Use constant-time auth checks in FastA2A proxy

[sena-labs]

Summary:

• switch FastA2A token checks to a shared constant-time helper for token-path, bearer, and api_key auth flows
• add regression coverage for successful and rejected auth paths

Root cause:

• the proxy compared attacker-controlled auth tokens with direct string equality, which duplicated logic across code paths and did not use a timing-safe comparison

Testing:

• docker exec agent-zero-live /opt/venv-a0/bin/python -m pytest /a0/tests/test_fasta2a_server_auth.py -q → 4 passed in 0.41s
• updated rejection coverage validated in the live container against the PR branch test file → 8 passed in 0.09s

[Copilot]

Pull request overview

This PR hardens the FastA2A proxy’s authentication checks by centralizing token comparisons into a constant-time helper and adds targeted regression tests to ensure the new comparison path is exercised.

Changes:

• Introduces a shared _tokens_match() helper using hmac.compare_digest() for constant-time token comparisons.
• Updates token-in-path and header/query auth flows to use _tokens_match() instead of direct string equality.
• Adds async tests that validate compare_digest is invoked for token-path, Bearer, and api_key query authentication.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
helpers/fasta2a_server.py	Adds constant-time token comparison helper and routes all relevant auth flows through it.
tests/test_fasta2a_server_auth.py	Adds regression tests asserting the proxy’s auth paths call hmac.compare_digest().

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The non-token-path auth flows are only tested for the success case. Since the PR changes the bearer / api_key checks to route through the new constant-time helper, add regression tests for rejected requests too (e.g., wrong Bearer token, wrong/missing api_key in query and in X-API-KEY header) to ensure 401 behavior can’t regress without being caught.

[sena-labs]

Addressed the Copilot review feedback in 0221cff: the auth regression suite now covers rejected non-token-path requests for wrong Bearer credentials, wrong X-API-KEY/query api_key credentials, and the no-auth case, while preserving the existing compare_digest path assertions.