feat: secrets of clients now need to be hashed, added command to create hash

internal/server/server.go

@@ -14,6 +14,7 @@ import (
 	"github.com/prometheus/client_golang/prometheus/promauto"
 	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"go.uber.org/zap"
+	"golang.org/x/crypto/bcrypt"
 )
 
 var (
@@ -77,8 +78,14 @@ func NewRouter(cfg *config.Config, logger *zap.Logger, prov pvd.Provider) *gin.E
 			ip = c.ClientIP()
 		}
 		clientCfg, ok := cfg.Clients[req.Key]
-		if !ok || req.Secret != clientCfg.Secret {
+		// Compare the provided secret with the stored hash
+		err := bcrypt.CompareHashAndPassword([]byte(clientCfg.SecretHash), []byte(req.Secret))
+		if !ok || err != nil {
 			failedUpdates.Inc()
+			// Log the error only if it's not a not found error, to avoid logging failed auth attempts excessively
+			if err != nil && err != bcrypt.ErrMismatchedHashAndPassword {
+				logger.Error("bcrypt comparison failed", zap.Error(err))
+			}
 			c.JSON(http.StatusUnauthorized, gin.H{"status": "error", "message": "invalid key or secret"})
 			return
 		}