		$this->publicKeyTokenProvider->invalidateTokenById($uid, $id);
 	}
 
-	public function invalidateOldTokens() {
+	public function invalidateOldTokens(): void {
 		$this->publicKeyTokenProvider->invalidateOldTokens();
 	}
 
@@ -194,10 +179,6 @@ class Manager implements IProvider, OCPIProvider {
 	}
 
 	/**
-	 * @param OCPIToken $token
-	 * @param string $oldTokenId
-	 * @param string $newTokenId
-	 * @return OCPIToken
 	 * @throws InvalidTokenException
 	 * @throws \RuntimeException when OpenSSL reports a problem
 	 */
@@ -211,8 +192,6 @@ class Manager implements IProvider, OCPIProvider {
 	}
 
 	/**
-	 * @param OCPIToken $token
-	 * @return IProvider
 	 * @throws InvalidTokenException
 	 */
 	private function getProvider(OCPIToken $token): IProvider {
@@ -224,15 +203,15 @@ class Manager implements IProvider, OCPIProvider {
 	}
 
 
-	public function markPasswordInvalid(OCPIToken $token, string $tokenId) {
+	public function markPasswordInvalid(OCPIToken $token, string $tokenId): void {
 		$this->getProvider($token)->markPasswordInvalid($token, $tokenId);
 	}
 
-	public function updatePasswords(string $uid, string $password) {
+	public function updatePasswords(string $uid, string $password): void {
 		$this->publicKeyTokenProvider->updatePasswords($uid, $password);
 	}
 
-	public function invalidateTokensOfUser(string $uid, ?string $clientName) {
+	public function invalidateTokensOfUser(string $uid, ?string $clientName): void {
 		$tokens = $this->getTokenByUser($uid);
 		foreach ($tokens as $token) {
 			if ($clientName === null || ($token->getName() === $clientName)) {
diff --git a/lib/private/Authentication/Token/PublicKeyToken.php b/lib/private/Authentication/Token/PublicKeyToken.php
index be427ab4839..3a3b457839e 100644
--- a/lib/private/Authentication/Token/PublicKeyToken.php
+++ b/lib/private/Authentication/Token/PublicKeyToken.php
@@ -111,8 +111,6 @@ class PublicKeyToken extends Entity implements INamedToken, IWipeableToken {
 
 	/**
 	 * Get the login name used when generating the token
-	 *
-	 * @return string
 	 */
 	public function getLoginName(): string {
 		return parent::getLoginName();
@@ -137,8 +135,6 @@ class PublicKeyToken extends Entity implements INamedToken, IWipeableToken {
 
 	/**
 	 * Get the timestamp of the last password check
-	 *
-	 * @return int
 	 */
 	public function getLastCheck(): int {
 		return parent::getLastCheck();
@@ -202,14 +198,11 @@ class PublicKeyToken extends Entity implements INamedToken, IWipeableToken {
 		parent::setExpires($expires);
 	}
 
-	/**
-	 * @return int|null
-	 */
-	public function getExpires() {
+	public function getExpires(): ?int {
 		return parent::getExpires();
 	}
 
-	public function setPasswordInvalid(bool $invalid) {
+	public function setPasswordInvalid(bool $invalid): void {
 		parent::setPasswordInvalid($invalid);
 	}
 
diff --git a/lib/private/Authentication/Token/PublicKeyTokenMapper.php b/lib/private/Authentication/Token/PublicKeyTokenMapper.php
index 9aabd69e57a..cd9a57f4478 100644
--- a/lib/private/Authentication/Token/PublicKeyTokenMapper.php
+++ b/lib/private/Authentication/Token/PublicKeyTokenMapper.php
@@ -25,7 +25,7 @@ class PublicKeyTokenMapper extends QBMapper {
 	/**
 	 * Invalidate (delete) a given token
 	 */
-	public function invalidate(string $token) {
+	public function invalidate(string $token): void {
 		/* @var $qb IQueryBuilder */
 		$qb = $this->db->getQueryBuilder();
 		$qb->delete($this->tableName)
@@ -34,12 +34,7 @@ class PublicKeyTokenMapper extends QBMapper {
 			->executeStatement();
 	}
 
-	/**
-	 * @param int $olderThan
-	 * @param int $type
-	 * @param int|null $remember
-	 */
-	public function invalidateOld(int $olderThan, int $type = IToken::TEMPORARY_TOKEN, ?int $remember = null) {
+	public function invalidateOld(int $olderThan, int $type = IToken::TEMPORARY_TOKEN, ?int $remember = null): void {
 		/* @var $qb IQueryBuilder */
 		$qb = $this->db->getQueryBuilder();
 		$delete = $qb->delete($this->tableName)
@@ -146,10 +141,8 @@ class PublicKeyTokenMapper extends QBMapper {
 
