[Dev-Zwaylo]

this pr closes #1110

Fixes the [RELIABILITY] Admin API authorization issue (SSB-2026-167).

Current behavior: adminAuth and /api/admin/auth compared the key with !==, so the comparison wasn't constant-time. Malformed values and an unset or empty ADMIN_API_KEY weren't handled explicitly.

Change:

New shared isValidAdminKey in backend/src/middleware/adminAuth.ts:
It reads ADMIN_API_KEY once per check, so a concurrent rotation is judged against either the old key or the new one, never a mix.
It rejects missing, empty and non-string keys, and rejects everything when no key is configured.
It compares keys with timingSafeEqual.
Both the adminAuth middleware and /api/admin/auth in backend/src/index.ts use it.
Retry path: a rejected request returns 401 before any handler runs, so it has no side effects. Retrying with the rotated key runs the handler exactly once, with no duplicated money-moving effects, events or stored state.
Tests: new adminAuth.test.ts covers missing, malformed, rotated and interleaved-rotation cases.
No documented behavior changes.

[vercel]

@Dev-Zwaylo is attempting to deploy a commit to the ritik4ever's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9426814a-8bd2-42a3-b055-19f3d19b8b3e

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}