refactor(harp): compare the HaRP shared key with hash_equals

[oleksandr-nc]

HarpController::validateHarpSharedKey() compared the harp-shared-key header with the stored key using !==. This uses hash_equals() instead, the PHP function meant for comparing keys and tokens, as AppAPI already does for Talk bot signatures in TalkBotController. The empty-header check stays, and the result is the same for every input.

[oleksandr-nc]

/backport to stable35

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 6b7bedfa-345d-42c9-9bac-e3f810c513ba

📥 Commits

Reviewing files that changed from the base of the PR and between 910c378 and f9634cb.

📒 Files selected for processing: 1

• lib/Controller/HarpController.php

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Harp shared-key validation now uses hash_equals to compare the supplied key with the decrypted key. The existing rejection of empty headers remains unchanged.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to f9634

The shared-key check continues to reject missing or incorrect keys and accept matching keys. No PR-specific behavior or compatibility risk remains, so the change is ready to merge subject to normal checks.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: using hash_equals to compare the HaRP shared key.
Description check		The description accurately explains the change, preserves the empty-header check, and relates directly to the changeset.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}