Chore: Remove public vars in setting package (#81018)

Removes the public variable setting.SecretKey plus some other ones. 
Introduces some new functions for creating setting.Cfg.

pkg/services/auth/authimpl/auth_token.go

@@ -66,7 +66,7 @@ type UserAuthTokenService struct {
 }
 
 func (s *UserAuthTokenService) CreateToken(ctx context.Context, user *user.User, clientIP net.IP, userAgent string) (*auth.UserToken, error) {
-	token, hashedToken, err := generateAndHashToken()
+	token, hashedToken, err := generateAndHashToken(s.cfg.SecretKey)
 	if err != nil {
 		return nil, err
 	}
@@ -112,7 +112,7 @@ func (s *UserAuthTokenService) CreateToken(ctx context.Context, user *user.User,
 }
 
 func (s *UserAuthTokenService) LookupToken(ctx context.Context, unhashedToken string) (*auth.UserToken, error) {
-	hashedToken := hashToken(unhashedToken)
+	hashedToken := hashToken(s.cfg.SecretKey, unhashedToken)
 	var model userAuthToken
 	var exists bool
 	var err error
@@ -249,7 +249,7 @@ func (s *UserAuthTokenService) rotateToken(ctx context.Context, token *auth.User
 		clientIPStr = clientIP.String()
 	}
 
-	newToken, hashedToken, err := generateAndHashToken()
+	newToken, hashedToken, err := generateAndHashToken(s.cfg.SecretKey)
 	if err != nil {
 		return nil, err
 	}
@@ -338,7 +338,7 @@ func (s *UserAuthTokenService) TryRotateToken(ctx context.Context, token *auth.U
 		if err != nil {
 			return nil, err
 		}
-		hashedToken := hashToken(newToken)
+		hashedToken := hashToken(s.cfg.SecretKey, newToken)
 
 		// very important that auth_token_seen is set after the prev_auth_token = case when ... for mysql to function correctly
 		sql := `
@@ -627,18 +627,18 @@ func createToken() (string, error) {
 	return token, nil
 }
 
-func hashToken(token string) string {
-	hashBytes := sha256.Sum256([]byte(token + setting.SecretKey))
+func hashToken(secretKey string, token string) string {
+	hashBytes := sha256.Sum256([]byte(token + secretKey))
 	return hex.EncodeToString(hashBytes[:])
 }
 
-func generateAndHashToken() (string, string, error) {
+func generateAndHashToken(secretKey string) (string, string, error) {
 	token, err := createToken()
 	if err != nil {
 		return "", "", err
 	}
 
-	return token, hashToken(token), nil
+	return token, hashToken(secretKey, token), nil
 }
 
 func readQuotaConfig(cfg *setting.Cfg) (*quota.Map, error) {

pkg/services/auth/authimpl/auth_token_test.go

@@ -479,14 +479,14 @@ func TestIntegrationUserAuthToken(t *testing.T) {
 			token, err = ctx.tokenService.RotateToken(context.Background(), auth.RotateCommand{UnHashedToken: token.UnhashedToken})
 			require.NoError(t, err)
 			assert.True(t, token.UnhashedToken != prev)
-			assert.True(t, token.PrevAuthToken == hashToken(prev))
+			assert.True(t, token.PrevAuthToken == hashToken("", prev))
 		})
 
 		t.Run("should rotate token when called with previous", func(t *testing.T) {
 			newPrev := token.UnhashedToken
 			token, err = ctx.tokenService.RotateToken(context.Background(), auth.RotateCommand{UnHashedToken: prev})
 			require.NoError(t, err)
-			assert.True(t, token.PrevAuthToken == hashToken(newPrev))
+			assert.True(t, token.PrevAuthToken == hashToken("", newPrev))
 		})
 
 		t.Run("should not rotate token when called with old previous", func(t *testing.T) {