 	/**
 	 * delete all auth token which belong to a specific client if the client was deleted
-	 *
-	 * @param string $name
 	 */
-	public function deleteByName(string $name) {
+	public function deleteByName(string $name): void {
 		$qb = $this->db->getQueryBuilder();
 		$qb->delete($this->tableName)
 			->where($qb->expr()->eq('name', $qb->createNamedParameter($name), IQueryBuilder::PARAM_STR))
@@ -157,7 +150,7 @@ class PublicKeyTokenMapper extends QBMapper {
 		$qb->executeStatement();
 	}
 
-	public function deleteTempToken(PublicKeyToken $except) {
+	public function deleteTempToken(PublicKeyToken $except): void {
 		$qb = $this->db->getQueryBuilder();
 
 		$qb->delete($this->tableName)
@@ -165,7 +158,6 @@ class PublicKeyTokenMapper extends QBMapper {
 			->andWhere($qb->expr()->eq('type', $qb->createNamedParameter(IToken::TEMPORARY_TOKEN)))
 			->andWhere($qb->expr()->neq('id', $qb->createNamedParameter($except->getId())))
 			->andWhere($qb->expr()->eq('version', $qb->createNamedParameter(PublicKeyToken::VERSION, IQueryBuilder::PARAM_INT)));
-
 		$qb->executeStatement();
 	}
 
diff --git a/lib/private/Authentication/Token/PublicKeyTokenProvider.php b/lib/private/Authentication/Token/PublicKeyTokenProvider.php
index 12c3a1d535b..67f8cc6475b 100644
--- a/lib/private/Authentication/Token/PublicKeyTokenProvider.php
+++ b/lib/private/Authentication/Token/PublicKeyTokenProvider.php
@@ -32,48 +32,22 @@ class PublicKeyTokenProvider implements IProvider {
 
 	use TTransactional;
 
-	/** @var PublicKeyTokenMapper */
-	private $mapper;
-
-	/** @var ICrypto */
-	private $crypto;
-
-	/** @var IConfig */
-	private $config;
-
-	private IDBConnection $db;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var ITimeFactory */
-	private $time;
-
 	/** @var ICache */
 	private $cache;
 
-	/** @var IHasher */
-	private $hasher;
-
-	public function __construct(PublicKeyTokenMapper $mapper,
-		ICrypto $crypto,
-		IConfig $config,
-		IDBConnection $db,
-		LoggerInterface $logger,
-		ITimeFactory $time,
-		IHasher $hasher,
-		ICacheFactory $cacheFactory) {
-		$this->mapper = $mapper;
-		$this->crypto = $crypto;
-		$this->config = $config;
-		$this->db = $db;
-		$this->logger = $logger;
-		$this->time = $time;
-
+	public function __construct(
+		private PublicKeyTokenMapper $mapper,
+		private ICrypto $crypto,
+		private IConfig $config,
+		private IDBConnection $db,
+		private LoggerInterface $logger,
+		private ITimeFactory $time,
+		private IHasher $hasher,
+		private ICacheFactory $cacheFactory,
+	) {
 		$this->cache = $cacheFactory->isLocalCacheAvailable()
 			? $cacheFactory->createLocal('authtoken_')
 			: $cacheFactory->createInMemory();
-		$this->hasher = $hasher;
 	}
 
 	/**
@@ -176,11 +150,7 @@ class PublicKeyTokenProvider implements IProvider {
 	 */
 	private function getTokenFromCache(string $tokenHash): ?PublicKeyToken {
 		$serializedToken = $this->cache->get($tokenHash);
-		if ($serializedToken === false) {
-			return null;
-		}
-
-		if ($serializedToken === null) {
+		if ($serializedToken === false || $serializedToken === null) {
 			return null;
 		}
 
@@ -200,6 +170,9 @@ class PublicKeyTokenProvider implements IProvider {
 		$this->cache->set($tokenHash, false, self::TOKEN_CACHE_TTL * 2);
 	}
 
+	/**
+	 * @throws InvalidTokenException when token doesn't exist
+	 */
 	public function getTokenById(int $tokenId): OCPIToken {
 		try {
 			$token = $this->mapper->getTokenById($tokenId);
@@ -212,6 +185,11 @@ class PublicKeyTokenProvider implements IProvider {
 		return $token;
 	}
 
+	/**
+	 * @throws ExpiredTokenException
+	 * @throws WipeTokenException
+	 * @throws TokenPasswordExpiredException
+	 */
 	private function checkToken($token): void {
 		if ((int)$token->getExpires() !== 0 && $token->getExpires() < $this->time->getTime()) {
 			throw new ExpiredTokenException($token);
@@ -227,11 +205,14 @@ class PublicKeyTokenProvider implements IProvider {
 		}
 	}
 
+	/**
+	 * @throws InvalidTokenException
+	 */
 	public function renewSessionToken(string $oldSessionId, string $sessionId): OCPIToken {
 		return $this->atomic(function () use ($oldSessionId, $sessionId) {
 			$token = $this->getToken($oldSessionId);
 
