import hmac

from fastapi import HTTPException


def verify_secret(provided: str | None, expected: str) -> None:
    """Constant-time comparison of the shared secret.

    Raises HTTPException(401) on mismatch or missing header.
    """
    if provided is None or not hmac.compare_digest(provided, expected):
        raise HTTPException(status_code=401, detail="invalid or missing secret")