Module auth 

Optional bearer-token authentication for the compute/parse routes.

Authentication is off by default so the public viewer -> server flow keeps working. When Config::api_token is set (via IFC_SERVER_API_TOKEN or API_TOKEN), the protected routes require an Authorization: Bearer <token> header and return 401 Unauthorized otherwise. The health endpoint is intentionally left unprotected so this layer never applies to it.

Functions

constant_time_eq 🔒

Length-aware constant-time byte comparison to avoid leaking the token via early-exit timing. Returns false immediately on length mismatch (the length itself is not secret), then folds all remaining bytes.

require_bearer_token

Axum middleware enforcing optional bearer-token auth on protected routes.

unauthorized 🔒

The 401: the shared error envelope plus the WWW-Authenticate challenge naming the scheme this layer accepts.