fix(harness): compare the /ingest bearer token in constant time

.changeset/tough-guests-drive.md

@@ -0,0 +1,5 @@
+---
+"@sapiom/harness": patch
+---
+
+Compare the /ingest bearer token in constant time, matching the /api and WS upgrade paths.

packages/harness/src/server/ingest.test.ts

@@ -88,6 +88,12 @@ describe("createIngestRouter", () => {
     expect(stored).toHaveLength(0);
   });
 
+  it("rejects requests with no Authorization header at all", async () => {
+    const res = await postIngest(baseUrl, { hookEvent: "SessionStart" }, "");
+    expect(res.status).toBe(401);
+    expect(stored).toHaveLength(0);
+  });
+
   it("responds 200 immediately and processes asynchronously", async () => {
     const res = await postIngest(baseUrl, {
       hookEvent: "UserPromptSubmit",

packages/harness/src/server/ingest.ts

@@ -13,6 +13,7 @@ import express, { type Router } from "express";
 import type { AnalyticsEvent, HarnessKind } from "../shared/types.js";
 import type { NormalizeContext } from "../core/collector/normalizer.js";
 import { createSeqCounter, type SeqCounter } from "../core/collector/seq.js";
+import { timingSafeEqualString } from "./auth.js";
 
 export interface IngestSessionContext {
   harness: HarnessKind;
@@ -162,7 +163,7 @@ export function createIngestRouter(deps: IngestDeps): Router {
 
   router.post("/ingest", (req, res) => {
     const token = bearerToken(req.headers.authorization);
-    if (token !== deps.ingestToken) {
+    if (!timingSafeEqualString(token ?? "", deps.ingestToken)) {
       res.status(401).json({ ok: false });
       return;
     }