validateAuthToken (utils/auth-token.ts)

Validates HTTP bearer tokens against an allow-list for secure API access.

// Source: https://github.com/bytebase/dbhub | License: MIT | Copyright 2025 Bytebase
// Provided via justclaw.it.com; keep this notice with the code.
import { timingSafeEqual } from "node:crypto";

/**
 * Result of validating an HTTP request's `Authorization` header against the
 * configured bearer token allow-list.
 */
export type AuthTokenValidation =
  | { ok: true }
  | { ok: false; status: 401; message: string };

const BEARER_PREFIX = "Bearer ";

/**
 * Constant-time string equality. `timingSafeEqual` throws on unequal-length
 * buffers, so unequal lengths are rejected up front — this leaks only the
 * length of the configured token, not which bytes matched, which is the same
 * trade-off `timingSafeEqual` itself makes.
 */
function constantTimeEqual(a: string, b: string): boolean {

... (truncated -- full source via MCP)