Config: new option -r redacts sensitive fields

[tomjaspers]

I think this was brought up in some issues before, as it makes it easier for people to blanket copy/paste their configuration when posting issues, without worrying about spilling their keys.

This PR introduces the config -r ( config --redacted) flag, which does the same as config, with the fields redacted, e.g.,

$ ./beet config -r
lyrics:
    sources: [lyricwiki, lyrics.com, musixmatch]
    google_API_key: REDACTED
    force: no
    auto: yes
    google_engine_ID: REDACTED
    fallback:
[...]

• Hard-coded a bunch of typical field names that need to be redacted (['password', 'username', 'userid', 'apikey', apisecret', 'email']).
• Plugins can register their own fields to be redacted, e.g.,:
  self.config.add_redacted_fields(['google_API_key', 'google_engine_ID'])

I was considering working with regex, matching 'secret', 'key', etc, but the above list seems to cover all the fields from the plugins listed in the official beets docs.

[brunal]

Nice! About 'key' and 'secret': no need for a regex, you could simply do if any(sensitive in field_name for sensitive in ('key', 'secret'))

[tomjaspers]

Thanks for the review, @brunal ! Good suggestions, as always.

About key, secret etc: I like the idea, but it would give false positives (e.g., duplicates plugin has a field 'keys'), so I think it'll be okay as it is.

I'll add some docs a bit later.

[brunal]

LGTM. Could you add tests in test/test_config_command.py?

[sampsyo]

Thank you, @tomjaspers! This looks great.

I'm going to make a few enhancements to the modularity of the redaction itself in confit.py. This should make the functionality a bit more generic and also more local, so add_redacted_fields does not propagate all the way to the root.

[sampsyo]

OK, done.

The API is now quite a bit different: rather than a hard-coded set of keys, you now mark individual views as redacted. Like this:

self.config['password'].redact = True

So it's possible I missed some things that were covered by the previous hard-coded list, but which I haven't yet found by searching the code. Please let me know if it seems like I left a gap.

I also have one question of opinion: What do you think about making redaction the default? People would have to pass --clear or something to show passwords. It might be sensible to make the common case the secure case.

[tomjaspers]

I think the main use-case for dumping the config is for sharing it elsewhere, so I'm all for making it the default redacted 👍

[sampsyo]

Great! Redaction is now the default. The flag --clear disables it.