safe-global / safe-events-service / 26511185053

87%

push

github

fix: harden auth with constant-time comparison (#523)

* fix: harden auth with constant-time comparison

- Deny AdminWebhookGuard access when ADMIN_WEBHOOK_AUTH is unset, instead of accepting an empty `Basic ` credential, and log that it must be set.
- Replace timing-unsafe `===` comparisons in BasicAuthGuard and AdminWebhookGuard with a constant-time check.
- Extract shared safeCompare util (timingSafeEqual) and reuse it in the guards and AuthService, removing duplicated comparison logic.
- Add unit tests for safeCompare.

* Add tests for AuthGuard

241 of 280 branches covered (86.07%)

Branch coverage included in aggregate %.

17 of 17 new or added lines in 3 files covered. (100.0%)

632 of 728 relevant lines covered (86.81%)

17.35 hits per line