Feature request: external storage for api tokens

[sprat]

I tend to commit all my sublime text plugin settings to git in order to keep all my dev machines in sync. But I am a bit annoyed with MarkdownPreview settings as it contains secrets, the api tokens. Would it be possible to use another file to store the api tokens, or use the environment variable GITHUB_TOKEN so that I can commit my settings?

[facelessuser]

We could move secrets to a separate settings file that only contains secrets that you could just ignore from your commits. I think that would be fine.

[sprat]

Yes, that's a possibility. I also like the idea of using an environment variable as it does not force users to leave secrets on disk (depending on how the environment variable is provided).

[facelessuser]

I'm not sure I'm understanding. How do you plan on providing your environmental variables such that they are not disk? It's been a bit a as well, I'm not sure how well Sublime Text interfaces with the default system environmental variables.

[facelessuser]

I can commit to this, create an option that will source secrets from a separate file. I'm open to someone doing some exploratory work to present a possible improved suggestion for the future. At the very least, we can separate the secrets from the main file.

[sprat]

In fact, I asked the same thing in the GitSavvy plugin which also need a github token and the plugin author suggested to use an environment variable instead of a separate file, so I suppose it's possible.

Yes, the secret need to be stored somewhere, because using GITHUB_TOKEN=xxx subl each time we want to run subl is not handy. But at least it can be defined at a single place instead of having many different files on disk with secrets in them.

Anyway, my main point is to avoid committing secrets inadvertently, so feel free to implement this feature request as you wish.

[facelessuser]

Okay, I'll implement as a separate settings file, and if someone wants to do the work to explore utilizing it from an environmental variable, I'm happy to take a look.

[sprat]

For reference, here is the pull request implementing environment variables for the token in the GitSavvy plugin: timbrel/GitSavvy#2055

I can probably give a try in implementing the same thing in MarkdownPreview when I'll get some time.

[facelessuser]

We would likely need a specific environmental variable that is appropriate for us with appropriately narrow privileges, but I'm okay if you are able to get a PR up and running (and tested). I'm willing to review such a change.