fix(xo-server-openmetrics): generate a 256-bit Prometheus secret

Buffer.from(getRandomValues(new Uint32Array(8))) coerces each 32-bit
element to a single byte, so the generated secret held 64 bits of
entropy instead of 256. Use randomBytes(32) instead.

Introduced by fe29bd0

Author: mpiton

packages/xo-server-openmetrics/src/index.mts

@@ -25,7 +25,7 @@ import { createLogger } from '@xen-orchestra/log'
 import { fork, type ChildProcess } from 'node:child_process'
 import { dirname, join } from 'node:path'
 import { fileURLToPath } from 'node:url'
-import { getRandomValues } from 'node:crypto'
+import { randomBytes } from 'node:crypto'
 import { performance } from 'node:perf_hooks'
 import v8 from 'node:v8'
 
@@ -509,7 +509,7 @@ export async function ensureSecret(
     return secret
   }
 
-  const generated = Buffer.from(getRandomValues(new Uint32Array(8))).toString('hex')
+  const generated = randomBytes(32).toString('hex')
   await persist({ secret: generated })
   return generated
 }

packages/xo-server-openmetrics/src/index.test.mts

@@ -22,7 +22,7 @@ describe('ensureSecret', () => {
       persisted.push(configuration)
     })
 
-    assert.match(secret, /^[0-9a-f]{16}$/)
+    assert.match(secret, /^[0-9a-f]{64}$/)
     assert.deepEqual(persisted, [{ secret }])
   })
 
@@ -32,7 +32,7 @@ describe('ensureSecret', () => {
       persisted.push(configuration)
     })
 
-    assert.match(secret, /^[0-9a-f]{16}$/)
+    assert.match(secret, /^[0-9a-f]{64}$/)
     assert.deepEqual(persisted, [{ secret }])
   })