Function safeEq

src/node/orpc/authMiddleware.ts:16–30

(a: string, b: string)

// Tradeoff: this allocates temporary buffers. That's acceptable here (called once
// per auth check) and avoids tricky timing branches.
export function safeEq(a: string, b: string): boolean {
  const bufA = Buffer.from(a);
  const bufB = Buffer.from(b);

  const maxLen = Math.max(bufA.length, bufB.length);

  // timingSafeEqual requires equal-length buffers.
  const paddedA = Buffer.alloc(maxLen);
  const paddedB = Buffer.alloc(maxLen);
  bufA.copy(paddedA);
  bufB.copy(paddedB);

  const bytesMatch = timingSafeEqual(paddedA, paddedB);
  return bytesMatch && bufA.length === bufB.length;
}

function extractBearerToken(header: string | string[] | undefined): string | null {
  const h = Array.isArray(header) ? header[0] : header;