-			if (!($token instanceof PublicKeyToken)) {
+			if (!$token instanceof PublicKeyToken) {
 				throw new InvalidTokenException('Invalid token type');
 			}
 
@@ -261,24 +242,25 @@ class PublicKeyTokenProvider implements IProvider {
 		}, $this->db);
 	}
 
-	public function invalidateToken(string $token) {
+	public function invalidateToken(string $token): void {
 		$tokenHash = $this->hashToken($token);
 		$this->mapper->invalidate($this->hashToken($token));
 		$this->mapper->invalidate($this->hashTokenWithEmptySecret($token));
 		$this->cacheInvalidHash($tokenHash);
 	}
 
-	public function invalidateTokenById(string $uid, int $id) {
+	public function invalidateTokenById(string $uid, int $id): void {
 		$token = $this->mapper->getTokenById($id);
 		if ($token->getUID() !== $uid) {
 			return;
 		}
-		$this->mapper->invalidate($token->getToken());
-		$this->cacheInvalidHash($token->getToken());
+		$tokenId = $token->getToken();
+		$this->mapper->invalidate($tokenId);
+		$this->cacheInvalidHash($tokenId);
 
 	}
 
-	public function invalidateOldTokens() {
+	public function invalidateOldTokens(): void {
 		$olderThan = $this->time->getTime() - $this->config->getSystemValueInt('session_lifetime', 60 * 60 * 24);
 		$this->logger->debug('Invalidating session tokens older than ' . date('c', $olderThan), ['app' => 'cron']);
 		$this->mapper->invalidateOld($olderThan, OCPIToken::TEMPORARY_TOKEN, OCPIToken::DO_NOT_REMEMBER);
@@ -300,16 +282,22 @@ class PublicKeyTokenProvider implements IProvider {
 		$this->mapper->invalidateLastUsedBefore($uid, $before);
 	}
 
-	public function updateToken(OCPIToken $token) {
-		if (!($token instanceof PublicKeyToken)) {
+	/**
+	 * @throws InvalidTokenException
+	 */
+	public function updateToken(OCPIToken $token): void {
+		if (!$token instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 		$this->mapper->update($token);
 		$this->cacheToken($token);
 	}
 
-	public function updateTokenActivity(OCPIToken $token) {
-		if (!($token instanceof PublicKeyToken)) {
+	/**
+	 * @throws InvalidTokenException
+	 */
+	public function updateTokenActivity(OCPIToken $token): void {
+		if (!$token instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 
@@ -329,8 +317,12 @@ class PublicKeyTokenProvider implements IProvider {
 		return $this->mapper->getTokenByUser($uid);
 	}
 
+	/**
+	 * @throws InvalidTokenException
+	 * @throws PasswordlessTokenException
+	 */
 	public function getPassword(OCPIToken $savedToken, string $tokenId): string {
-		if (!($savedToken instanceof PublicKeyToken)) {
+		if (!$savedToken instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 
@@ -345,8 +337,11 @@ class PublicKeyTokenProvider implements IProvider {
 		return $this->decryptPassword($savedToken->getPassword(), $privateKey);
 	}
 
-	public function setPassword(OCPIToken $token, string $tokenId, string $password) {
-		if (!($token instanceof PublicKeyToken)) {
+	/**
+	 * @throws InvalidTokenException
+	 */
+	public function setPassword(OCPIToken $token, string $tokenId, string $password): void {
+		if (!$token instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 
@@ -370,8 +365,11 @@ class PublicKeyTokenProvider implements IProvider {
 		return $this->hasher->hash(sha1($password) . $password);
 	}
 
+	/**
+	 * @throws InvalidTokenException
+	 */
 	public function rotate(OCPIToken $token, string $oldTokenId, string $newTokenId): OCPIToken {
-		if (!($token instanceof PublicKeyToken)) {
+		if (!$token instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 
@@ -493,8 +491,11 @@ class PublicKeyTokenProvider implements IProvider {
 		return $dbToken;
 	}
 
-	public function markPasswordInvalid(OCPIToken $token, string $tokenId) {
-		if (!($token instanceof PublicKeyToken)) {
+	/**
+	 * @throws InvalidTokenException
+	 */
+	public function markPasswordInvalid(OCPIToken $token, string $tokenId): void {
+		if (!$token instanceof PublicKeyToken) {
 			throw new InvalidTokenException('Invalid token type');
 		}
 
@@ -503,7 +504,7 @@ class PublicKeyTokenProvider implements IProvider {
 		$this->cacheToken($token);
 	}
 
-	public function updatePasswords(string $uid, string $password) {
+	public function updatePasswords(string $uid, string $password): void {
 		// prevent setting an empty pw as result of pw-less-login
 		if ($password === '' || !$this->config->getSystemValueBool('auth.storeCryptedPassword', true)) {
 			return;
@@ -556,7 +557,7 @@ class PublicKeyTokenProvider implements IProvider {
 		}, $this->db);
 	}
 
