@crvouga/mockingbird-service-postgres 3.12.4 → 3.12.5

package/CHANGELOG.md

@@ -1,9 +1,17 @@
 # Changelog — @crvouga/mockingbird-service-postgres
 
+## 3.12.5 (2026-11-02)
+
+### Fixes and improvements
+
+- compare the admin key in constant time ([2a43141](https://github.com/crvouga/mockingbird/commit/2a43141f50dab41e698c3bbce0c69bf65b40e24e))
+
 ## 3.12.4 (2026-11-02)
 
 ### Fixes and improvements
 
+- stop walkSchema recursing forever on a self-referential $ref ([69464a9](https://github.com/crvouga/mockingbird/commit/69464a9d9e7f468c5e1095125108d4d3d5515431))
+- densify sparse bracket arrays by their written indices ([84a28cb](https://github.com/crvouga/mockingbird/commit/84a28cb182e3d7df91102897f0fc11fca714ba5f))
 - do not save idempotent results for requests that fail validation ([f2161aa](https://github.com/crvouga/mockingbird/commit/f2161aadeae30bcc586e26131da12a7030bdeb11))
 
 ## 3.12.3 (2026-11-02)

package/dist/admin.js

@@ -1562,6 +1562,17 @@ var createNamespaceControls = (options) => {
   };
 };
 
+// ../core/dist/signing.js
+var encoder = new TextEncoder();
+var timingSafeEqual = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+};
+
 // ../core/dist/surface.js
 var ADMIN_ROUTE_REFERENCE = {
   "GET /": "This index: every route and control header, with a one-line summary each.",
@@ -1625,6 +1636,10 @@ var resolveAdminPrefix = (prefix = ADMIN_PREFIX) => {
 };
 var isAdminPath = (path, prefix) => path === prefix || path.startsWith(`${prefix}/`);
 var ADMIN_KEY_HEADER = CONTROL_HEADERS.adminKey;
+var hasAdminKey = (headers, adminKey) => {
+  const sent = headers.get(ADMIN_KEY_HEADER);
+  return sent !== null && timingSafeEqual(sent, adminKey);
+};
 var NAMESPACE_HEADER = CONTROL_HEADERS.namespace;
 var ADMIN_DOCS_URL = "https://mockingbird.chrisvouga.dev/docs/admin-controls";
 var ADMIN_CONTROL_PAGES = [
@@ -2098,7 +2113,7 @@ var createControlPlane = (context) => {
       }
       const path = url.pathname.slice(adminPrefix.length) || "/";
       const shell = request.method === "GET" && (path === "/ui" || path === "/ui/");
-      if (!shell && context.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+      if (!shell && context.adminKey !== void 0 && !hasAdminKey(request.headers, context.adminKey)) {
         return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
       }
       for (const route of routes) {
@@ -9289,9 +9304,9 @@ function cmpString(a, b) {
   }
   return ea.length - eb.length;
 }
-var encoder = new TextEncoder();
+var encoder2 = new TextEncoder();
 function utf8(s) {
-  return encoder.encode(s);
+  return encoder2.encode(s);
 }
 function arrayCompare(t, a, b, ctx) {
   const elem = arrayElemType(t);