feat: Engram sync layer — swarm memory protocol, peer delta sync, distributed activation

engram/crates/engram-server/src/auth.rs

@@ -0,0 +1,31 @@
+/// Auth middleware for sync endpoints.
+///
+/// Sync and swarm endpoints require `Authorization: Bearer {api_key}`.
+/// The API key is configured at server startup and stored in AppState.
+use axum::{
+    extract::{Request, State},
+    http::StatusCode,
+    middleware::Next,
+    response::Response,
+};
+use std::sync::Arc;
+
+use crate::state::AppState;
+
+/// Axum middleware that checks the Authorization header on sync/swarm routes.
+pub async fn require_auth(
+    State(state): State<Arc<AppState>>,
+    req: Request,
+    next: Next,
+) -> Result<Response, StatusCode> {
+    let api_key = req
+        .headers()
+        .get("Authorization")
+        .and_then(|v| v.to_str().ok())
+        .and_then(|v| v.strip_prefix("Bearer "));
+
+    match api_key {
+        Some(key) if key == state.api_key => Ok(next.run(req).await),
+        _ => Err(StatusCode::UNAUTHORIZED),
+    }
+}