Claude 80958ef9b9 gitea-saas-core#7: constant-time API-key check in authorized() (bounce fix) ... Replace the == string comparison at delivery.py:127 with hmac.compare_digest so the shared secret never leaks through response timing (repo convention: stripe_client.py:88, server.py:171). The isinstance/empty guards run first so compare_digest's TypeError on non-str input is never reached — unset config, None, and non-str keys stay fail-closed False. Five direct authorized() tests added (16 delivery tests / 42 full suite green).		2026-08-25 06:40:41 -05:00
..
test_billing_core.py	gitea-saas-core#1: billing ledger core (clients/ledger/holds, idempotent, fail-closed)	2026-08-25 04:16:35 -05:00
test_delivery.py	gitea-saas-core#7: constant-time API-key check in authorized() (bounce fix)	2026-08-25 06:40:41 -05:00