refactor: inject Trakt API keys using obfuscation

Injects Trakt client ID and secret into the traktapi.py file during the build process.

Author: vladjerca

.github/workflows/submit.yml

@@ -13,6 +13,11 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v5
+      - name: Inject Trakt Keys
+        env:
+          TRAKT_CLIENT_ID: ${{ secrets.TRAKT_CLIENT_ID }}
+          TRAKT_CLIENT_SECRET: ${{ secrets.TRAKT_CLIENT_SECRET }}
+        run: python3 scripts/inject_keys.py
       - name: Generate distribution zip and submit to official kodi repository
         id: kodi-addon-submitter
         uses: xbmc/action-kodi-addon-submitter@v1.3

resources/lib/obfuscation.py

@@ -0,0 +1,11 @@
+# -*- coding: utf-8 -*-
+
+def deobfuscate(data):
+    if not data or not isinstance(data, list):
+        return ""
+    return "".join(chr(b ^ 0x42) for b in data)
+
+def obfuscate(data):
+    if not data:
+        return []
+    return [ord(c) ^ 0x42 for c in data]

resources/lib/traktapi.py

@@ -20,6 +20,7 @@
     findSeasonMatchInList,
     findShowMatchInList,
 )
+from resources.lib.obfuscation import deobfuscate
 from trakt import Trakt
 from trakt.objects import Movie, Show
 
@@ -31,8 +32,9 @@
 
 
 class traktAPI(object):
-    __client_id = "d4161a7a106424551add171e5470112e4afdaf2438e6ef2fe0548edc75924868"
-    __client_secret = "b5fcd7cb5d9bb963784d11bbf8535bc0d25d46225016191eb48e50792d2155c0"
+    # Placeholders for build-time injection
+    __client_id = "TRAKT_CLIENT_ID_PLACEHOLDER"
+    __client_secret = "TRAKT_CLIENT_SECRET_PLACEHOLDER"
 
     def __init__(self, force=False):
         logger.debug("Initializing.")
@@ -43,7 +45,8 @@ def __init__(self, force=False):
 
         # Configure
         Trakt.configuration.defaults.client(
-            id=self.__client_id, secret=self.__client_secret
+            id=deobfuscate(self.__client_id),
+            secret=deobfuscate(self.__client_secret),
         )
 
         # Bind event

scripts/inject_keys.py

@@ -0,0 +1,47 @@
+import os
+import sys
+
+# Add the parent directory to sys.path to allow importing from resources
+sys.path.append(os.path.join(os.path.dirname(__file__), ".."))
+
+from resources.lib.obfuscation import deobfuscate, obfuscate
+
+def main():
+    client_id = os.environ.get("TRAKT_CLIENT_ID")
+    client_secret = os.environ.get("TRAKT_CLIENT_SECRET")
+
+    if not client_id or not client_secret:
+        print("Error: TRAKT_CLIENT_ID or TRAKT_CLIENT_SECRET not set.")
+        sys.exit(1)
+
+    obfuscated_id = obfuscate(client_id)
+    obfuscated_secret = obfuscate(client_secret)
+
+    # Verify logic
+    assert deobfuscate(obfuscated_id) == client_id
+    assert deobfuscate(obfuscated_secret) == client_secret
+
+    target_file = "resources/lib/traktapi.py"
+    with open(target_file, "r") as f:
+        content = f.read()
+
+    # Replace placeholders
+    new_content = content.replace(
+        '"TRAKT_CLIENT_ID_PLACEHOLDER"',
+        str(obfuscated_id),
+    ).replace(
+        '"TRAKT_CLIENT_SECRET_PLACEHOLDER"',
+        str(obfuscated_secret),
+    )
+
+    if new_content == content:
+        print("Error: Could not find placeholders in target file.")
+        sys.exit(1)
+
+    with open(target_file, "w") as f:
+        f.write(new_content)
+
+    print(f"Successfully injected obfuscated keys into {target_file}")
+
+if __name__ == "__main__":
+    main()