From 4e1285dc9683fd6dc087b696a1634c894efd5d24 Mon Sep 17 00:00:00 2001
From: marcos <marcos.paulodasilva.mp@gmail.com>
Date: Tue, 18 Aug 2026 13:00:08 +0000
Subject: [PATCH] fix: constant-time comparison for share tokens
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Applies the reviewer's suggestion on app/auth.py — hmac was already imported.
---
 app/auth.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/auth.py b/app/auth.py
index d579722..b2c117a 100644
--- a/app/auth.py
+++ b/app/auth.py
@@ -35,4 +35,4 @@ def make_share_token(note_id: int) -> str:
 
 def check_share_token(supplied: str, expected: str) -> bool:
     """Validate a share token supplied in a URL."""
-    return supplied == expected
+    return hmac.compare_digest(supplied, expected)