Module gateway_identity 

Per-person gateway keys + request identity tags (enterprise#11).

gateway-keys.toml maps SHA-256 hashes of bearer keys to an identity (person, optional team, optional default project), so an org gateway can meter usage per person/project without the clients sharing one token:

[[keys]]
sha256_hex = "9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"
person = "yves"
team = "platform"
default_project = "ai-gateway"

Only the hash is ever stored (same rule as TeamTokenConfig / cloud_server::auth); the plaintext key lives with the person. The file path resolves via LEAN_CTX_GATEWAY_KEYS, falling back to <config_dir>/gateway-keys.toml — deployments mount it as a secret.

A caller may override the project per request with the x-leanctx-project header (an internal gateway header: it is deliberately not on ALLOWED_REQUEST_HEADERS, so it never leaks upstream).

Structs

GatewayKeys

Loaded, lookup-ready key set. One instance per proxy process, loaded at startup (key rotation = redeploy/restart, the standard secret-mount flow).

GatewayTags

The identity tags attached to an authenticated gateway request. Inserted as a request extension by the auth guard and stamped onto the usage record by the forward path.

Functions

sha256_hex

Lowercase hex SHA-256 (the storage form of every gateway key).