Fix SonarQube/PHPStan issues: session type, returns count, coverage gaps

- AuditLog: move @var before ORM attribute for PHPStan visibility
- SubAccountPermissionSubscriber: use Session instead of FlashBagAwareSessionInterface
- SuspendedUserSubscriber: same Session type fix
- OrderController::create: merge expired + invalid cart into single return (4→3 returns)
- OrderControllerTest: add testCreateOrderUnlimitedBillet (covers clampQuantity unlimited branch)
- AccountControllerTest: add BilletOrder in soldCounts test (covers foreach $rows loop)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/Controller/OrderController.php

@@ -30,10 +30,6 @@ class OrderController extends AbstractController
             throw $this->createNotFoundException();
         }
 
-        if ($event->getEndAt() && $event->getEndAt() < new \DateTimeImmutable()) {
-            return $this->json(['error' => 'Cet evenement est termine.'], 400);
-        }
-
         $cart = json_decode($request->getContent(), true);
         $eventUrl = $this->generateUrl('app_event_detail', [
             'orgaSlug' => $event->getAccount()->getSlug(),
@@ -41,10 +37,9 @@ class OrderController extends AbstractController
             'eventSlug' => $event->getSlug(),
         ]);
 
-        if (!$this->isValidCart($cart)) {
-            $this->addFlash('error', 'Votre panier est vide.');
-
-            return $this->json(['redirect' => $eventUrl], 400);
+        $isExpired = $event->getEndAt() && $event->getEndAt() < new \DateTimeImmutable();
+        if ($isExpired || !$this->isValidCart($cart)) {
+            return $this->json($isExpired ? ['error' => 'Cet evenement est termine.'] : ['redirect' => $eventUrl], 400);
         }
 
         /** @var User|null $user */

src/Entity/AuditLog.php

@@ -22,8 +22,8 @@ class AuditLog
     #[ORM\Column(nullable: true)]
     private ?int $entityId = null;
 
-    #[ORM\Column(type: 'json')]
     /** @var array<string, mixed> */
+    #[ORM\Column(type: 'json')]
     private array $data = [];
 
     #[ORM\Column(length: 255, nullable: true)]

src/EventSubscriber/SubAccountPermissionSubscriber.php

@@ -82,7 +82,7 @@ class SubAccountPermissionSubscriber implements EventSubscriberInterface
 
     private function deny(RequestEvent $event): void
     {
-        /** @var \Symfony\Component\HttpFoundation\Session\Flash\FlashBagAwareSessionInterface $session */
+        /** @var \Symfony\Component\HttpFoundation\Session\Session $session */
         $session = $event->getRequest()->getSession();
         $session->getFlashBag()->add('error', 'Vous n\'avez pas la permission d\'effectuer cette action.');
         $event->setResponse(new RedirectResponse($this->urlGenerator->generate('app_account')));

src/EventSubscriber/SuspendedUserSubscriber.php

@@ -41,7 +41,7 @@ class SuspendedUserSubscriber implements EventSubscriberInterface
             return;
         }
 
-        /** @var \Symfony\Component\HttpFoundation\Session\Flash\FlashBagAwareSessionInterface $session */
+        /** @var \Symfony\Component\HttpFoundation\Session\Session $session */
         $session = $event->getRequest()->getSession();
         $session->getFlashBag()->add('error', 'Votre compte a ete suspendu. Contactez '.$this->adminEmail.'.');
         $event->setResponse(new RedirectResponse($this->urlGenerator->generate('app_home')));

tests/Controller/AccountControllerTest.php

@@ -2108,6 +2108,13 @@ class AccountControllerTest extends WebTestCase
         $item->setUnitPriceHT(1000);
         $order->addItem($item);
         $em->persist($order);
+
+        $ticket = new \App\Entity\BilletOrder();
+        $ticket->setBilletBuyer($order);
+        $ticket->setBillet($billet);
+        $ticket->setBilletName('Entree');
+        $ticket->setUnitPriceHT(1000);
+        $em->persist($ticket);
         $em->flush();
 
         $client->loginUser($user);

tests/Controller/OrderControllerTest.php

@@ -208,6 +208,31 @@ class OrderControllerTest extends WebTestCase
         self::assertStringContainsString('/informations', $data['redirect']);
     }
 
+    public function testCreateOrderUnlimitedBillet(): void
+    {
+        $client = static::createClient();
+        $em = static::getContainer()->get(EntityManagerInterface::class);
+        $user = $this->createOrga($em);
+        [$event] = $this->createEventWithBillet($em, $user);
+
+        $category = $em->getRepository(Category::class)->findOneBy(['event' => $event]);
+        $unlimited = new Billet();
+        $unlimited->setName('Illimite');
+        $unlimited->setCategory($category);
+        $unlimited->setPriceHT(500);
+        $unlimited->setQuantity(null);
+        $em->persist($unlimited);
+        $em->flush();
+
+        $client->request('POST', '/evenement/'.$event->getId().'/commander', [], [], ['CONTENT_TYPE' => 'application/json'], json_encode([
+            ['billetId' => $unlimited->getId(), 'qty' => 50],
+        ]));
+
+        self::assertResponseIsSuccessful();
+        $data = json_decode($client->getResponse()->getContent(), true);
+        self::assertStringContainsString('/informations', $data['redirect']);
+    }
+
     // === GUEST ===
 
     public function testGuestPageNotFound(): void