-	private function logOpensslError() {
+	private function logOpensslError(): void {
 		$errors = [];
 		while ($error = openssl_error_string()) {
 			$errors[] = $error;
diff --git a/lib/private/Authentication/Token/RemoteWipe.php b/lib/private/Authentication/Token/RemoteWipe.php
index 80ba330b66d..6dc0aa738ba 100644
--- a/lib/private/Authentication/Token/RemoteWipe.php
+++ b/lib/private/Authentication/Token/RemoteWipe.php
@@ -18,27 +18,15 @@ use Psr\Log\LoggerInterface;
 use function array_filter;
 
 class RemoteWipe {
-	/** @var IProvider */
-	private $tokenProvider;
 
-	/** @var IEventDispatcher */
-	private $eventDispatcher;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	public function __construct(IProvider $tokenProvider,
-		IEventDispatcher $eventDispatcher,
-		LoggerInterface $logger) {
-		$this->tokenProvider = $tokenProvider;
-		$this->eventDispatcher = $eventDispatcher;
-		$this->logger = $logger;
+	public function __construct(
+		private IProvider $tokenProvider,
+		private IEventDispatcher $eventDispatcher,
+		private LoggerInterface $logger,
+	) {
 	}
 
 	/**
-	 * @param IToken $token
-	 * @return bool
-	 *
 	 * @throws InvalidTokenException
 	 * @throws WipeTokenException
 	 */
@@ -54,8 +42,6 @@ class RemoteWipe {
 	}
 
 	/**
-	 * @param IUser $user
-	 *
 	 * @return bool true if any tokens have been marked for remote wipe
 	 */
 	public function markAllTokensForWipe(IUser $user): bool {
@@ -79,8 +65,6 @@ class RemoteWipe {
 	}
 
 	/**
-	 * @param string $token
-	 *
 	 * @return bool whether wiping was started
 	 * @throws InvalidTokenException
 	 *
@@ -106,8 +90,6 @@ class RemoteWipe {
 	}
 
 	/**
-	 * @param string $token
-	 *
 	 * @return bool whether wiping could be finished
 	 * @throws InvalidTokenException
 	 */
diff --git a/lib/private/Authentication/Token/TokenCleanupJob.php b/lib/private/Authentication/Token/TokenCleanupJob.php
index 041d2e8a5e2..c109cd3fb72 100644
--- a/lib/private/Authentication/Token/TokenCleanupJob.php
+++ b/lib/private/Authentication/Token/TokenCleanupJob.php
@@ -9,11 +9,13 @@ use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\BackgroundJob\TimedJob;
 
 class TokenCleanupJob extends TimedJob {
-	private IProvider $provider;
 
-	public function __construct(ITimeFactory $time, IProvider $provider) {
+	public function __construct(
+		ITimeFactory $time,
+		private IProvider $provider,
+	) {
 		parent::__construct($time);
-		$this->provider = $provider;
+
 		// Run once a day at off-peak time
 		$this->setInterval(24 * 60 * 60);
 		$this->setTimeSensitivity(self::TIME_INSENSITIVE);
diff --git a/lib/private/Authentication/TwoFactorAuth/Db/ProviderUserAssignmentDao.php b/lib/private/Authentication/TwoFactorAuth/Db/ProviderUserAssignmentDao.php
index cc468dbeba0..60b60052067 100644
--- a/lib/private/Authentication/TwoFactorAuth/Db/ProviderUserAssignmentDao.php
+++ b/lib/private/Authentication/TwoFactorAuth/Db/ProviderUserAssignmentDao.php
@@ -18,11 +18,9 @@ use function array_map;
 class ProviderUserAssignmentDao {
 	public const TABLE_NAME = 'twofactor_providers';
 
-	/** @var IDBConnection */
-	private $conn;
-
-	public function __construct(IDBConnection $dbConn) {
-		$this->conn = $dbConn;
+	public function __construct(
+		private IDBConnection $conn,
+	) {
 	}
 
 	/**
@@ -51,10 +49,8 @@ class ProviderUserAssignmentDao {
 	 * Persist a new/updated (provider_id, uid, enabled) tuple
 	 */
 	public function persist(string $providerId, string $uid, int $enabled): void {
-		$conn = $this->conn;
-
 		// Insert a new entry
-		if ($conn->insertIgnoreConflict(self::TABLE_NAME, [
+		if ($this->conn->insertIgnoreConflict(self::TABLE_NAME, [
 			'provider_id' => $providerId,
 			'uid' => $uid,
 			'enabled' => $enabled,
@@ -63,7 +59,7 @@ class ProviderUserAssignmentDao {
 		}
 
