Add proper parameters

composer.json

@@ -9,11 +9,12 @@
         "thecodingmachine/safe": "^3.3"
     },
     "require-dev": {
-        "nunomaduro/collision": "^8.8",
-        "larastan/larastan": "^3.6",
-        "orchestra/testbench": "^11.0.0||^10.0.0||^9.0.0||^8.22.0",
         "friendsofphp/php-cs-fixer": "^3.3",
+        "larastan/larastan": "^3.6",
         "lychee-org/phpstan-lychee": "^v2.0.2",
+        "lychee-org/phpstan-sensitive-parameter-values": "^1.0",
+        "nunomaduro/collision": "^8.8",
+        "orchestra/testbench": "^11.0.0||^10.0.0||^9.0.0||^8.22.0",
         "php-parallel-lint/php-parallel-lint": "^1.4",
         "phpunit/phpunit": "^10.0||^11.0"
     },

config/verify.php

@@ -14,10 +14,10 @@
 	'keygen_url' => env('KEYGEN_URL', 'https://keygen.lycheeorg.dev/api'),
 
 	'validation' => [
-		ValidateSupporter::class => 'a12d601f9f22a6f326901f0c4deb3cdeb5d6cc47',
-		ValidatePro::class => '50a93c3e54cbd8ec502cb574ac236bc4e99194be',
-		ValidateSignature::class => '5a8a855d4b59c44c298daa66801c79f2aba20492',
-		Verify::class => '1026070973fa233fc087ed706aa4b9b50bd37843',
+		ValidateSupporter::class => 'bcd0281afd7a8c4e19be3ea3a16860f4fe81556b',
+		ValidatePro::class => '26e178bcb4264101281ff4adb51d05a821b021f6',
+		ValidateSignature::class => '8c1c664c1ed9a98452f5af10b1a2a69c03b81d66',
+		Verify::class => '4ae4a13beb075b695536d91478f8e55f5226e51a',
 		VerifySupporterStatus::class => '6358c45ed0414c1e2697e0881238659fa6221bed',
 		VerifyProStatus::class => '212e6ada794587ee8e2b81cf76e243d134a7e823',
 		VerifyServiceProvider::class => '923b63b15d25e69b95ed1d5ec1c82ba57f1a7d74',

phpstan.neon

@@ -1,6 +1,7 @@
 includes:
 	- vendor/larastan/larastan/extension.neon
 	- vendor/lychee-org/phpstan-lychee/phpstan.neon
+	- vendor/lychee-org/phpstan-sensitive-parameter-values/extension.neon
 
 parameters:
 	level: 9

src/Contract/RotationResult.php

@@ -7,7 +7,8 @@ class RotationResult
 	private function __construct(
 		public readonly bool $success,
 		public readonly ?string $message,
-	) {}
+	) {
+	}
 
 	public static function ok(): self
 	{

src/Contract/TokenExtensionResult.php

@@ -14,7 +14,8 @@ private function __construct(
 		/** @var string[]|null */
 		public readonly ?array $scopes,
 		public readonly ?Carbon $expires_at,
-	) {}
+	) {
+	}
 
 	/**
 	 * @param string[] $scopes

src/Contract/ValidatorInterface.php

@@ -10,17 +10,17 @@ interface ValidatorInterface
 	/**
 	 * Given a license key and a verifiable string, check whether the license key is valid or not.
 	 *
-	 * @param string $verifiable
-	 * @param string $license
+	 * @param string                                  $verifiable
+	 * @param string|\SensitiveParameterValue<string> $license
 	 *
 	 * @return bool
 	 */
-	public function validate(string $verifiable, string $license): bool;
+	public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool;
 
 	/**
 	 * Defines the status granted by the Validator in case of success.
 	 *
 	 * @return Status
 	 */
 	public function grant(): Status;
-}
+}

src/Rotation.php

@@ -16,7 +16,8 @@ class Rotation
 
 	public function __construct(
 		private VerifyFactory $verifyFactory,
-	) {}
+	) {
+	}
 
 	public function rotate(): RotationResult
 	{

src/Validators/ValidatePro.php

@@ -20,8 +20,12 @@ public function __construct(#[\SensitiveParameter] ?string $hash = null)
 	/**
 	 * Validate whether the static license key provided matches with the hash.
 	 */
-	public function validate(string $verifiable, string $license): bool
+	public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool
 	{
+		if ($license instanceof \SensitiveParameterValue) {
+			$license = $license->getValue();
+		}
+
 		if ($license === '') {
 			return false;
 		}

