Function safeTokenCompare

apps/desktop/main/internal-api.ts:350–354

(a: string, b: string)

const hmacKey = randomBytes(32)

function safeTokenCompare(a: string, b: string): boolean {
  const hashA = createHmac('sha256', hmacKey).update(a).digest()
  const hashB = createHmac('sha256', hmacKey).update(b).digest()
  return timingSafeEqual(hashA, hashB)
}

/**
 * Auth hook for the Internal Server. ALL routes require Bearer token, no exceptions.