Function stateMatches

packages/cli/src/auth/loopback.ts:171–176

* Constant-time comparison for the OAuth `state` parameter. Real * exploitability is very low (loopback, 256-bit entropy, narrow flow * window), but the rest of the auth path uses crypto-grade primitives * and a `!==` here would be a gratuitous deviation in security review.

(actual: string, expected: string)

 * and a `!==` here would be a gratuitous deviation in security review.
 */
function stateMatches(actual: string, expected: string): boolean {
  const a = Buffer.from(actual, "utf8");
  const b = Buffer.from(expected, "utf8");
  if (a.length !== b.length) return false;
  return timingSafeEqual(a, b);
}

function respond(res: ServerResponse, status: number, body: string): void {
  res