feat(settings): unify platform credentials into one DB-backed accounts manager

Merge the two overlapping Settings sections (Multiple Accounts + the single-key
Bug Bounty Platform API Keys) into one 'Bug Bounty Platform Accounts' manager
that is the single source of truth — all in the DB, with per-account validity tags.

- accounts.MigrateEnvAccounts(): one-shot, idempotent import of the legacy
  single-account env creds (H1_USERNAME/H1_TOKEN, BUGCROWD_TOKEN, INTIGRITI_TOKEN,
  YWH_*) into bbp_accounts as a 'default' account per platform. Guarded by a
  settings marker; runs at boot after HydrateEnvFromDB.
- accounts.For() stops injecting the env account once migrated, so the DB is
  authoritative (no lingering env credential after a user edits/deletes an account).
- UI: remove the redundant HackerOne/Bugcrowd/Intigriti/YesWeHack single-key rows
  (now managed as accounts); the remaining single-value keys (HackAdvisor
  aggregator, Chaos recon) move to a small 'External Aggregators & Recon Keys'
  section. Accounts header/description updated; Bugcrowd cookie note retained.
- test: env→DB import, no env duplicate in For(), idempotency.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: h0tak88r

internal/accounts/accounts.go

@@ -110,13 +110,61 @@ func For(platform string) []Account {
 		}
 	}
 
-	// Add the legacy env account unless its token is already represented.
-	if env := envAccount(p); hasCreds(env) && (env.Token == "" || !seenTok[env.Token]) {
-		out = append(out, env)
+	// Add the legacy env account unless its token is already represented — but only
+	// until the env credentials have been migrated into the DB (see
+	// MigrateEnvAccounts). After migration the DB is the single source of truth, so
+	// the env vars are no longer injected as an implicit extra account.
+	if !envMigrated() {
+		if env := envAccount(p); hasCreds(env) && (env.Token == "" || !seenTok[env.Token]) {
+			out = append(out, env)
+		}
 	}
 	return out
 }
 
+const envMigratedMarker = "bbp_env_migrated"
+
+// envMigrated reports whether the one-time env→DB account migration has run.
+func envMigrated() bool {
+	v, _ := db.GetSetting(envMigratedMarker)
+	return v == "done"
+}
+
+// MigrateEnvAccounts imports the legacy single-account env credentials
+// (H1_USERNAME/H1_TOKEN, BUGCROWD_TOKEN, INTIGRITI_TOKEN, YWH_*) into the
+// bbp_accounts DB table as a "default" account per platform, so the DB becomes
+// the single source of truth for the Settings accounts manager. It is idempotent
+// and one-shot (guarded by a settings marker), so it is safe to call on every
+// boot. An env credential already present as a DB account (same token) is skipped.
+func MigrateEnvAccounts() {
+	if envMigrated() {
+		return
+	}
+	for _, p := range []string{"h1", "bc", "it", "ywh"} {
+		env := envAccount(p)
+		if !hasCreds(env) {
+			continue
+		}
+		exists := false
+		if rows, err := db.ListBBPAccounts(p); err == nil {
+			for _, r := range rows {
+				if r.Token != "" && r.Token == env.Token {
+					exists = true
+					break
+				}
+			}
+		}
+		if exists {
+			continue
+		}
+		_, _ = db.UpsertBBPAccount(db.BBPAccount{
+			Platform: p, Label: "default", Username: env.Username,
+			Token: env.Token, Email: env.Email, Password: env.Password, Enabled: true,
+		})
+	}
+	_ = db.SetSetting(envMigratedMarker, "done")
+}
+
 // Labels returns the account labels for a platform (for source tagging).
 func Labels(platform string) []string {
 	var ls []string

internal/accounts/accounts_test.go

@@ -0,0 +1,51 @@
+package accounts
+
+import (
+	"path/filepath"
+	"testing"
+
+	"github.com/h0tak88r/AutoAR/internal/db"
+)
+
+// TestMigrateEnvAccounts verifies the one-shot env→DB import: legacy env
+// credentials become "default" DB accounts, For() then serves them from the DB
+// without also injecting the env account (no duplicate), and re-running is a no-op.
+func TestMigrateEnvAccounts(t *testing.T) {
+	t.Setenv("DB_TYPE", "sqlite")
+	t.Setenv("DB_HOST", filepath.Join(t.TempDir(), "acct_test.db"))
+	t.Setenv("AUTOAR_SILENT", "true")
+	if err := db.Init(); err != nil {
+		t.Fatalf("db.Init: %v", err)
+	}
+	if err := db.EnsureSchema(); err != nil {
+		t.Fatalf("db.EnsureSchema: %v", err)
+	}
+
+	t.Setenv("H1_USERNAME", "0x88")
+	t.Setenv("H1_TOKEN", "h1-secret")
+	t.Setenv("BUGCROWD_TOKEN", "bc-secret")
+
+	MigrateEnvAccounts()
+
+	// h1 env creds imported as a "default" DB account.
+	rows, err := db.ListBBPAccounts("h1")
+	if err != nil {
+		t.Fatalf("ListBBPAccounts(h1): %v", err)
+	}
+	if len(rows) != 1 || rows[0].Label != "default" || rows[0].Username != "0x88" || rows[0].Token != "h1-secret" {
+		t.Fatalf("h1 not imported correctly: %+v", rows)
+	}
+
+	// After migration, For(h1) serves exactly the DB account — the env account is
+	// no longer injected (would otherwise duplicate the same credential).
+	acc := For("h1")
+	if len(acc) != 1 || acc[0].Source != "db" || acc[0].Token != "h1-secret" {
+		t.Fatalf("For(h1) after migration = %+v, want one db account", acc)
+	}
+
+	// Idempotent: a second run must not create duplicates.
+	MigrateEnvAccounts()
+	if rows2, _ := db.ListBBPAccounts("h1"); len(rows2) != 1 {
+		t.Fatalf("migration not idempotent: %d h1 rows", len(rows2))
+	}
+}

