Restore #[SensitiveParameter] attributes

Co-Authored-By: Alexander Kravchenko <[email protected]>

Author: jeromegamez

.php-cs-fixer.dist.php

@@ -17,7 +17,7 @@
             'spacing' => 'none',
         ],
         'method_argument_space' => [
-            'attribute_placement' => 'same_line',
+            'attribute_placement' => 'standalone', // same_line can break PHP <8.2
         ],
         'no_unused_imports' => true,
         'ordered_imports' => [

CHANGELOG.md

@@ -7,6 +7,11 @@ Please read about the future of the Firebase Admin PHP SDK on the
 
 ## [Unreleased]
 
+## Added
+
+* Re-added the `#[SensitiveParameter]` attribute because, while it's not supported in PHP 8.1, it can still be used
+  if placed in a standalone line above the variable or property.
+
 ## [7.21.1] - 2025-07-24
 
 ### Fixed

src/Firebase/AppCheck/AppCheckTokenGenerator.php

@@ -8,11 +8,10 @@
 use Firebase\JWT\JWT;
 use Kreait\Firebase\Exception\AppCheck\InvalidAppCheckTokenOptions;
 use Psr\Clock\ClockInterface;
+use SensitiveParameter;
 
 /**
  * @internal
- *
- * @todo Add #[SensitiveParameter] attribute to the private key once the minimum required PHP version is >=8.2
  */
 final class AppCheckTokenGenerator
 {
@@ -26,6 +25,7 @@ final class AppCheckTokenGenerator
      */
     public function __construct(
         private readonly string $clientEmail,
+        #[SensitiveParameter]
         private readonly string $privateKey,
         ?ClockInterface $clock = null,
     ) {

src/Firebase/ServiceAccount.php

@@ -4,37 +4,48 @@
 
 namespace Kreait\Firebase;
 
+use SensitiveParameter;
+
 /**
  * @internal
- *
- * @todo Add #[SensitiveParameter] attributes once the minimum required PHP version is >=8.2
  */
 final class ServiceAccount
 {
     public function __construct(
         /** @var non-empty-string */
         public string $type,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $projectId,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $clientEmail,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $clientId,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $privateKey,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $privateKeyId,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $authUri,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $tokenUri,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $authProviderX509CertUrl,
         /** @var non-empty-string */
+        #[SensitiveParameter]
         public string $clientX509CertUrl,
         /** @var non-empty-string|null */
+        #[SensitiveParameter]
         public ?string $quotaProjectId = null,
         /** @var non-empty-string|null */
+        #[SensitiveParameter]
         public ?string $universeDomain = null,
     ) {
     }