@crvouga/mockingbird-service-oauth 3.11.5 → 3.11.6

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — @crvouga/mockingbird-service-oauth
 
+## 3.11.6 (2026-11-02)
+
+### Fixes and improvements
+
+- compare the admin key in constant time ([2a43141](https://github.com/crvouga/mockingbird/commit/2a43141f50dab41e698c3bbce0c69bf65b40e24e))
+
 ## 3.11.5 (2026-11-02)
 
 ### Fixes and improvements

package/dist/{chunk-EFBIR4YL.js → chunk-BWGDZLMA.js}

@@ -2461,6 +2461,17 @@ var createNamespaceControls = (options) => {
   };
 };
 
+// ../core/dist/signing.js
+var encoder = new TextEncoder();
+var timingSafeEqual = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+};
+
 // ../core/dist/surface.js
 var defineMock = (runtime) => runtime;
 var ADMIN_ROUTE_REFERENCE = {
@@ -2579,6 +2590,10 @@ var assertAdminPrefixAvailable = (prefix, paths) => {
   }
 };
 var ADMIN_KEY_HEADER = CONTROL_HEADERS.adminKey;
+var hasAdminKey = (headers, adminKey) => {
+  const sent = headers.get(ADMIN_KEY_HEADER);
+  return sent !== null && timingSafeEqual(sent, adminKey);
+};
 var NAMESPACE_HEADER = CONTROL_HEADERS.namespace;
 var ADMIN_DOCS_URL = "https://mockingbird.chrisvouga.dev/docs/admin-controls";
 var ADMIN_CONTROL_PAGES = [
@@ -3052,7 +3067,7 @@ var createControlPlane = (context) => {
       }
       const path = url.pathname.slice(adminPrefix.length) || "/";
       const shell = request.method === "GET" && (path === "/ui" || path === "/ui/");
-      if (!shell && context.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+      if (!shell && context.adminKey !== void 0 && !hasAdminKey(request.headers, context.adminKey)) {
         return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
       }
       for (const route of routes) {
@@ -3807,7 +3822,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.11.5" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "3.11.6" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json4 = (status, body) => new Response(JSON.stringify(body), {
@@ -4786,7 +4801,7 @@ var createRuntime = (options) => {
         throw error;
       }
       const rewinds = at !== void 0 && selectedBranch === "main" && MUTATING_METHODS.has(request.method);
-      if ((requested || rewinds) && options.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== options.adminKey)
+      if ((requested || rewinds) && options.adminKey !== void 0 && !hasAdminKey(request.headers, options.adminKey))
         return refuse(401, `control headers need ${ADMIN_KEY_HEADER}`);
       controls.ensure(namespace);
       if (requested?.restore !== void 0 && !snapshotStore.get(namespace, requested.restore))
@@ -5278,10 +5293,10 @@ var BehaviorState = class {
 };
 
 // src/crypto.ts
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 var base64url = (bytes) => btoa(String.fromCharCode(...bytes)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
 var random = () => base64url(crypto.getRandomValues(new Uint8Array(32)));
-var hash = async (value) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))));
+var hash = async (value) => base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", encoder2.encode(value))));
 var RSA = { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" };
 var Signer = class {
   pair;
@@ -5313,20 +5328,20 @@ var Signer = class {
   }
   async sign(claims) {
     const header = base64url(
-      encoder.encode(JSON.stringify({ alg: "RS256", kid: this.kid, typ: "JWT" }))
+      encoder2.encode(JSON.stringify({ alg: "RS256", kid: this.kid, typ: "JWT" }))
     );
-    const payload = base64url(encoder.encode(JSON.stringify(claims)));
+    const payload = base64url(encoder2.encode(JSON.stringify(claims)));
     const input = `${header}.${payload}`;
     const signature = await crypto.subtle.sign(
       "RSASSA-PKCS1-v1_5",
       (await this.pair).privateKey,
-      encoder.encode(input)
+      encoder2.encode(input)
     );
     return `${input}.${base64url(new Uint8Array(signature))}`;
   }
 };
 var halfHash = async (value) => base64url(
-  new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(value))).slice(0, 16)
+  new Uint8Array(await crypto.subtle.digest("SHA-256", encoder2.encode(value))).slice(0, 16)
 );
 async function verifyAppleSecret(token, clientId, apple, now) {
   try {
@@ -5350,7 +5365,7 @@ async function verifyAppleSecret(token, clientId, apple, now) {
       { name: "ECDSA", hash: "SHA-256" },
       key,
       decode(signature),
-      encoder.encode(`${header}.${payload}`)
+      encoder2.encode(`${header}.${payload}`)
     );
   } catch {
     return false;
@@ -7473,4 +7488,4 @@ export {
   createMultiRuntime,
   OAuthAPI
 };
-//# sourceMappingURL=chunk-EFBIR4YL.js.map
+//# sourceMappingURL=chunk-BWGDZLMA.js.map