security: CAPA privilege escalation, CSV injection, AI rate-limit, prompt injection guard, open redirect, timing-safe cron secret, server-only admin client, notifications RLS

app/api/cron/capa-escalation/route.ts

@@ -1,13 +1,17 @@
 export const dynamic = 'force-dynamic'
 
+import { timingSafeEqual } from 'crypto'
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
 import { escalateOverdueCapa } from '@/lib/notifications/capa-escalation'
 
 export async function GET(request: NextRequest) {
-  const auth = request.headers.get('authorization')
-  const expected = `Bearer ${process.env.CRON_SECRET}`
-  if (!auth || auth !== expected) {
+  const auth = request.headers.get('authorization') ?? ''
+  const expected = `Bearer ${process.env.CRON_SECRET ?? ''}`
+  const authBuf = Buffer.from(auth, 'utf8')
+  const expectedBuf = Buffer.from(expected, 'utf8')
+  const valid = authBuf.length === expectedBuf.length && timingSafeEqual(authBuf, expectedBuf)
+  if (!valid) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }