P2 — Deduplicate `safeEqual` in middleware using timingSafeEqual

[itsmiso-ai]

Problem

src/middleware.ts:28-33 contains a safeEqual function with a timing leak:

function safeEqual(a: string, b: string): boolean {
 if (a.length !== b.length) return false; // ← early return leaks length difference
 let result = 0;
 for (let i = 0; i < a.length; i += 1) {
 result |= a.charCodeAt(i) ^ b.charCodeAt(i);
 }
 return result === 0;
}

Issues:

1. Timing leak — early return on length mismatch leaks string length difference
2. Duplication — identical function (with timing-safe Buffer comparison) exists in src/lib/dispatch-env.ts using Node's crypto.timingSafeEqual
3. Used in isBearerAuthorized and isBasicAuthorized

Recommended Fix

Import safeEqual from @/lib/dispatch-env in middleware, or deduplicate to a shared src/lib/crypto.ts.

Acceptance Criteria

• Middleware uses timing-safe comparison (no early return on length mismatch)
• No duplicate implementation of safeEqual
• Both isBearerAuthorized and isBasicAuthorized use the shared function

Parent: #235 (Weekly tech debt audit: 2026-05-27)

Labels: audit