wp user session list fatals with TypeError when a session token has a non-int expiration #622

Bug

wp user session list <user> throws a fatal TypeError under PHP 8+ when any of the user's session tokens has an expiration (or login) value that is not an int. A single malformed token takes down the entire command.

Stack trace (WP-CLI 2.12.0, entity-command)

PHP Fatal error:  Uncaught TypeError: date(): Argument #2 ($timestamp) must be of type ?int, string given
  in .../wp-cli/entity-command/src/User_Session_Command.php:184
#0 User_Session_Command.php(184): date()
#1 {closure:User_Session_Command::get_all_sessions():181}()
#2 User_Session_Command.php(179): array_walk()
#3 User_Session_Command.php(164): User_Session_Command->get_all_sessions()
#4 User_Session_Command->list_()

Offending code

src/User_Session_Command.php, get_all_sessions():

array_walk(
    $sessions,
    function ( &$session, $token ) {
        $session['token']           = $token;
        $session['login_time']      = date( 'Y-m-d H:i:s', $session['login'] );      // L183
        $session['expiration_time'] = date( 'Y-m-d H:i:s', $session['expiration'] );  // L184  <-- fatals
    }
);

date()'s second argument is typed ?int. Under PHP 7 a non-numeric string was silently coerced to 0; under PHP 8 it is a hard TypeError, so the whole command dies instead of listing the user's sessions.

How the bad data arises

Session token internals live in session_tokens user meta and are normally written by core with integer expiration/login. But WP-CLI cannot assume every token in the wild is well-formed — plugins, imports, or edge-case auth paths can leave a token whose expiration is a string. In our case one token had expiration => 'logged_in' (the auth cookie scheme string landed in the expiration slot), UA WP CLI 2.12.0. That single token made wp user session list unusable for that user until we manually pruned the meta.

Impact

• Command is completely unusable for the affected user (no way to see the sessions in order to destroy the bad one via wp user session destroy).
• On multisite, session_tokens is global usermeta, so one bad token surfaces the fatal from every site context.

Suggested fix

Guard the date formatting so a malformed token degrades gracefully instead of fataling the whole list. For example:

$login = isset( $session['login'] ) && is_numeric( $session['login'] ) ? (int) $session['login'] : null;
$exp   = isset( $session['expiration'] ) && is_numeric( $session['expiration'] ) ? (int) $session['expiration'] : null;
$session['login_time']      = null === $login ? '' : date( 'Y-m-d H:i:s', $login );
$session['expiration_time'] = null === $exp   ? '' : date( 'Y-m-d H:i:s', $exp );

This keeps well-formed rows unchanged while letting an operator actually list (and then destroy) a corrupt session token instead of hitting a fatal.

Environment

• WP-CLI 2.12.0
• PHP 8.x