From 09d179f30d1f1bbaeda703d7fe3cc61834608ba7 Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Fri, 5 Sep 2025 23:36:48 +0800
Subject: [PATCH] misc: addressed comments

---
 backend/src/ee/routes/v1/proxy-router.ts      | 11 +++++++++--
 backend/src/ee/routes/v2/gateway-router.ts    |  8 +++++++-
 backend/src/lib/crypto/cryptography/crypto.ts |  3 ++-
 3 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/backend/src/ee/routes/v1/proxy-router.ts b/backend/src/ee/routes/v1/proxy-router.ts
index d7742baa7..3fe225ab2 100644
--- a/backend/src/ee/routes/v1/proxy-router.ts
+++ b/backend/src/ee/routes/v1/proxy-router.ts
@@ -1,6 +1,7 @@
 import { z } from "zod";
 
 import { getConfig } from "@app/lib/config/env";
+import { crypto } from "@app/lib/crypto/cryptography";
 import { BadRequestError, UnauthorizedError } from "@app/lib/errors";
 import { writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
@@ -38,8 +39,14 @@ export const registerProxyRouter = async (server: FastifyZodProvider) => {
     onRequest: (req, _, next) => {
       const authHeader = req.headers.authorization;
 
-      if (appCfg.PROXY_AUTH_SECRET && authHeader === `Bearer ${appCfg.PROXY_AUTH_SECRET}`) {
-        return next();
+      if (appCfg.PROXY_AUTH_SECRET && authHeader) {
+        const expectedHeader = `Bearer ${appCfg.PROXY_AUTH_SECRET}`;
+        if (
+          authHeader.length === expectedHeader.length &&
+          crypto.nativeCrypto.timingSafeEqual(Buffer.from(authHeader), Buffer.from(expectedHeader))
+        ) {
+          return next();
+        }
       }
 
       throw new UnauthorizedError({
diff --git a/backend/src/ee/routes/v2/gateway-router.ts b/backend/src/ee/routes/v2/gateway-router.ts
index 114672a23..4ab3f5ec2 100644
--- a/backend/src/ee/routes/v2/gateway-router.ts
+++ b/backend/src/ee/routes/v2/gateway-router.ts
@@ -1,7 +1,7 @@
 import z from "zod";
 
 import { GatewaysV2Schema } from "@app/db/schemas";
-import { writeLimit } from "@app/server/config/rateLimiter";
+import { readLimit, writeLimit } from "@app/server/config/rateLimiter";
 import { verifyAuth } from "@app/server/plugins/auth/verify-auth";
 import { AuthMode } from "@app/services/auth/auth-type";
 
@@ -40,6 +40,9 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         })
       }
     },
+    config: {
+      rateLimit: writeLimit
+    },
     onRequest: verifyAuth([AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const gateway = await server.services.gatewayV2.registerGateway({
@@ -90,6 +93,9 @@ export const registerGatewayV2Router = async (server: FastifyZodProvider) => {
         }).array()
       }
     },
+    config: {
+      rateLimit: readLimit
+    },
     onRequest: verifyAuth([AuthMode.JWT, AuthMode.IDENTITY_ACCESS_TOKEN]),
     handler: async (req) => {
       const gateways = await server.services.gatewayV2.listGateways({
diff --git a/backend/src/lib/crypto/cryptography/crypto.ts b/backend/src/lib/crypto/cryptography/crypto.ts
index b8fc45645..b6fd44f41 100644
--- a/backend/src/lib/crypto/cryptography/crypto.ts
+++ b/backend/src/lib/crypto/cryptography/crypto.ts
@@ -421,7 +421,8 @@ const cryptographyFactory = () => {
       constants: crypto.constants,
       X509Certificate: crypto.X509Certificate,
       KeyObject: crypto.KeyObject,
-      Hash: crypto.Hash
+      Hash: crypto.Hash,
+      timingSafeEqual: crypto.timingSafeEqual
     }
   };
 };