// lib/transcoder-auth.ts
// Timing-safe Bearer token verification for transcoder API endpoints.
import { createHash, timingSafeEqual } from "crypto";

/**
 * Verifies the incoming request carries the correct TRANSCODER_SECRET
 * via an "Authorization: Bearer <token>" header.
 *
 * Uses HMAC-SHA256 hashes and timingSafeEqual to prevent timing attacks.
 */
export function verifyTranscoderToken(request: Request): boolean {
  const secret = process.env.TRANSCODER_SECRET;
  if (!secret) return false;

  const auth = request.headers.get("authorization") ?? "";
  if (!auth.startsWith("Bearer ")) return false;

  const token = auth.slice(7);

  try {
    const a = createHash("sha256").update(token).digest();
    const b = createHash("sha256").update(secret).digest();
    return timingSafeEqual(a, b);
  } catch {
    return false;
  }
}