Module auth 

2026-09-26: Bearer-token validation for the HTTP API’s --require-auth gate.

Owner: server auth. Invariants:

• An AuthConfig holds at least one non-empty token: both constructors return an error otherwise.
• validate compares the presented token with every loaded token, and compares equal-length tokens over every byte with no early exit.

build_auth_config (main_modules/serve.rs) loads the tokens once at startup, from --auth-tokens-file or --auth-token, and only when --require-auth is set. For --auth-token it logs a warning that the value is visible through ps//proc/<pid>/cmdline. File permissions are not checked.

Structs

AuthConfig

2026-09-26: The loaded bearer tokens. The server shares one instance as Arc<AuthConfig>.

LookupTenant

2026-10-04: Who a request belongs to, for state shared across requests that must not cross tenants (the cross-request prompt-lookup cache). The auth middleware attaches it to every request: 0 when the serve has no --require-auth (one trust domain), else the token’s tenant (AuthConfig::tenant_of).