Add bearer token auth

[suqin-haha]

Summary

add simple auth token check when the environment variable configured

without the environment variable configured, it just bypass the authentication

Related Issues

Changes

Checklist

• [ x] Code builds correctly
• [x ] Tests have been added or updated
• Documentation updated if necessary
• [x ] I have reviewed my own changes

---

Note

Adds optional bearer token authentication (via MOONLINK_REST_TOKEN) enforced by Axum middleware with 401 on missing/invalid token, plus tests.

• REST API (Axum):
  • Auth Middleware: Add auth_middleware that validates Authorization: Bearer <token> against MOONLINK_REST_TOKEN cached in ApiState.
    • If unset, auth is bypassed; if set and invalid/missing, returns 401 with JSON error.
  • Router: Wire middleware with .layer(middleware::from_fn_with_state(...)); update ApiState to include bearer_token and initialize from env.
  • Minor handler/import updates to support middleware (Request, HeaderMap, State cloning).
• Tests:
  • Add test_bearer_token_authentication in src/moonlink_service/src/test.rs covering no header, wrong format, and correct token cases.

^{Written by Cursor Bugbot for commit 4f211c7. This will update automatically on new commits. Configure here.}

[cursor]

This PR is being reviewed by Cursor Bugbot

Details

Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.

To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.

[cursor]

Bug: Preserve Environment State in Cleanup Checks

The test unconditionally removes the MOONLINK_REST_TOKEN environment variable in cleanup without preserving its original value. If the environment variable was set before the test ran (e.g., in a production environment or CI/CD), the test will remove it, potentially breaking subsequent code that expects it to be set. The test should save the original value with std::env::var("MOONLINK_REST_TOKEN").ok() before setting it, and restore the original state in cleanup rather than unconditionally removing it.

 

[github-actions]

This PR has been inactive for 14 days and is now marked as stale. If this is still being worked on, please comment to keep it open.