@crvouga/mockingbird-service-stripe 3.10.3 → 3.10.4

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog — @crvouga/mockingbird-service-stripe
 
+## 3.10.4 (2026-11-02)
+
+### Fixes and improvements
+
+- compare the admin key in constant time ([2a43141](https://github.com/crvouga/mockingbird/commit/2a43141f50dab41e698c3bbce0c69bf65b40e24e))
+
 ## 3.10.3 (2026-11-02)
 
 ### Fixes and improvements

package/dist/{chunk-SOIQVFQD.js → chunk-AL3LIES3.js}

@@ -1,10 +1,10 @@
 import {
   createRuntime,
   validateAccounts
-} from "./chunk-KXNVS35C.js";
+} from "./chunk-BM3DUOET.js";
 import {
   listen
-} from "./chunk-KHNJCSHG.js";
+} from "./chunk-RSTEXFHT.js";
 
 // src/server.ts
 import { readFileSync } from "node:fs";
@@ -87,4 +87,4 @@ export {
   createServer,
   serveTarget
 };
-//# sourceMappingURL=chunk-SOIQVFQD.js.map
+//# sourceMappingURL=chunk-AL3LIES3.js.map

package/dist/{chunk-KXNVS35C.js → chunk-BM3DUOET.js}

@@ -17,7 +17,7 @@ import {
   requestBaseUrl,
   resolveSchema,
   signers
-} from "./chunk-NUTYUHW7.js";
+} from "./chunk-HN7EI4ER.js";
 
 // src/account.ts
 var accountOfKey = (key) => `acct_${opaqueToken(key, 8)}`;
@@ -15879,4 +15879,4 @@ export {
   createRuntime2 as createRuntime,
   StripeAPI
 };
-//# sourceMappingURL=chunk-KXNVS35C.js.map
+//# sourceMappingURL=chunk-BM3DUOET.js.map

package/dist/{chunk-NUTYUHW7.js → chunk-HN7EI4ER.js}

@@ -2482,6 +2482,46 @@ var createNamespaceControls = (options) => {
   };
 };
 
