Module auth 

Origin checks and the auth middlewares. Split out of server/mod.rs unchanged (SPEC_LARGE_FILE_MODULE_ANALYSIS_2026_09_30.md §4.1).

Enums

ReactiveAuthVia 🔒

Auth middleware for the two LAN-forwarding-relevant reactive routes (/agentmux/reactive/agent, /agentmux/reactive/inject) — accepts EITHER state.auth_key (the normal, full-access case: every other caller of these two routes, e.g. agentmux-mcp’s SendMessage tool for a plain host-tier inject) OR state.lan_key (a LAN peer forwarding a jekt or looking up which agents this instance hosts).

Functions

admit_container_agent 🔒

A container agent’s token: allowed only on crate::backend::container_credential::container_route_allowed. There it stands in for the instance key it replaced (so jekt tiers and identity behave as for any agent), with the caller pinned to the grant’s agent by caller_middleware.

auth_middleware 🔒

Auth middleware matching Go pkg/authkey/authkey.go:18-42.

is_allowed_origin 🔒

A loopback origin (is_loopback_origin), or one a headless srv was told to accept with --allowed-origin (a reverse proxy’s public origin). Used by CORS and by ws_origin_guard.

is_loopback_origin 🔒

http://127.0.0.1 or http://localhost, optionally with a numeric port: where the desktop frontend is served from (the CEF host’s loopback server, or the Vite dev server). A headless srv behind a reverse proxy can also accept the proxy’s origin; see is_allowed_origin, which CORS and ws_origin_guard use.

lan_or_full_auth_middleware 🔒

unauthorized 🔒

ws_origin_guard 🔒

Refuse a WebSocket upgrade whose Origin is neither loopback nor allowed by --allowed-origin (is_allowed_origin).