Mark authentication parameters sensitive

Author: GrahamCampbell

CHANGELOG.md

@@ -9,6 +9,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 * Add PHP 8.5 support
 * Add support for `symfony/options-resolver:^8.0`
+* Add sensitive parameter annotations for authentication, trigger tokens, and user passwords
 * Add support for `force` in `Repositories::createCommit`
 * Add support for personal access tokens
 * Add support for project access token filters and rotation

src/Api/Projects.php

@@ -251,7 +251,7 @@ public function removeTrigger(int|string $project_id, int $trigger_id): mixed
         return $this->delete($this->getProjectPath($project_id, 'triggers/'.self::encodePath($trigger_id)));
     }
 
-    public function triggerPipeline(int|string $project_id, string $ref, string $token, array $variables = []): mixed
+    public function triggerPipeline(int|string $project_id, string $ref, #[\SensitiveParameter] string $token, array $variables = []): mixed
     {
         return $this->post($this->getProjectPath($project_id, 'trigger/pipeline'), [
             'ref' => $ref,

src/Api/Users.php

@@ -281,7 +281,7 @@ public function user(): mixed
         return $this->get('user');
     }
 
-    public function create(string $email, string $password, array $params = []): mixed
+    public function create(string $email, #[\SensitiveParameter] string $password, array $params = []): mixed
     {
         $params['email'] = $email;
         $params['password'] = $password;

src/Client.php

@@ -325,7 +325,7 @@ public function wiki(): Wiki
      * @param string      $token      Gitlab private token
      * @param string      $authMethod One of the AUTH_* class constants
      */
-    public function authenticate(string $token, string $authMethod, ?string $sudo = null): void
+    public function authenticate(#[\SensitiveParameter] string $token, string $authMethod, ?string $sudo = null): void
     {
         $this->getHttpClientBuilder()->removePlugin(Authentication::class);
         $this->getHttpClientBuilder()->addPlugin(new Authentication($authMethod, $token, $sudo));

src/HttpClient/Plugin/Authentication.php

@@ -36,7 +36,7 @@ final class Authentication implements Plugin
      */
     private readonly array $headers;
 
-    public function __construct(string $method, string $token, ?string $sudo = null)
+    public function __construct(string $method, #[\SensitiveParameter] string $token, ?string $sudo = null)
     {
         $this->headers = self::buildHeaders($method, $token, $sudo);
     }
@@ -62,7 +62,7 @@ public function handleRequest(RequestInterface $request, callable $next, callabl
      *
      * @return array<string,string>
      */
-    private static function buildHeaders(string $method, string $token, ?string $sudo = null): array
+    private static function buildHeaders(string $method, #[\SensitiveParameter] string $token, ?string $sudo = null): array
     {
         $headers = [];