validateApiKey() compares API keys with plain === instead of a timing-safe comparison

[sshdopey]

Where: src/lib/apiKeys.ts, validateApiKey() (lines ~126-144).

What's wrong:

export function validateApiKey(key: string): ApiKey | null {
  for (const apiKey of keysStore.values()) {
    if (apiKey.status !== "active") continue;
    if (apiKey.key === key) return apiKey;
    if (apiKey.old_key && apiKey.new_key_expires_at && now < apiKey.new_key_expires_at) {
      if (apiKey.old_key === key) return apiKey;
    }
  }
  return null;
}

Both the current-key and grace-period-old-key comparisons use plain ===.
This is the same class of issue as the admin-key comparisons flagged
separately (apiKeyAuth.ts, graphql/schema.ts) — the codebase has
lib/timing-safe.ts precisely for this purpose but it isn't used here,
even though this function is on the live path for GraphQL API-key auth
(createGraphQLContext calls it directly).

Suggested fix: use timingSafeCompare(apiKey.key, key) (and likewise for
old_key) instead of ===.

[BernardOnuh]

@BernardOnuh has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hey Maintainer! I’m keen to work on this. I’m available to start immediately. Please assign this issue to me.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @BernardOnuh to this issue.

[drips-wave]

Congratulations, @BernardOnuh! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @BernardOnuh: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[BernardOnuh]

Resolved on main — no code changes needed.

Commit 304365f ("fix: resolve issue #507 (#607)") already replaced both plain === comparisons in validateApiKey() (src/lib/apiKeys.ts):

• Current key: timingSafeCompare(apiKey.key, key) (line 133)
• Grace-period old key: timingSafeCompare(apiKey.old_key, key) (line 139)

timingSafeCompare (src/lib/timing-safe.ts) hashes both inputs with SHA-256 before a fixed-length timingSafeEqual, so it leaks neither content nor length.

Verified on current main (HEAD 304365f). Closing as fixed.

[BernardOnuh]

Resolved on main — no code changes needed.

Commit 304365f ("fix: resolve issue #507 (#607)") already replaced both plain === comparisons in validateApiKey() (src/lib/apiKeys.ts):

• Current key: timingSafeCompare(apiKey.key, key) (line 133)
• Grace-period old key: timingSafeCompare(apiKey.old_key, key) (line 139)

timingSafeCompare (src/lib/timing-safe.ts) hashes both inputs with SHA-256 before a fixed-length timingSafeEqual, so it leaks neither content nor length.

Verified on current main (HEAD 304365f).

Note: I attempted to close this issue as the assignee but the account lacks permission to run CloseIssue. Could a maintainer close it as completed (or review request me to close it)? For visibility, src/lib/email.ts:84 has a similar plain === on unsubscribe_token if you'd like a follow-up issue.