feat: name change + bugfixes

internal/auth/auth.go

@@ -1,6 +1,7 @@
 package auth
 
 import (
+	"crypto/subtle"
 	"net/http"
 	"os"
 )
@@ -15,7 +16,9 @@ func AdminAuth() gin.HandlerFunc {
 
 	return func(c *gin.Context) {
 
-		if c.GetHeader("X-Admin-Token") != token {
+		// Without a configured token every admin request is refused, never allowed
+		provided := c.GetHeader("X-Admin-Token")
+		if token == "" || subtle.ConstantTimeCompare([]byte(provided), []byte(token)) != 1 {
 			c.AbortWithStatusJSON(http.StatusUnauthorized, gin.H{
 				"error": "Unauthorized",
 			})