import { timingSafeEqual } from 'node:crypto';
/** Reject short configuration secrets and compare byte strings in constant time. */
export function verifyAdminKey(provided: string | null | undefined, expected: string | undefined) {
  if (typeof provided !== 'string' || typeof expected !== 'string' || expected.length < 32) return false;
  const a = Buffer.from(provided, 'utf8');
  const b = Buffer.from(expected, 'utf8');
  return a.length === b.length && timingSafeEqual(a, b);
}