"""订单中心调本方：请求头 X-Oms-Token，和环境变量 OMS_INBOUND_TOKEN 比对。

未配置 token 时一律失败，避免空串把鉴权打成敞开。
"""
from __future__ import annotations

import os
import secrets


def token_ok(provided: str | None) -> bool:
    expected = os.getenv("OMS_INBOUND_TOKEN", "")
    if not expected or not provided:
        return False
    return secrets.compare_digest(provided, expected)