+// ../core/dist/signing.js
+var encoder = new TextEncoder();
+var toBase64 = (bytes) => {
+  let binary = "";
+  for (const byte of bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)) {
+    binary += String.fromCharCode(byte);
+  }
+  return btoa(binary);
+};
+var fromBase64 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
+var toHex = (bytes) => [...bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+var keyBytes = (key) => typeof key === "string" ? encoder.encode(key) : key;
+var hmac = async (algorithm, key, message, encoding = "hex") => {
+  const imported = await crypto.subtle.importKey("raw", keyBytes(key), { name: "HMAC", hash: algorithm }, false, ["sign"]);
+  const signed = await crypto.subtle.sign("HMAC", imported, typeof message === "string" ? encoder.encode(message) : message);
+  return encoding === "hex" ? toHex(signed) : toBase64(signed);
+};
+var svixSecretBytes = (secret) => {
+  const raw = secret.replace(/^f?whsec_/, "");
+  try {
+    return fromBase64(raw);
+  } catch {
+    throw new TypeError("webhook secret must be whsec_<base64> (as Svix issues it)");
+  }
+};
+var signSvix = async (secret, messageId, timestampSeconds, body) => `v1,${await hmac("SHA-256", svixSecretBytes(secret), `${messageId}.${timestampSeconds}.${body}`, "base64")}`;
+var signTimestamped = async (secret, timestampSeconds, body) => `t=${timestampSeconds},v1=${await hmac("SHA-256", secret, `${timestampSeconds}.${body}`, "hex")}`;
+var signTwilio = async (authToken, url, params) => {
+  const payload = url + Object.keys(params).sort().map((key) => `${key}${params[key]}`).join("");
+  return hmac("SHA-1", authToken, payload, "base64");
+};
+var timingSafeEqual = (a, b) => {
+  if (a.length !== b.length)
+    return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++)
+    diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+};
+
 // ../core/dist/surface.js
 var defineMock = (runtime) => runtime;
 var ADMIN_ROUTE_REFERENCE = {
@@ -2600,6 +2640,10 @@ var assertAdminPrefixAvailable = (prefix, paths) => {
   }
 };
 var ADMIN_KEY_HEADER = CONTROL_HEADERS.adminKey;
+var hasAdminKey = (headers, adminKey) => {
+  const sent = headers.get(ADMIN_KEY_HEADER);
+  return sent !== null && timingSafeEqual(sent, adminKey);
+};
 var NAMESPACE_HEADER = CONTROL_HEADERS.namespace;
 var ADMIN_DOCS_URL = "https://mockingbird.chrisvouga.dev/docs/admin-controls";
 var ADMIN_CONTROL_PAGES = [
@@ -3073,7 +3117,7 @@ var createControlPlane = (context) => {
       }
       const path = url.pathname.slice(adminPrefix.length) || "/";
       const shell = request.method === "GET" && (path === "/ui" || path === "/ui/");
-      if (!shell && context.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== context.adminKey) {
+      if (!shell && context.adminKey !== void 0 && !hasAdminKey(request.headers, context.adminKey)) {
         return adminError(401, `missing or wrong ${ADMIN_KEY_HEADER}`);
       }
       for (const route of routes) {
@@ -3874,39 +3918,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.10.3" : UNRELEASED_VERSION;
-
-// ../core/dist/signing.js
-var encoder = new TextEncoder();
-var toBase64 = (bytes) => {
-  let binary = "";
-  for (const byte of bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)) {
-    binary += String.fromCharCode(byte);
-  }
-  return btoa(binary);
-};
-var fromBase64 = (value) => Uint8Array.from(atob(value), (char) => char.charCodeAt(0));
-var toHex = (bytes) => [...bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
-var keyBytes = (key) => typeof key === "string" ? encoder.encode(key) : key;
-var hmac = async (algorithm, key, message, encoding = "hex") => {
-  const imported = await crypto.subtle.importKey("raw", keyBytes(key), { name: "HMAC", hash: algorithm }, false, ["sign"]);
-  const signed = await crypto.subtle.sign("HMAC", imported, typeof message === "string" ? encoder.encode(message) : message);
-  return encoding === "hex" ? toHex(signed) : toBase64(signed);
-};
-var svixSecretBytes = (secret) => {
-  const raw = secret.replace(/^f?whsec_/, "");
-  try {
-    return fromBase64(raw);
-  } catch {
-    throw new TypeError("webhook secret must be whsec_<base64> (as Svix issues it)");
-  }
-};
-var signSvix = async (secret, messageId, timestampSeconds, body) => `v1,${await hmac("SHA-256", svixSecretBytes(secret), `${messageId}.${timestampSeconds}.${body}`, "base64")}`;
-var signTimestamped = async (secret, timestampSeconds, body) => `t=${timestampSeconds},v1=${await hmac("SHA-256", secret, `${timestampSeconds}.${body}`, "hex")}`;
-var signTwilio = async (authToken, url, params) => {
-  const payload = url + Object.keys(params).sort().map((key) => `${key}${params[key]}`).join("");
-  return hmac("SHA-1", authToken, payload, "base64");
-};
+var PACKAGE_VERSION = true ? "3.10.4" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var signers = {
@@ -5303,7 +5315,7 @@ var createRuntime = (options) => {
         throw error;
       }
       const rewinds = at !== void 0 && selectedBranch === "main" && MUTATING_METHODS.has(request.method);
-      if ((requested || rewinds) && options.adminKey !== void 0 && request.headers.get(ADMIN_KEY_HEADER) !== options.adminKey)
+      if ((requested || rewinds) && options.adminKey !== void 0 && !hasAdminKey(request.headers, options.adminKey))
         return refuse(401, `control headers need ${ADMIN_KEY_HEADER}`);
       controls.ensure(namespace);
       if (requested?.restore !== void 0 && !snapshotStore.get(namespace, requested.restore))
@@ -5837,4 +5849,4 @@ export {
   createRuntime,
   signV4
 };
-//# sourceMappingURL=chunk-NUTYUHW7.js.map
+//# sourceMappingURL=chunk-HN7EI4ER.js.map