fix(security): constant-time comparison for Bearer auth tokens

[devin-ai-integration]

Summary

The Bearer auth-token check compared the client-supplied token to the configured auth_token with plain string equality, which short-circuits on the first mismatching byte and is therefore vulnerable to a timing side-channel that can be used to recover the token byte-by-byte. This affects both the proxy entrypoint and the management API (/api/v1).

Fix: use crypto/subtle.ConstantTimeCompare in both auth paths.

// internal/service/server/server.go — checkAuth
-return strings.TrimSpace(auth[7:]) == expectedToken
+provided := strings.TrimSpace(auth[7:])
+return subtle.ConstantTimeCompare([]byte(provided), []byte(expectedToken)) == 1

// internal/service/api/helpers.go — AuthMiddleware
-if strings.TrimSpace(auth[7:]) != token {
+provided := strings.TrimSpace(auth[7:])
+if subtle.ConstantTimeCompare([]byte(provided), []byte(token)) != 1 {

Behavior is otherwise unchanged (empty configured token still means "no auth"; missing/malformed Authorization headers still 401). go build, go vet, and the server/api package tests pass.

Scan notes

Also scanned for the other requested classes; no additional critical fixes were needed:

• Hardcoded secrets: none found; example env files use placeholders, real secrets are .gitignored.
• SQL injection: queries use ? placeholders; only table names / ASC/DESC are interpolated and those are internal constants.
• Path traversal: trace writer sanitizes path segments and the console asset FS rejects ...
• CORS: no permissive CORS headers are set.
• Config export: plaintext secret export is gated behind auth + an explicit X-Confirm-Secrets header; other config endpoints mask secrets.
• Default bind: 127.0.0.1; Cloudflare worker refuses to start in production without an auth_token.

Link to Devin session: https://app.devin.ai/sessions/5ff0131d35aa41de98235c94b1606d8d
Requested by: @ZhiYi-R

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring