Do not expose credentials as persistent attributes

tests/test_sdk.py

@@ -140,6 +140,18 @@ def test_mock_register(self, mock_post):
         resp = self.base.register(email=os.getenv("WATTTIME_EMAIL"))
         self.assertEqual(len(mock_post.call_args_list), 1)
 
+    def test_get_password(self):
+
+        with mock.patch.dict(os.environ, {}, clear=True), self.assertRaises(ValueError):
+            wt_base = WattTimeBase()
+
+        with mock.patch.dict(os.environ, {}, clear=True):
+            wt_base = WattTimeBase(
+                username="WATTTIME_USERNAME", password="WATTTIME_PASSWORD"
+            )
+            self.assertEqual(wt_base.username, "WATTTIME_USERNAME")
+            self.assertEqual(wt_base.password, "WATTTIME_PASSWORD")
+
 
 class TestWattTimeHistorical(unittest.TestCase):
     def setUp(self):

watttime/api.py

@@ -31,8 +31,17 @@ def __init__(
             username (Optional[str]): The username to use for authentication. If not provided, the value will be retrieved from the environment variable "WATTTIME_USER".
             password (Optional[str]): The password to use for authentication. If not provided, the value will be retrieved from the environment variable "WATTTIME_PASSWORD".
         """
-        self.username = username or os.getenv("WATTTIME_USER")
-        self.password = password or os.getenv("WATTTIME_PASSWORD")
+
+        # This only applies to the current session, is not stored persistently
+        if username and not os.getenv("WATTTIME_USER"):
+            os.environ["WATTTIME_USER"] = username
+        if password and not os.getenv("WATTTIME_PASSWORD"):
+            os.environ["WATTTIME_PASSWORD"] = password
+
+        # Accessing attributes will raise exception if variables are not set
+        _ = self.password
+        _ = self.username
+
         self.token = None
         self.headers = None
         self.token_valid_until = None
@@ -47,6 +56,28 @@ def __init__(
             )  # prevent multiple threads from modifying _last_request_times simultaneously
             self._rate_limit_condition = threading.Condition(self._rate_limit_lock)
 
+    @property
+    def password(self):
+        password = os.getenv("WATTTIME_PASSWORD")
+        if not password:
+            raise ValueError(
+                "WATTTIME_PASSWORD env variable is not set."
+                + "Please set this variable, or pass in a password upon initialization,"
+                + "which will store it as a variable only for the current session"
+            )
+        return password
+
+    @property
+    def username(self):
+        username = os.getenv("WATTTIME_USER")
+        if not username:
+            raise ValueError(
+                "WATTTIME_USER env variable is not set."
+                + "Please set this variable, or pass in a username upon initialization,"
+                + "which will store it as a variable only for the current session"
+            )
+        return username
+
     def _login(self):
         """
         Login to the WattTime API, which provides a JWT valid for 30 minutes