Implement X-Callback-Secret for validating API requests

pkg/web/static/js/core.js

@@ -60,7 +60,7 @@ function showBanEventToast(event) {
     + '    <i class="fas fa-shield-alt text-red-500"></i>'
     + '  </div>'
     + '  <div class="flex-1 min-w-0">'
-    + '    <div class="font-semibold text-sm">New Block Detected</div>'
+    + '    <div class="font-semibold text-sm">New block occurred</div>'
     + '    <div class="text-sm mt-1">'
     + '      <span class="font-mono font-semibold">' + escapeHtml(ip) + '</span>'
     + '      <span> banned in </span>'

pkg/web/static/js/settings.js

@@ -48,6 +48,19 @@ function loadSettings() {
       // Set callback URL and add auto-update listener for port changes
       const callbackURLInput = document.getElementById('callbackURL');
       callbackURLInput.value = data.callbackUrl || '';
+      const callbackSecretInput = document.getElementById('callbackSecret');
+      const toggleLink = document.getElementById('toggleCallbackSecretLink');
+      if (callbackSecretInput) {
+        callbackSecretInput.value = data.callbackSecret || '';
+        // Reset to password type when loading
+        if (callbackSecretInput.type === 'text') {
+          callbackSecretInput.type = 'password';
+        }
+        // Update link text
+        if (toggleLink) {
+          toggleLink.textContent = 'show secret';
+        }
+      }
       
       // Auto-update callback URL when port changes (if using default localhost pattern)
       function updateCallbackURLIfDefault() {
@@ -159,6 +172,7 @@ function saveSettings(event) {
     debug: document.getElementById('debugMode').checked,
     destemail: document.getElementById('destEmail').value.trim(),
     callbackUrl: callbackUrl,
+    callbackSecret: document.getElementById('callbackSecret').value.trim(),
     alertCountries: selectedCountries.length > 0 ? selectedCountries : ["ALL"],
     bantimeIncrement: document.getElementById('bantimeIncrement').checked,
     defaultJailEnable: document.getElementById('defaultJailEnable').checked,
@@ -428,3 +442,15 @@ if (advancedIntegrationSelect) {
   advancedIntegrationSelect.addEventListener('change', updateAdvancedIntegrationFields);
 }
 
+// Toggle callback secret visibility
+function toggleCallbackSecretVisibility() {
+  const input = document.getElementById('callbackSecret');
+  const link = document.getElementById('toggleCallbackSecretLink');
+  
+  if (!input || !link) return;
+  
+  const isPassword = input.type === 'password';
+  input.type = isPassword ? 'text' : 'password';
+  link.textContent = isPassword ? 'hide secret' : 'show secret';
+}
+