Function serve_with_auth 

pub fn serve_with_auth(
    stream: TcpStream,
    gpp: &Path,
    peer_name: &str,
    opts: SyncOptions,
    allow: Option<&[String]>,
) -> Result<SyncReport>

Like serve, but reject any peer whose Noise static key is not in allow immediately after the handshake — before the repo-id exchange, TOFU pinning, or any object data. None disables the check (TOFU only).

Noise XX only reveals the initiator’s static key once the handshake completes, so this is the earliest point the key is known; rejecting here means an unauthorized peer transfers no application data. Keys are compared in the lowercase-hex form written to known_peers, case-insensitively.