INNER CODE UNIT · Python

_bearer_matches

ohdearquant/lionagi · lionagi/studio/app.py:44

def _bearer_matches(presented: str, token: str) -> bool:
    """Constant-time comparison of a presented Authorization header against the
    expected bearer. `compare_digest` only accepts ASCII-only str, so a header
    carrying non-ASCII bytes is a mismatch — same as before, not a 500.
    """
    try:
        return hmac.compare_digest(presented, f"Bearer {token}")
    except TypeError:
        return False


def _collect_cors_methods(application: FastAPI) -> list[str]:
    """Derive the CORS method allowlist from the app's actual route table
    (hardcoding silently omits FastAPI's auto-generated HEAD routes).
    """
    methods: set[str] = {"OPTIONS"}
    for route in application.routes:
        route_methods = getattr(route, "methods", None)

View source record →