misc: addressed comments

backend/src/ee/routes/v1/proxy-router.ts

@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { getConfig } from "@app/lib/config/env";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -38,8 +39,14 @@ export const registerProxyRouter = async (server: FastifyZodProvider) => {
     onRequest: (req, _, next) => {
       const authHeader = req.headers.authorization;
 
-      if (appCfg.PROXY_AUTH_SECRET && authHeader === `Bearer ${appCfg.PROXY_AUTH_SECRET}`) {
-        return next();
+      if (appCfg.PROXY_AUTH_SECRET && authHeader) {
+        const expectedHeader = `Bearer ${appCfg.PROXY_AUTH_SECRET}`;
+        if (
+          authHeader.length === expectedHeader.length &&
+          crypto.nativeCrypto.timingSafeEqual(Buffer.from(authHeader), Buffer.from(expectedHeader))
+        ) {
+          return next();
+        }
       }
 
       throw new UnauthorizedError({

backend/src/ee/routes/v2/gateway-router.ts

@@ -1,7 +1,7 @@
 import z from "zod";
 
 import { GatewaysV2Schema } from "@app/db/schemas";
-import { writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 
@@ -40,6 +40,9 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         })
       }
     },
+    config: {
+      rateLimit: writeLimit
+    },
     onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const gateway = await server.services.gatewayV2.registerGateway({
@@ -90,6 +93,9 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         }).array()
       }
     },
+    config: {
+      rateLimit: readLimit
+    },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const gateways = await server.services.gatewayV2.listGateways({

backend/src/lib/crypto/cryptography/crypto.ts

@@ -421,7 +421,8 @@ const cryptographyFactory = () => {
       constants: crypto.constants,
       X509Certificate: crypto.X509Certificate,
       KeyObject: crypto.KeyObject,
-      Hash: crypto.Hash
+      Hash: crypto.Hash,
+      timingSafeEqual: crypto.timingSafeEqual
     }
   };
 };