fix(backend): migrate webhooks to use canonical timingsafekey comparison

[LucasSantana-Dev]

fix: #1699

Replace two call sites of custom safeEqualString() with timingSafeKeyCompare() to match the canonical constant-time comparison used in other internal routes (serviceAnnounce.ts, internalNotify.ts, serviceGuild.ts). Removes now-unused safeEqualString function definition and its timingSafeEqual import.

---

Summary by cubic

Standardizes webhook auth to use timingSafeKeyCompare for constant-time key checks in Top.gg and internal notify endpoints, aligning with other internal routes and addressing #1699. Removes the custom safeEqualString helper and the timingSafeEqual import.

^{Written for commit d0c3fe2. Summary will update on new commits.}

Summary by CodeRabbit

• Bug Fixes
  • Improved webhook request verification for better protection against invalid or tampered requests.
  • Kept vote streak and duplicate-vote behavior unchanged while making the handling more reliable.

[coderabbitai]

📝 Walkthrough

Walkthrough

Webhook token verification in webhooks.ts is refactored to use a shared timingSafeKeyCompare utility instead of a local safeEqualString helper combined with node:crypto's timingSafeEqual. Vote streak computation logic is reformatted without semantic changes.

Changes

Webhook Auth Refactor

Layer / File(s)	Summary
Constant-time key comparison packages/backend/src/routes/webhooks.ts	Imports timingSafeKeyCompare, removes the local safeEqualString helper, and updates verifyTopggAuth and verifyInternalKey to use the new comparison function for TOPGG_AUTH_TOKEN and LUCKY_NOTIFY_API_KEY checks.
Vote streak formatting packages/backend/src/routes/webhooks.ts	Reformats the expiredStreak computation in readVoteState and the newStreak assignment in recordVote into multi-line conditionals, preserving existing streak semantics.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

• chore(backend): unify internal-endpoint key comparison on timingSafeKeyCompare #1699: This PR consolidates webhook auth-key comparisons onto timingSafeKeyCompare and removes the safeEqualString path, directly matching the issue's request.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: switching backend webhooks to the canonical timingSafeKeyCompare approach.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1699-timingsafe-webhooks

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Failed to generate code suggestions for PR

[cubic-dev-ai]

No issues found across 1 file

<sub>Auto-approved: Replaces custom safeEqualString with canonical timingSafeKeyCompare for webhook auth, matching other internal routes. Removes unused code. Low risk.

Re-trigger cubic</sub>

[github-actions]

	Warnings
⚠️	User-facing change without a CHANGELOG.md update. Add a line under ## [Unreleased] if this should appear in release notes. (Or apply the skip-changelog label if this PR does not affect end users.)

Generated by 🚫 dangerJS against d0c3fe2

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud