Struct AuthConfig 

pub struct AuthConfig { /* private fields */ }

API key authentication for the HTTP server.

Configured from RECURSIVE_HTTP_AUTH_KEYS, a comma-separated list of keys the server will accept in the X-API-Key request header. An empty key set (the default) disables auth entirely — every route is reachable without credentials. This preserves zero-config behavior and keeps the public default backward-compatible.

Distinct from RECURSIVE_API_KEY (singular): that variable holds the outbound credential the agent uses to talk to its LLM provider. RECURSIVE_HTTP_AUTH_KEYS (plural) holds the inbound credentials the HTTP server accepts from clients. The names are deliberately dissimilar to avoid confusion at the operator’s shell.

/health and /metrics are always exempt (k8s liveness probes and Prometheus scrapers must work unauthenticated).

Implementations

impl AuthConfig

pub fn new(keys: Vec<String>) -> Self

Build an AuthConfig from an explicit key list. Pass an empty vec to disable API-key auth (a JWT verifier may still be attached via AuthConfig::with_jwt).

pub fn with_jwt(self, jwt: JwtConfig) -> Self

Attach a JWT verifier. Call after AuthConfig::new to get “X-API-Key OR Bearer JWT” semantics — either valid credential type lets a request through. Without this call the behavior is X-API-Key-only (the original g135 behavior).

pub fn is_valid(&self, presented: &str) -> bool

Constant-time check whether presented is in the configured API-key set.

Returns true if no API keys are configured. Endpoints must rely on the middleware layering, not this method, for the “auth disabled” semantics — see [auth_middleware].

The loop runs over every configured key regardless of an early match, to keep the comparison constant-time and avoid leaking key-set membership timing.

pub fn is_enabled(&self) -> bool

Whether ANY auth modality is enabled — non-empty API key set OR a JWT verifier attached. When this returns false, the middleware is a pass-through.

Trait Implementations

impl Clone for AuthConfig

fn clone(&self) -> AuthConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Default for AuthConfig

fn default() -> AuthConfig

Returns the “default value” for a type.