chore(config): make admin_token a secret

packages/common/config/src/config/auth.rs

@@ -1,16 +1,10 @@
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
+use crate::secret::Secret;
+
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 pub struct Auth {
-	pub admin_token: String,
-}
-
-impl Default for Auth {
-	fn default() -> Self {
-		Auth {
-			admin_token: "admin".to_string(),
-		}
-	}
+	pub admin_token: Secret<String>,
 }

packages/common/config/src/config/mod.rs

@@ -100,7 +100,7 @@ pub struct Root {
 impl Default for Root {
 	fn default() -> Self {
 		Root {
-			auth: Some(Auth::default()),
+			auth: None,
 			guard: None,
 			api_public: None,
 			api_peer: None,

packages/core/guard/server/src/routing/runner.rs

@@ -57,7 +57,7 @@ pub async fn route_request(
 		};
 
 		// Validate token
-		if token != auth.admin_token {
+		if token != auth.admin_token.read() {
 			return Err(rivet_api_builder::ApiForbidden.build());
 		}
 	}