src/Validators/ValidateSignature.php

@@ -25,8 +25,12 @@ public function __construct(#[\SensitiveParameter] ?string $public_key = null)
 	/**
 	 * Validate whether the cryptographic signature (license) is valid with the hard coded public key.
 	 */
-	public function validate(string $verifiable, string $license): bool
+	public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool
 	{
+		if ($license instanceof \SensitiveParameterValue) {
+			$license = $license->getValue();
+		}
+
 		if ($license === '' || $verifiable === '') {
 			return false;
 		}

src/Validators/ValidateSupporter.php

@@ -20,8 +20,12 @@ public function __construct(#[\SensitiveParameter] ?string $hash = null)
 	/**
 	 * Validate whether the static license key provided matches with the hash.
 	 */
-	public function validate(string $verifiable, string $license): bool
+	public function validate(string $verifiable, string|\SensitiveParameterValue $license): bool
 	{
+		if ($license instanceof \SensitiveParameterValue) {
+			$license = $license->getValue();
+		}
+
 		if ($license === '') {
 			return false;
 		}

src/Verify.php

@@ -16,8 +16,10 @@
 class Verify implements VerifyInterface
 {
 	use VerifyTrait;
-	private string $config_email;
-	private string $license_key;
+	/** @var \SensitiveParameterValue<string> */
+	private \SensitiveParameterValue $config_email;
+	/** @var \SensitiveParameterValue<string> */
+	private \SensitiveParameterValue $license_key;
 	private ValidateSignature $validateSignature;
 	private ValidateSupporter $validateSupporter;
 	private ValidatePro $validatePro;
@@ -54,8 +56,8 @@ private function init(
 	): bool {
 		if ($config_email !== null || $license_key !== null) {
 			// If both values are provided, no need to check the database
-			$this->config_email = $config_email ?? '';
-			$this->license_key = $license_key ?? '';
+			$this->config_email = new \SensitiveParameterValue($config_email ?? '');
+			$this->license_key = new \SensitiveParameterValue($license_key ?? '');
 			$this->initialized = true;
 
 			return true;
@@ -67,8 +69,8 @@ private function init(
 		}
 
 		// Load the necessary config entries
-		$this->config_email = DB::table('configs')->where('key', 'email')->first()?->value ?? ''; // @phpstan-ignore-line
-		$this->license_key = DB::table('configs')->where('key', 'license_key')->first()?->value ?? ''; // @phpstan-ignore-line
+		$this->config_email = new \SensitiveParameterValue(DB::table('configs')->where('key', 'email')->first()?->value ?? ''); // @phpstan-ignore-line
+		$this->license_key = new \SensitiveParameterValue(DB::table('configs')->where('key', 'license_key')->first()?->value ?? ''); // @phpstan-ignore-line
 		$this->initialized = true;
 
 		return true;
@@ -95,7 +97,7 @@ public function get_status(): Status
 	 */
 	private function resolve_status(): Status
 	{
-		$base = json_encode(['url' => config('app.url'), 'email' => $this->config_email]);
+		$base = json_encode(['url' => config('app.url'), 'email' => $this->config_email->getValue()]);
 
 		if ($this->validateSupporter->validate($base, $this->license_key)) {
 			return $this->validateSupporter->grant();
@@ -105,7 +107,7 @@ private function resolve_status(): Status
 			return $this->validatePro->grant();
 		}
 
-		if ($this->config_email !== '' && $this->validateSignature->validate($base, $this->license_key)) {
+		if ($this->config_email->getValue() !== '' && $this->validateSignature->validate($base, $this->license_key)) {
 			return $this->validateSignature->grant();
 		}
 

tests/TestVerifyFactory.php

@@ -8,12 +8,17 @@
 
 class TestVerifyFactory implements VerifyFactory
 {
+	/** @var \SensitiveParameterValue<?string> */
+	private \SensitiveParameterValue $hash_supporter;
+
 	public function __construct(
-		#[\SensitiveParameter] private ?string $hash_supporter = null,
-	) {}
+		#[\SensitiveParameter] ?string $hash_supporter = null,
+	) {
+		$this->hash_supporter = new \SensitiveParameterValue($hash_supporter);
+	}
 
 	public function make(#[\SensitiveParameter] string $license_key): VerifyInterface
 	{
-		return new Verify(license_key: $license_key, hash_supporter: $this->hash_supporter);
+		return new Verify(license_key: $license_key, hash_supporter: $this->hash_supporter->getValue());
 	}
 }

tests/Verify/RotationTest.php

@@ -15,7 +15,7 @@ class RotationTest extends TestCase
 {
 	private const KEYGEN_URL = 'https://keygen.lycheeorg.dev/api';
 
-	private function makeRotation(?string $hash_supporter = null): Rotation
+	private function makeRotation(#[\SensitiveParameter] ?string $hash_supporter = null): Rotation
 	{
 		$factory = $hash_supporter !== null
 			? new TestVerifyFactory($hash_supporter)