Added Environment Variable Support for security

Added option to include full ComfyUI execution info in the API call
Updated README

README.md

@@ -9,3 +9,23 @@ Send a JSON message to the specified URL. Supports basic api key authentication.
 <img src="assets/apicall_node.jpg" width="400"/>
 
 
+## A Note on Security
+
+99.99% of the time, you should use the prefix '$ENV.<Some_Variable_Name>' to access the environment variables. This keeps your secrets out of the metadata of the output.
+
+**IF YOU DO NOT ADD THE --disable-metadata FLAG TO COMFYUI, THIS _WILL_ SPILL SECRETS IN THE METADATA OF THE OUTPUT.**
+**You must ensure that the metadata is not attached to _any_ outputs, as some nodes will not respect the --disable-metadata flag and will attach their own metadata.**
+
+This package is designed to be used in a secure environment. It is not recommended to use this package in a public environment.
+Make sure to add the --disable-metadata flag to your comfyui command, to prevent the metadata from being attached outputs -- but be aware that some nodes will not respect this flag and will attach their own metadata.
+
+In the event that you need to use the metadata, you absolutely must use the prefix '$ENV.<Some_Variable_Name>' in any fields you want to keep secret.
+
+
+## Installation
+
+1. Download the package from the ComfyUI extensions tab.
+2. Install the package.
+3. Add the Secure API Call node to your ComfyUI workflow.
+4. Configure the node with the URL, API key, and any other necessary parameters.
+5. Run the workflow and check the output (especially the metadata, it should be empty).

nodes/secure_api_call.py

@@ -12,6 +12,7 @@ class SecureApiCall:
                 "any": (ComfyAnyType("*"), {}),
                 "api_url": ("STRING", {'default': 'https://localhost:9001/'}),
                 "data": ('STRING', {'default': '{"data": "some_data"}'}),
+                "full_comfyui_info": ("BOOLEAN", {"default": True}),
                 "api_auth": ("STRING", {'default': 'x-api-key'}),
                 "timeout": ('FLOAT', {'default': 3, 'min': 0, 'max': 60}),
                 "verify_ssl": ("BOOLEAN", {"default": True}),
@@ -23,14 +24,24 @@ class SecureApiCall:
     RETURN_TYPES = tuple()
     CATEGORY = "notifications"
 
-    def hook(self, any, api_url, api_auth, data, timeout, verify_ssl):
+    def hook(self, any, api_url, api_auth, data, full_comfyui_info, timeout, verify_ssl):
         # Get the payload from the data string
         payload = json.loads(data)
         # Add ComfyUI execution information to the payload
         current_queue = server.PromptServer.instance.prompt_queue.get_current_queue()
-        # The response is a massive object (containing all nodes and workflow info) -- we only want the prompt_id for tracking
+
+        # The response is a massive object (containing all nodes and workflow info) -- we only want the prompt_id for tracking, but if full_comfyui_info is true, we want to include the entire object
         prompt_id = current_queue[0][0][1]
         payload.update({"comfyui_execution_info": {"prompt_id": prompt_id}})
+        if include_full_comfyui_info:
+            payload.update({"comfyui_info": {"full_comfyui_info": current_queue}})
+
+
+        # Resolve any environment variables in the api_url, api_auth fields -- If the variable is not set, change the value to 'NOT_SET'
+        if api_url.startswith("$ENV."):
+            api_url = os.getenv(api_url.removeprefix("$ENV.")) or 'NOT_SET'
+        if api_auth.startswith("$ENV."):
+            api_auth = os.getenv(api_auth.removeprefix("$ENV.")) or 'NOT_SET'
 
         # Send the payload to the API
         res = requests.post(