Feature/multi platform accounts

[ChiefGyk3D]

No description provided.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-advanced-security]

CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

To fix the problem, we should avoid logging cleartext sensitive data, even if it's likely public. In boon_tube_daemon/media/youtube_videos.py, on line 71, the code logs a confirmation message when monitoring an account, including the (possibly secret-sourced) YouTube channel ID. Instead of logging the full (or even truncated) channel ID, we should log only non-sensitive display data. If desired, the log can reference a non-sensitive identifier such as the account's name (if present) or the fact that another account has been added, omitting the full channel_id field. The log message can be changed to report only the account number, optionally including account.get('name') instead of channel_id.

You only need to modify the region around line 71 in boon_tube_daemon/media/youtube_videos.py. No changes are required in the config file as that is not logging secrets.

---

To fix this issue, we must ensure that no sensitive or authentication-related data from login/API responses – even metadata like expiry time – is logged. In boon_tube_daemon/social/matrix.py, line 159 should be modified to log only a generic success message without including details from the data object. This applies regardless of whether the information seems sensitive now, as future changes to the API could alter the meaning or secrecy of fields. The code should simply confirm the login succeeded and an access token was obtained, without logging any values returned by the authentication endpoint.

Steps:

• Edit the logger statement at line 159 to remove the portion that logs .get('expires_in_ms', 'never') or any data from the token response.
• Replace it with a simple confirmation, e.g., logger.info(f"✓ Obtained Matrix access token for account #{account_num}").
• Review for followups, but no new imports or additional methods are needed for this change.

---

To remove cleartext logging of sensitive information, avoid including secret identifiers (even section/key names) in logs, especially at warning level. Instead, log a generic message or, if context is required, ensure only non-sensitive metadata is included.
Best approach:

• Remove the logger.warning in line 354 or replace it with a more generic message that does not reveal the section/key identifiers.
• E.g. Replace it with: logger.warning("⚠ Found placeholder value for secret in .env (starts with placeholder prefix)")
• Alternative: Only log at debug level instead of warning, or mask the identifier further.
  Required changes:
• Edit lines 353–355 in boon_tube_daemon/utils/config.py, replacing the warning message.

No imports or method definitions need to change, and no functionality is lost—all that changes is the content and scope of the log message.

---

The correct way to fix this issue is to remove get_secret from the import statement in boon_tube_daemon/social/matrix.py. This can be done by editing the import line on line 17 to omit get_secret, so it only imports the functions that are actually used: get_bool_config and get_matrix_accounts.

Only the import statement on line 17 needs to be changed; no other changes or additions are required. This edit will remove the unused import without affecting any existing functionality.