fix(web): use constant-time comparison for media-server webhook secret

[richiemcilroy]

Uses a constant-time comparison for the media-server webhook shared secret, matching the cron routes.

Greptile Summary

This PR hardens the media-server webhook authentication by replacing a plain === string comparison with a constant-time SHA-256-hash-then-timingSafeEqual check, bringing it in line with the cron route pattern.

• Both authHeader and webhookSecret are hashed to a fixed 32-byte SHA-256 digest before timingSafeEqual is called, so the buffers are always the same length (no RangeError) and no length pre-check is needed (no secret-size side-channel).
• The !webhookSecret and !authHeader null guards short-circuit on absent configuration or missing header — neither leaks information about the secret's value.

Confidence Score: 5/5

The change is a targeted, self-contained security hardening of one auth check — safe to merge.

The hashing approach is correct: SHA-256 always produces a fixed 32-byte buffer, so timingSafeEqual will never throw, and the absence of a length pre-check means the secret size is not leaked through timing. The null guards for a missing config value or missing header are appropriate and do not expose the secret's content. No functional behavior outside the auth gate is touched.

No files require special attention.

Important Files Changed

Filename	Overview
apps/web/app/api/webhooks/media-server/progress/route.ts	Replaces string equality check with SHA-256 hash + timingSafeEqual; correctly addresses prior thread concerns about byte-length mismatch and secret-length timing leak.

_{Reviews (3): Last reviewed commit: "fix(web): hash media-server webhook secr..." | Re-trigger Greptile}

[polarityinc]

Paragon Review Skipped

Hi @richiemcilroy! Your Polarity credit balance is insufficient to complete this review.

Please visit https://app.paragon.run to finish your review.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[richiemcilroy]

@greptileai please review the PR

[richiemcilroy]

@greptileai please review the PR