From cf699834f665b61c8dbc5365f54f2a265f95da37 Mon Sep 17 00:00:00 2001
From: Mathis Maquenne <124215603+mathismqn@users.noreply.github.com>
Date: Sun, 1 Mar 2026 21:57:38 +0100
Subject: [PATCH] refactor: hardcode secret key in crypto package

---
 internal/config/config.go     |  9 +--------
 internal/crypto/blowfish.go   | 10 +++++++---
 internal/downloader/client.go |  2 +-
 3 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/internal/config/config.go b/internal/config/config.go
index c18934a..1d0a872 100644
--- a/internal/config/config.go
+++ b/internal/config/config.go
@@ -12,7 +12,6 @@ import (
 
 type Config struct {
 	ArlCookie string `mapstructure:"arl_cookie"`
-	SecretKey string `mapstructure:"secret_key"`
 	OutputDir string `mapstructure:"output_dir"`
 	HomeDir   string
 }
@@ -33,7 +32,7 @@ func New(cfgPath string) (*Config, error) {
 		if _, err := os.Stat(cfgPath); os.IsNotExist(err) {
 			fmt.Printf("Config file not found, creating one at %s\n", cfgPath)
 
-			content := []byte("arl_cookie = ''\nsecret_key = ''\noutput_dir = ''\n")
+			content := []byte("arl_cookie = ''\noutput_dir = ''\n")
 			if err := os.WriteFile(cfgPath, content, 0644); err != nil {
 				return nil, fmt.Errorf("failed to create config file: %w", err)
 			}
@@ -68,12 +67,6 @@ func (c *Config) Validate() error {
 	if c.ArlCookie == "" {
 		return fmt.Errorf("arl_cookie is not set")
 	}
-	if c.SecretKey == "" {
-		return fmt.Errorf("secret_key is not set")
-	}
-	if len(c.SecretKey) != 16 {
-		return fmt.Errorf("secret_key must be 16 bytes long")
-	}
 	if c.OutputDir == "" {
 		c.OutputDir = filepath.Join(c.HomeDir, "Music", "GoDeez")
 	}
diff --git a/internal/crypto/blowfish.go b/internal/crypto/blowfish.go
index 59b36f3..787dc1a 100644
--- a/internal/crypto/blowfish.go
+++ b/internal/crypto/blowfish.go
@@ -8,13 +8,17 @@ import (
 	"golang.org/x/crypto/blowfish"
 )
 
-var iv = []byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07}
+var (
+	iv        = []byte{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07}
+	secretKey = []byte("g4el58wc0zvf9na1")
+)
 
-func GetKey(secretKey, songID string) []byte {
+func GetKey(songID string) []byte {
 	hash := md5.Sum([]byte(songID))
 	hashHex := hex.EncodeToString(hash[:])
 
-	key := []byte(secretKey)
+	key := make([]byte, len(secretKey))
+	copy(key, secretKey)
 	for i := 0; i < len(hash); i++ {
 		key[i] = key[i] ^ hashHex[i] ^ hashHex[i+16]
 	}
diff --git a/internal/downloader/client.go b/internal/downloader/client.go
index e3a8a69..4c7ba86 100644
--- a/internal/downloader/client.go
+++ b/internal/downloader/client.go
@@ -175,7 +175,7 @@ func (c *Client) downloadSong(ctx context.Context, resource deezer.Resource, son
 	fileName := song.GetFileName(c.resourceType, mediaFormat)
 	outputPath := path.Join(outputDir, fileName)
 
-	key := crypto.GetKey(c.appConfig.SecretKey, song.ID)
+	key := crypto.GetKey(song.ID)
 	if err := c.streamToFile(dlCtx, stream, outputPath, key); err != nil {
 		fileutil.DeleteFile(outputPath)
 		return downloadResult{err: fmt.Errorf("failed to stream to file: %w", err)}