spb/zyquo-router Public MIT

1//2//  AuthMiddleware.swift3//  Zyquo Router4//5//  Author: Simon-Pierre Boucher6//  Mail: contact@spboucher.ai7//8//  Local API-key gate (Bearer `zyquo-sk-…`). With no keys configured the9//  router is open (localhost-only posture); LAN exposure forces at least one10//  key at start time. Per-key rate limits and model allow-lists apply in the11//  chat route.12//1314import Foundation1516struct AuthMiddleware: Sendable {17    /// Keys in force; empty ⇒ no auth required (localhost default).18    var keys: [APIKeyRecord] = []1920    enum Decision: Sendable {21        case allowed(APIKeyRecord?)22        case unauthorized(message: String)23    }2425    func authorize(_ request: RouteRequest) -> Decision {26        guard !keys.isEmpty else { return .allowed(nil) }2728        guard let auth = request.headers.first(name: "Authorization"),29              auth.lowercased().hasPrefix("bearer ") else {30            return .unauthorized(message: "Missing bearer token. Pass a local router key: Authorization: Bearer zyquo-sk-…")31        }32        let token = String(auth.dropFirst("bearer ".count)).trimmingCharacters(in: .whitespaces)33        let hash = APIKeyRecord.hash(token)34        guard let match = keys.first(where: { $0.tokenHash == hash }) else {35            return .unauthorized(message: "Invalid API key.")36        }37        guard match.enabled else {38            return .unauthorized(message: "This API key has been revoked.")39        }40        return .allowed(match)41    }42}43