1import type { Env } from "./env.ts";23/** Constant-time string comparison over UTF-8 bytes. */4function timingSafeEqual(a: string, b: string): boolean {5 const enc = new TextEncoder();6 const ab = enc.encode(a);7 const bb = enc.encode(b);8 // Length leak is fine: token length is not secret.9 if (ab.length !== bb.length) return false;10 let diff = 0;11 for (let i = 0; i < ab.length; i++) diff |= ab[i] ^ bb[i];12 return diff === 0;13}1415export function checkBearer(req: Request, env: Env): boolean {16 const header = req.headers.get("authorization") ?? "";17 if (!header.startsWith("Bearer ")) return false;18 return timingSafeEqual(header.slice(7).trim(), env.NZIP_TOKEN);19}