security.py

"""Small, dependency-free guards for endpoints that change RAG knowledge."""

import hmac
import os


def corrections_write_enabled() -> bool:
    """Corrections are opt-in: a public Space must never accept anonymous writes."""
    return bool(os.getenv("CORRECTIONS_WRITE_TOKEN", "").strip())


def corrections_write_authorized(provided_token: str | None) -> bool:
    """Verify the engineer token without leaking timing information."""
    expected_token = os.getenv("CORRECTIONS_WRITE_TOKEN", "").strip()
    return bool(
        expected_token
        and provided_token
        and hmac.compare_digest(expected_token, provided_token)
    )