Add #[\SensitiveParameter] to token and verifier

Author: sstok

src/Argon2SplitTokenFactory.php

@@ -40,7 +40,7 @@ public function generate(\DateTimeImmutable | \DateInterval $expiresAt = null):
         return $splitToken->expireAt($this->getExpirationTimestamp($expiresAt));
     }
 
-    public function fromString(string | HiddenString | \Stringable $token): SplitToken
+    public function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): SplitToken
     {
         return Argon2SplitToken::fromString($token);
     }

src/SplitToken.php

@@ -98,7 +98,7 @@ abstract class SplitToken
     private ?string $verifierHash = null;
     private ?\DateTimeImmutable $expiresAt = null;
 
-    final private function __construct(HiddenString $token, string $selector, string $verifier)
+    final private function __construct(HiddenString $token, string $selector, #[\SensitiveParameter] string $verifier)
     {
         $this->token = $token;
         $this->selector = $selector;
@@ -150,7 +150,7 @@ public function expireAt(\DateTimeImmutable $expiresAt = null): static
      *
      * Note: The provided $token is zeroed from memory when it's length is valid.
      */
-    final public static function fromString(string | HiddenString | \Stringable $token): static
+    final public static function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): static
     {
         if ($token instanceof HiddenString) {
             $token = $token->getString();
@@ -259,5 +259,5 @@ protected function configureHasher(array $config): void
     abstract protected function verifyHash(string $hash, string $verifier): bool;
 
     /** Produces a hashed version of the verifier. */
-    abstract protected function hashVerifier(string $verifier): string;
+    abstract protected function hashVerifier(#[\SensitiveParameter] string $verifier): string;
 }

src/SplitTokenFactory.php

@@ -46,5 +46,5 @@ public function generate(\DateTimeImmutable | \DateInterval $expiresAt = null):
      * return SplitToken::fromString($token);
      * ```
      */
-    public function fromString(string | HiddenString | \Stringable $token): SplitToken;
+    public function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): SplitToken;
 }

tests/FakeSplitTokenFactoryTest.php

@@ -118,7 +118,10 @@ public function it_creates_from_stringable_object(): void
         $splitToken = $factory->generate();
 
         $stringObj = new class($splitToken->token()->getString()) implements \Stringable {
-            public function __construct(private string $value) {}
+            public function __construct(
+                #[\SensitiveParameter]
+                private string $value
+            ) {}
 
             public function __toString(): string
             {