Enum ReactiveAuthVia 

pub(crate) enum ReactiveAuthVia {
    FullAuthKey,
    LanKey,
}

Auth middleware for the two LAN-forwarding-relevant reactive routes (/agentmux/reactive/agent, /agentmux/reactive/inject) — accepts EITHER state.auth_key (the normal, full-access case: every other caller of these two routes, e.g. agentmux-mcp’s SendMessage tool for a plain host-tier inject) OR state.lan_key (a LAN peer forwarding a jekt or looking up which agents this instance hosts).

Deliberately a SEPARATE middleware from auth_middleware, applied to a standalone router merged at the top level rather than nested inside authed_routes — nesting would put authed_routes’s own route_layer(auth_middleware) on the outside, rejecting the LAN key before this middleware ever ran. This is why these two routes live in their own lan_forward_routes router in router(), not in reactive_routes.

state.lan_key grants access to ONLY the lan_forward_routes — never the rest of /agentmux/service, /agentmux/file, shell creation, credential/ identity endpoints, etc. See Config::lan_key’s doc comment for why this exists. Which of the two credentials lan_or_full_auth_middleware accepted authenticated this specific request. Inserted into the request’s extensions so handle_reactive_inject can force delivery_tier = "lan" whenever LanKey authenticated the request, regardless of what the JSON body itself claims — closing the bypass where a lan_key-only holder could otherwise just self-label a request “host” to dodge LAN’s stricter verification entirely. See docs/specs/SPEC_JEKT_LAN_TIER_SIGNING_2026_08_15.md §3 for the full rationale, including why the reverse (downgrading a “lan” claim seen under FullAuthKey) is deliberately NOT done — reagentx P0 found that same-host forwarding (Tier 2a/2b in reactive.rs) legitimately re-authenticates an already-LAN-originated jekt with a sibling instance’s own full auth_key, so downgrading there silently discarded an already-detected signature failure’s forced-sensitive escalation.

Variants

FullAuthKey

LanKey

Trait Implementations

impl Clone for ReactiveAuthVia

fn clone(&self) -> ReactiveAuthVia

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for ReactiveAuthVia

impl Debug for ReactiveAuthVia

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for ReactiveAuthVia

impl PartialEq for ReactiveAuthVia

fn eq(&self, other: &ReactiveAuthVia) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for ReactiveAuthVia