 		// There is already an entry -> update it
-		$qb = $conn->getQueryBuilder();
+		$qb = $this->conn->getQueryBuilder();
 		$updateQuery = $qb->update(self::TABLE_NAME)
 			->set('enabled', $qb->createNamedParameter($enabled))
 			->where($qb->expr()->eq('provider_id', $qb->createNamedParameter($providerId)))
diff --git a/lib/private/Authentication/TwoFactorAuth/EnforcementState.php b/lib/private/Authentication/TwoFactorAuth/EnforcementState.php
index e02064bc8f7..66b5ce483f7 100644
--- a/lib/private/Authentication/TwoFactorAuth/EnforcementState.php
+++ b/lib/private/Authentication/TwoFactorAuth/EnforcementState.php
@@ -11,28 +11,12 @@ namespace OC\Authentication\TwoFactorAuth;
 use JsonSerializable;
 
 class EnforcementState implements JsonSerializable {
-	/** @var bool */
-	private $enforced;
 
-	/** @var array */
-	private $enforcedGroups;
-
-	/** @var array */
-	private $excludedGroups;
-
-	/**
-	 * EnforcementState constructor.
-	 *
-	 * @param bool $enforced
-	 * @param string[] $enforcedGroups
-	 * @param string[] $excludedGroups
-	 */
-	public function __construct(bool $enforced,
-		array $enforcedGroups = [],
-		array $excludedGroups = []) {
-		$this->enforced = $enforced;
-		$this->enforcedGroups = $enforcedGroups;
-		$this->excludedGroups = $excludedGroups;
+	public function __construct(
+		private bool $enforced,
+		private array $enforcedGroups = [],
+		private array $excludedGroups = [],
+	) {
 	}
 
 	/**
diff --git a/lib/private/Authentication/TwoFactorAuth/Manager.php b/lib/private/Authentication/TwoFactorAuth/Manager.php
index 1b22300e317..adf3835f386 100644
--- a/lib/private/Authentication/TwoFactorAuth/Manager.php
+++ b/lib/private/Authentication/TwoFactorAuth/Manager.php
@@ -37,67 +37,28 @@ class Manager {
 	public const REMEMBER_LOGIN = 'two_factor_remember_login';
 	public const BACKUP_CODES_PROVIDER_ID = 'backup_codes';
 
-	/** @var ProviderLoader */
-	private $providerLoader;
-
-	/** @var IRegistry */
-	private $providerRegistry;
-
-	/** @var MandatoryTwoFactor */
-	private $mandatoryTwoFactor;
-
-	/** @var ISession */
-	private $session;
-
-	/** @var IConfig */
-	private $config;
-
-	/** @var IManager */
-	private $activityManager;
-
-	/** @var LoggerInterface */
-	private $logger;
-
-	/** @var TokenProvider */
-	private $tokenProvider;
-
-	/** @var ITimeFactory */
-	private $timeFactory;
-
-	/** @var IEventDispatcher */
-	private $dispatcher;
-
-	/** @psalm-var array<string, bool> */
-	private $userIsTwoFactorAuthenticated = [];
-
-	public function __construct(ProviderLoader $providerLoader,
-		IRegistry $providerRegistry,
-		MandatoryTwoFactor $mandatoryTwoFactor,
-		ISession $session,
-		IConfig $config,
-		IManager $activityManager,
-		LoggerInterface $logger,
-		TokenProvider $tokenProvider,
-		ITimeFactory $timeFactory,
-		IEventDispatcher $eventDispatcher) {
-		$this->providerLoader = $providerLoader;
-		$this->providerRegistry = $providerRegistry;
-		$this->mandatoryTwoFactor = $mandatoryTwoFactor;
-		$this->session = $session;
-		$this->config = $config;
-		$this->activityManager = $activityManager;
-		$this->logger = $logger;
-		$this->tokenProvider = $tokenProvider;
-		$this->timeFactory = $timeFactory;
-		$this->dispatcher = $eventDispatcher;
+	public function __construct(
+		private ProviderLoader $providerLoader,
+		private IRegistry $providerRegistry,
+		private MandatoryTwoFactor $mandatoryTwoFactor,
+		private ISession $session,
+		private IConfig $config,
+		private IManager $activityManager,
+		private LoggerInterface $logger,
+		private TokenProvider $tokenProvider,
+		private ITimeFactory $timeFactory,
+		private IEventDispatcher $eventDispatcher,
+	) {
 	}
 
 	/**
 	 * Determine whether the user must provide a second factor challenge
 	 */
 	public function isTwoFactorAuthenticated(IUser $user): bool {
-		if (isset($this->userIsTwoFactorAuthenticated[$user->getUID()])) {
-			return $this->userIsTwoFactorAuthenticated[$user->getUID()];
+		$uid = $user->getUID();
+
+		if (isset($this->userIsTwoFactorAuthenticated[$uid])) {
+			return $this->userIsTwoFactorAuthenticated[$uid];
 		}
 
 		if ($this->mandatoryTwoFactor->isEnforcedFor($user)) {
@@ -111,8 +72,8 @@ class Manager {
 		$providerIds = array_keys($enabled);
 		$providerIdsWithoutBackupCodes = array_diff($providerIds, [self::BACKUP_CODES_PROVIDER_ID]);
 
