From c700405c2a77b26cf889498966c45959b3106b04 Mon Sep 17 00:00:00 2001
From: Sebastiaan Stok <s.stok@rollerscapes.net>
Date: Sat, 6 Jan 2024 12:21:09 +0100
Subject: [PATCH] Add #[\SensitiveParameter] to token and verifier

---
 src/Argon2SplitTokenFactory.php     | 2 +-
 src/SplitToken.php                  | 6 +++---
 src/SplitTokenFactory.php           | 2 +-
 tests/FakeSplitTokenFactoryTest.php | 5 ++++-
 4 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/src/Argon2SplitTokenFactory.php b/src/Argon2SplitTokenFactory.php
index 96f7830..045177f 100644
--- a/src/Argon2SplitTokenFactory.php
+++ b/src/Argon2SplitTokenFactory.php
@@ -40,7 +40,7 @@ public function generate(\DateTimeImmutable | \DateInterval $expiresAt = null):
         return $splitToken->expireAt($this->getExpirationTimestamp($expiresAt));
     }
 
-    public function fromString(string | HiddenString | \Stringable $token): SplitToken
+    public function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): SplitToken
     {
         return Argon2SplitToken::fromString($token);
     }
diff --git a/src/SplitToken.php b/src/SplitToken.php
index 10e7496..24c22b3 100644
--- a/src/SplitToken.php
+++ b/src/SplitToken.php
@@ -98,7 +98,7 @@ abstract class SplitToken
     private ?string $verifierHash = null;
     private ?\DateTimeImmutable $expiresAt = null;
 
-    final private function __construct(HiddenString $token, string $selector, string $verifier)
+    final private function __construct(HiddenString $token, string $selector, #[\SensitiveParameter] string $verifier)
     {
         $this->token = $token;
         $this->selector = $selector;
@@ -150,7 +150,7 @@ public function expireAt(\DateTimeImmutable $expiresAt = null): static
      *
      * Note: The provided $token is zeroed from memory when it's length is valid.
      */
-    final public static function fromString(string | HiddenString | \Stringable $token): static
+    final public static function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): static
     {
         if ($token instanceof HiddenString) {
             $token = $token->getString();
@@ -259,5 +259,5 @@ protected function configureHasher(array $config): void
     abstract protected function verifyHash(string $hash, string $verifier): bool;
 
     /** Produces a hashed version of the verifier. */
-    abstract protected function hashVerifier(string $verifier): string;
+    abstract protected function hashVerifier(#[\SensitiveParameter] string $verifier): string;
 }
diff --git a/src/SplitTokenFactory.php b/src/SplitTokenFactory.php
index 2e25eae..7c4e704 100644
--- a/src/SplitTokenFactory.php
+++ b/src/SplitTokenFactory.php
@@ -46,5 +46,5 @@ public function generate(\DateTimeImmutable | \DateInterval $expiresAt = null):
      * return SplitToken::fromString($token);
      * ```
      */
-    public function fromString(string | HiddenString | \Stringable $token): SplitToken;
+    public function fromString(#[\SensitiveParameter] string | HiddenString | \Stringable $token): SplitToken;
 }
diff --git a/tests/FakeSplitTokenFactoryTest.php b/tests/FakeSplitTokenFactoryTest.php
index 80b5545..9695347 100644
--- a/tests/FakeSplitTokenFactoryTest.php
+++ b/tests/FakeSplitTokenFactoryTest.php
@@ -118,7 +118,10 @@ public function it_creates_from_stringable_object(): void
         $splitToken = $factory->generate();
 
         $stringObj = new class($splitToken->token()->getString()) implements \Stringable {
-            public function __construct(private string $value) {}
+            public function __construct(
+                #[\SensitiveParameter]
+                private string $value
+            ) {}
 
             public function __toString(): string
             {