package auth

import (
	"crypto/sha256"
	"crypto/subtle"
)

// SecretEqual compares a client-supplied secret with the configured one in
// constant time. An empty configured secret never matches, so an unset secret
// disables access instead of letting requests without the header through.
func SecretEqual(given, want string) bool {
	if want == "" {
		return false
	}
	// hashing first keeps the comparison length-independent
	g := sha256.Sum256([]byte(given))
	w := sha256.Sum256([]byte(want))
	return subtle.ConstantTimeCompare(g[:], w[:]) == 1
}