-		$this->userIsTwoFactorAuthenticated[$user->getUID()] = !empty($providerIdsWithoutBackupCodes);
-		return $this->userIsTwoFactorAuthenticated[$user->getUID()];
+		$this->userIsTwoFactorAuthenticated[$uid] = !empty($providerIdsWithoutBackupCodes);
+		return $this->userIsTwoFactorAuthenticated[$uid];
 	}
 
 	/**
@@ -148,7 +109,8 @@ class Manager {
 	private function fixMissingProviderStates(array $providerStates,
 		array $providers, IUser $user): array {
 		foreach ($providers as $provider) {
-			if (isset($providerStates[$provider->getId()])) {
+			$pid = $provider->getId();
+			if (isset($providerStates[$pid])) {
 				// All good
 				continue;
 			}
@@ -159,7 +121,7 @@ class Manager {
 			} else {
 				$this->providerRegistry->disableProviderFor($provider, $user);
 			}
-			$providerStates[$provider->getId()] = $enabled;
+			$providerStates[$pid] = $enabled;
 		}
 
 		return $providerStates;
@@ -276,11 +238,12 @@ class Manager {
 	 * @param array $params
 	 */
 	private function publishEvent(IUser $user, string $event, array $params) {
+		$uid = $user->getUID();
 		$activity = $this->activityManager->generateEvent();
 		$activity->setApp('core')
 			->setType('security')
-			->setAuthor($user->getUID())
-			->setAffectedUser($user->getUID())
+			->setAuthor($uid)
+			->setAffectedUser($uid)
 			->setSubject($event, $params);
 		try {
 			$this->activityManager->publish($activity);
@@ -307,9 +270,10 @@ class Manager {
 
 		// First check if the session tells us we should do 2FA (99% case)
 		if (!$this->session->exists(self::SESSION_UID_KEY)) {
+			$uid = $user->getUID();
 			// Check if the session tells us it is 2FA authenticated already
 			if ($this->session->exists(self::SESSION_UID_DONE) &&
-				$this->session->get(self::SESSION_UID_DONE) === $user->getUID()) {
+				$this->session->get(self::SESSION_UID_DONE) === $uid) {
 				return false;
 			}
 
@@ -321,10 +285,10 @@ class Manager {
 				$sessionId = $this->session->getId();
 				$token = $this->tokenProvider->getToken($sessionId);
 				$tokenId = $token->getId();
-				$tokensNeeding2FA = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+				$tokensNeeding2FA = $this->config->getUserKeys($uid, 'login_token_2fa');
 
 				if (!\in_array((string)$tokenId, $tokensNeeding2FA, true)) {
-					$this->session->set(self::SESSION_UID_DONE, $user->getUID());
+					$this->session->set(self::SESSION_UID_DONE, $uid);
 					return false;
 				}
 			} catch (InvalidTokenException|SessionNotAvailableException $e) {
@@ -338,9 +302,10 @@ class Manager {
 			//   disabled the same time
 			$this->session->remove(self::SESSION_UID_KEY);
 
-			$keys = $this->config->getUserKeys($user->getUID(), 'login_token_2fa');
+			$uid = $user->getUID();
+			$keys = $this->config->getUserKeys($uid, 'login_token_2fa');
 			foreach ($keys as $key) {
-				$this->config->deleteUserValue($user->getUID(), 'login_token_2fa', $key);
+				$this->config->deleteUserValue($uid, 'login_token_2fa', $key);
 			}
 			return false;
 		}
@@ -355,12 +320,13 @@ class Manager {
 	 * @param boolean $rememberMe
 	 */
 	public function prepareTwoFactorLogin(IUser $user, bool $rememberMe) {
-		$this->session->set(self::SESSION_UID_KEY, $user->getUID());
+		$uid = $user->getUID();
+		$this->session->set(self::SESSION_UID_KEY, $uid);
 		$this->session->set(self::REMEMBER_LOGIN, $rememberMe);
 
 		$id = $this->session->getId();
 		$token = $this->tokenProvider->getToken($id);
-		$this->config->setUserValue($user->getUID(), 'login_token_2fa', (string)$token->getId(), (string)$this->timeFactory->getTime());
+		$this->config->setUserValue($uid, 'login_token_2fa', (string)$token->getId(), (string)$this->timeFactory->getTime());
 	}
 
 	public function clearTwoFactorPending(string $userId) {
diff --git a/lib/private/Authentication/TwoFactorAuth/MandatoryTwoFactor.php b/lib/private/Authentication/TwoFactorAuth/MandatoryTwoFactor.php
index 37c9d3fc550..f1731353908 100644
--- a/lib/private/Authentication/TwoFactorAuth/MandatoryTwoFactor.php
+++ b/lib/private/Authentication/TwoFactorAuth/MandatoryTwoFactor.php
@@ -13,15 +13,11 @@ use OCP\IGroupManager;
 use OCP\IUser;
 
 class MandatoryTwoFactor {
-	/** @var IConfig */
-	private $config;
 
-	/** @var IGroupManager */
-	private $groupManager;
-
-	public function __construct(IConfig $config, IGroupManager $groupManager) {
-		$this->config = $config;
-		$this->groupManager = $groupManager;
+	public function __construct(
+		private IConfig $config,
+		private IGroupManager $groupManager,
+	) {
 	}
 
 	/**
@@ -38,7 +34,7 @@ class MandatoryTwoFactor {
 	/**
 	 * Set the state of enforced two-factor auth
 	 */
-	public function setState(EnforcementState $state) {
+	public function setState(EnforcementState $state): void {
 		$this->config->setSystemValue('twofactor_enforced', $state->isEnforced() ? 'true' : 'false');
 		$this->config->setSystemValue('twofactor_enforced_groups', $state->getEnforcedGroups());
 		$this->config->setSystemValue('twofactor_enforced_excluded_groups', $state->getExcludedGroups());
@@ -51,9 +47,6 @@ class MandatoryTwoFactor {
 	 * and also have the option to exclude users of certain groups. This method will
 	 * check their membership of those groups.
 	 *
-	 * @param IUser $user
-	 *
-	 * @return bool
 	 */
 	public function isEnforcedFor(IUser $user): bool {
 		$state = $this->getState();
diff --git a/lib/private/Authentication/TwoFactorAuth/ProviderManager.php b/lib/private/Authentication/TwoFactorAuth/ProviderManager.php
index 5ce4c598154..a4d0b3dc88f 100644
--- a/lib/private/Authentication/TwoFactorAuth/ProviderManager.php
+++ b/lib/private/Authentication/TwoFactorAuth/ProviderManager.php
@@ -16,17 +16,16 @@ use OCP\Authentication\TwoFactorAuth\IRegistry;
 use OCP\IUser;
 
 class ProviderManager {
-	/** @var ProviderLoader */
-	private $providerLoader;
 
-	/** @var IRegistry */
-	private $providerRegistry;
-
-	public function __construct(ProviderLoader $providerLoader, IRegistry $providerRegistry) {
-		$this->providerLoader = $providerLoader;
-		$this->providerRegistry = $providerRegistry;
+	public function __construct(
+		private ProviderLoader $providerLoader,
+		private IRegistry $providerRegistry,
+	) {
 	}
 
+	/**
+	 * @throws InvalidProviderException
+	 */
 	private function getProvider(string $providerId, IUser $user): IProvider {
 		$providers = $this->providerLoader->getProviders($user);
 
@@ -40,8 +39,6 @@ class ProviderManager {
 	/**
 	 * Try to enable the provider with the given id for the given user
 	 *
-	 * @param IUser $user
-	 *
 	 * @return bool whether the provider supports this operation
 	 */
 	public function tryEnableProviderFor(string $providerId, IUser $user): bool {
@@ -51,9 +48,9 @@ class ProviderManager {
 			$provider->enableFor($user);
 			$this->providerRegistry->enableProviderFor($provider, $user);
 			return true;
-		} else {
-			return false;
 		}
+
+		return false;
 	}
 
 	/**
@@ -70,8 +67,8 @@ class ProviderManager {
 			$provider->disableFor($user);
 			$this->providerRegistry->disableProviderFor($provider, $user);
 			return true;
-		} else {
-			return false;
 		}
+
+		return false;
 	}
 }
diff --git a/lib/private/Authentication/TwoFactorAuth/ProviderSet.php b/lib/private/Authentication/TwoFactorAuth/ProviderSet.php
index 15b82be6dec..53ff0fe137e 100644
--- a/lib/private/Authentication/TwoFactorAuth/ProviderSet.php
+++ b/lib/private/Authentication/TwoFactorAuth/ProviderSet.php
@@ -16,29 +16,18 @@ use function array_filter;
  * Contains all two-factor provider information for the two-factor login challenge
  */
 class ProviderSet {
-	/** @var IProvider */
-	private $providers;
 
-	/** @var bool */
-	private $providerMissing;
-
-	/**
-	 * @param IProvider[] $providers
-	 * @param bool $providerMissing
-	 */
-	public function __construct(array $providers, bool $providerMissing) {
+	public function __construct(
+		private array $providers,
+		private bool $providerMissing,
+	) {
 		$this->providers = [];
 		foreach ($providers as $provider) {
 			$this->providers[$provider->getId()] = $provider;
 		}
-		$this->providerMissing = $providerMissing;
 	}
 
-	/**
-	 * @param string $providerId
-	 * @return IProvider|null
-	 */
-	public function getProvider(string $providerId) {
+	public function getProvider(string $providerId): ?IProvider {
 		return $this->providers[$providerId] ?? null;
 	}
 
diff --git a/lib/private/Authentication/TwoFactorAuth/Registry.php b/lib/private/Authentication/TwoFactorAuth/Registry.php
index 544f60c4f97..f9b23c991f7 100644
--- a/lib/private/Authentication/TwoFactorAuth/Registry.php
+++ b/lib/private/Authentication/TwoFactorAuth/Registry.php
@@ -20,23 +20,18 @@ use OCP\EventDispatcher\IEventDispatcher;
 use OCP\IUser;
 
 class Registry implements IRegistry {
-	/** @var ProviderUserAssignmentDao */
-	private $assignmentDao;
 
-	/** @var IEventDispatcher */
-	private $dispatcher;
-
-	public function __construct(ProviderUserAssignmentDao $assignmentDao,
-		IEventDispatcher $dispatcher) {
-		$this->assignmentDao = $assignmentDao;
-		$this->dispatcher = $dispatcher;
+	public function __construct(
+		private ProviderUserAssignmentDao $assignmentDao,
+		private IEventDispatcher $dispatcher,
+	) {
 	}
 
 	public function getProviderStates(IUser $user): array {
 		return $this->assignmentDao->getState($user->getUID());
 	}
 
-	public function enableProviderFor(IProvider $provider, IUser $user) {
+	public function enableProviderFor(IProvider $provider, IUser $user): void {
 		$this->assignmentDao->persist($provider->getId(), $user->getUID(), 1);
 
 		$event = new RegistryEvent($provider, $user);
@@ -44,7 +39,7 @@ class Registry implements IRegistry {
 		$this->dispatcher->dispatchTyped(new TwoFactorProviderForUserRegistered($user, $provider));
 	}
 
-	public function disableProviderFor(IProvider $provider, IUser $user) {
+	public function disableProviderFor(IProvider $provider, IUser $user): void {
 		$this->assignmentDao->persist($provider->getId(), $user->getUID(), 0);
 
 		$event = new RegistryEvent($provider, $user);
@@ -60,7 +55,7 @@ class Registry implements IRegistry {
 		}
 	}
 
-	public function cleanUp(string $providerId) {
+	public function cleanUp(string $providerId): void {
 		$this->assignmentDao->deleteAll($providerId);
 	}
 }
diff --git a/lib/private/Authentication/WebAuthn/CredentialRepository.php b/lib/private/Authentication/WebAuthn/CredentialRepository.php
index 203f2ef9020..a9389cb182f 100644
--- a/lib/private/Authentication/WebAuthn/CredentialRepository.php
+++ b/lib/private/Authentication/WebAuthn/CredentialRepository.php
@@ -16,11 +16,10 @@ use Webauthn\PublicKeyCredentialSourceRepository;
 use Webauthn\PublicKeyCredentialUserEntity;
 
 class CredentialRepository implements PublicKeyCredentialSourceRepository {
-	/** @var PublicKeyCredentialMapper */
-	private $credentialMapper;
 
-	public function __construct(PublicKeyCredentialMapper $credentialMapper) {
-		$this->credentialMapper = $credentialMapper;
+	public function __construct(
+		private PublicKeyCredentialMapper $credentialMapper,
+	) {
 	}
 
 	public function findOneByCredentialId(string $publicKeyCredentialId): ?PublicKeyCredentialSource {
@@ -28,7 +27,7 @@ class CredentialRepository implements PublicKeyCredentialSourceRepository {
 			$entity = $this->credentialMapper->findOneByCredentialId($publicKeyCredentialId);
 			return $entity->toPublicKeyCredentialSource();
 		} catch (IMapperException $e) {
-			return  null;
+			return null;
 		}
 	}
 
diff --git a/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialEntity.php b/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialEntity.php
index 6c4bc3ca81b..aec7d6bb347 100644
--- a/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialEntity.php
+++ b/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialEntity.php
@@ -29,20 +29,16 @@ use Webauthn\PublicKeyCredentialSource;
  * @method void setUserVerification(bool $userVerification);
  */
 class PublicKeyCredentialEntity extends Entity implements JsonSerializable {
-	/** @var string */
-	protected $name;
 
-	/** @var string */
-	protected $uid;
+	protected string $name;
 
-	/** @var string */
-	protected $publicKeyCredentialId;
+	protected string $uid;
 
-	/** @var string */
-	protected $data;
+	protected string $publicKeyCredentialId;
 
-	/** @var bool|null */
-	protected $userVerification;
+	protected string $data;
+
+	protected ?bool $userVerification;
 
 	public function __construct() {
 		$this->addType('name', 'string');
diff --git a/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialMapper.php b/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialMapper.php
index fa7304157c8..938120eabbe 100644
--- a/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialMapper.php
+++ b/lib/private/Authentication/WebAuthn/Db/PublicKeyCredentialMapper.php
@@ -70,7 +70,7 @@ class PublicKeyCredentialMapper extends QBMapper {
 	/**
 	 * @throws \OCP\DB\Exception
 	 */
-	public function deleteByUid(string $uid) {
+	public function deleteByUid(string $uid): void {
 		$qb = $this->db->getQueryBuilder();
 
 		$qb->delete($this->getTableName())