import { timingSafeEqual } from 'node:crypto';

/**
 * Constant-time string comparison. Used for secret verification (client/application
 * secrets) so the comparison does not leak length-prefix matches via timing. Returns
 * false immediately on length mismatch (lengths are not themselves secret).
 */
export const oAuthSafeStringCompare = (a: string, b: string): boolean => {
  const bufA = Buffer.from(a, 'utf-8');
  const bufB = Buffer.from(b, 'utf-8');
  if (bufA.length !== bufB.length) return false;
  return timingSafeEqual(bufA, bufB);
};