internal/api/ui/pages/settings.js

@@ -144,12 +144,15 @@
         </div>
 
         <div class="settings-section" data-tab="platforms">
-          <div class="settings-section-header"> Multiple Accounts</div>
+          <div class="settings-section-header"> Bug Bounty Platform Accounts</div>
           <div class="settings-section-description">
-            Add more than one credential per platform to pull programs, domains and scope from
-            <strong>all</strong> of your accounts at once. Every enabled account is queried and the
-            results are merged (deduplicated). The single credential in the section below is used
-            automatically as an extra <code>env</code> account.
+            The single source for HackerOne, Bugcrowd, Intigriti and YesWeHack credentials — all
+            stored in the database and surviving redeploys. Add one or more accounts per platform;
+            every <strong>enabled</strong> account is queried and the programs, domains and scope
+            are merged (deduplicated). Each account shows a live <strong>validity</strong> tag.
+            Any credential you had in the old single-key fields was imported here automatically.
+            <br><em>Bugcrowd</em> takes the <code>_crowdcontrol_session_key</code> cookie value from
+            your logged-in browser (DevTools → Cookies) — not the "API Credentials" token.
           </div>
           <div class="settings-section-body">
             <div id="settings-accounts-manager" style="padding:8px 24px 16px;">
@@ -159,29 +162,13 @@
         </div>
 
         <div class="settings-section" data-tab="platforms">
-          <div class="settings-section-header"> Bug Bounty Platform API Keys</div>
+          <div class="settings-section-header"> External Aggregators &amp; Recon Keys</div>
           <div class="settings-section-description">
-            Credentials for the Programs catalogue. Saved securely on the server (never
-            shown back) and applied immediately — the Programs list refreshes in the
-            background. Leave a field blank to keep the current value.
+            Single-value service keys (not per-account) — an aggregator that pulls extra external
+            programs, and a recon dataset key. Saved to the database; leave a field blank to keep
+            the current value.
           </div>
           <div class="settings-section-body">
-            <div class="settings-item">
-              <div class="settings-label">
-                <div class="settings-title">HackerOne</div>
-                <div class="settings-hint">Username + API token (<a href="https://hackerone.com/settings/api_token" target="_blank" rel="noopener">get a token</a>). ${cfg.h1_token_set ? '<span class="badge badge-done">configured</span>' : '<span class="badge badge-failed">not set</span>'}</div>
-              </div>
-              <div class="settings-control" style="flex-direction:column;align-items:stretch;gap:6px;">
-                <input type="text" id="h1-username-input" value="" placeholder="${cfg.h1_username_set ? 'username saved — type to change' : 'username'}" class="form-control premium-input">
-                <div style="display:flex;gap:8px;">
-                  <input type="password" id="h1-token-input" value="" placeholder="${cfg.h1_token_set ? '••••••• (saved)' : 'API token'}" class="form-control premium-input" style="flex:1;">
-                  <button class="btn btn-primary" onclick="window.SettingsPage.saveH1Creds()">Save</button>
-                </div>
-              </div>
-            </div>
-            ${tokenRow('Bugcrowd', 'The value of your <code>_crowdcontrol_session_key</code> cookie — from your logged-in browser (bugcrowd.com → DevTools → Application/Storage → Cookies). This is the session cookie, <em>not</em> the "API Credentials" token, which this integration can\'t use.', 'bc-token-input', 'window.SettingsPage.saveBugcrowdToken()', '_crowdcontrol_session_key value', cfg.bc_token_set)}
-            ${tokenRow('Intigriti', 'Researcher API token.', 'it-token-input', 'window.SettingsPage.saveIntigritiToken()', 'API token', cfg.it_token_set)}
-            ${tokenRow('YesWeHack', 'JWT token.', 'ywh-token-input', 'window.SettingsPage.saveYWHToken()', 'JWT token', cfg.ywh_token_set)}
             <div class="settings-item">
               <div class="settings-label">
                 <div class="settings-title">HackAdvisor <span style="font-size:10px;color:#f472b6;font-weight:600;">external targets</span></div>

internal/app/app.go

@@ -8,6 +8,7 @@ import (
 	"os/signal"
 	"syscall"
 
+	"github.com/h0tak88r/AutoAR/internal/accounts"
 	"github.com/h0tak88r/AutoAR/internal/api"
 	"github.com/h0tak88r/AutoAR/internal/db"
 	"github.com/h0tak88r/AutoAR/internal/envloader"
@@ -70,6 +71,10 @@ func StartAPI() error {
 	// as the container env provides them.
 	if os.Getenv("DB_HOST") != "" {
 		api.HydrateEnvFromDB()
+		// Import the legacy single-account env credentials into the DB accounts
+		// table (one-shot) so the Settings accounts manager is the single source of
+		// truth. Runs after HydrateEnvFromDB so UI-saved values are picked up too.
+		accounts.MigrateEnvAccounts()
 	}
 
 	// Ensure scans don't remain "running" across restarts (single-instance mode).