pub async fn check_auth(
auth: &Option<Arc<AuthState>>,
headers: &HeaderMap,
action: &str,
) -> Result<(Option<String>, String), StatusCode>Expand description
Check authentication for a protected endpoint.
Returns Ok((None, user_key)) if auth is not configured (open mode), or if
a valid token is present without needing cookie renewal. Returns
Ok((Some(cookie), user_key)) if auth succeeded and the caller should
include the given Set-Cookie header value in the response (rolling session).
Returns Err(StatusCode) if auth is configured but no valid token is found.
The returned user_key is the identity string used for session isolation
(JWT principals: preferred_username || sub — PINNED, see [jwt_user_key];
dev:{email} for dev-mode humans, agent-{name} for dev:agent: tokens,
"default" when auth is not configured). This avoids the need for handlers
to call resolve_user_key() which would re-validate the JWT a second time.
Token sources (in order):
Authorization: Bearer <token>header (raw JWT — validated directly)trustee_token=<session_id>cookie (looked up in WebSessionManager, auto-refreshed if near expiry)
Dev mode tokens use the format dev:email:name:username.