fix: encode order_id to bytes before hmac.compare_digest

[hrco]

Summary

• hmac.compare_digest raises TypeError when given non-ASCII str input. A crafted order_id on /keys/mine containing non-ASCII characters crashed the request with a 500 instead of the intended 404.
• Encode both sides to UTF-8 bytes before comparison; behavior for ASCII inputs is unchanged.
• Flagged by CodeRabbit review on PR release: /keys/mine order_id second factor (paywall bypass fix) #26 (main→release promotion of the paywall fix).

Test plan

• Added test_non_ascii_order_id_returns_404_not_500 — reproduces the crash pre-fix, passes post-fix.
• Full test_key_provisioning.py suite passes (12/12).
• Confirmed unrelated pre-existing failures in test_tool_chains.py (pytest-asyncio plugin registration) are unchanged by this diff.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1afe68a7-95b2-4137-913e-a0161cb114de

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/order-id-ascii-compare

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[hrco]

🔤 ROAST: fix/order-id-ascii-compare (#29)

The good: 3-line fix. Prevents a 500. Correct.

The roast:

This is the PR equivalent of finding one cockroach and calling the whole family to witness it with a full write-up. Three lines of actual fix, 6 lines of test, and a PR description that reads like you defused a bomb. You did not defuse a bomb. You called .encode("utf-8").

"Flagged by CodeRabbit review on PR #26" — so a bot found this for you. In a 3-character diff. You are outsourcing your QA to automation and then publishing the receipt. I appreciate the honesty but maybe keep the "a robot did my code review" part as an internal note.

The real question: who is sending non-ASCII order IDs? Did someone try to order a license key in UTF-16? You built an entire paywall bypass security system (/keys/mine with order_id second factor, HMAC comparison, constant-time comparison) and it folds to a French accent. hmac.compare_digest does not like é — join the club, mate.

Verdict: Correct fix. But the fact that CodeRabbit had to teach you about encoding gives me pause. Merge it quietly.