feat(auth): wire JWT validation into /v1/* LLM endpoints

internal/config/config.go

@@ -22,6 +22,8 @@ type Config struct {
 	Models map[string]*ModelUpstream
 	// Adapters holds service adapter definitions for X-Service routing.
 	Adapters []*serviceadapter.ServiceAdapter
+	// Auth holds JWT authentication configuration for /v1/* endpoints.
+	Auth AuthConfig
 }
 
 // ModelUpstream holds upstream configuration for a specific model.
@@ -32,6 +34,22 @@ type ModelUpstream struct {
 	Address string
 	// Path is the upstream path for this model (e.g., "/v1/chat/completions").
 	Path string
+	// AuthRequired indicates whether this model requires JWT authentication.
+	AuthRequired bool
+}
+
+// AuthConfig holds JWT authentication configuration.
+type AuthConfig struct {
+	// Enabled globally enables/disables auth for /v1/* endpoints.
+	Enabled bool
+	// Issuer is the expected JWT issuer (iss claim).
+	Issuer string
+	// Audience is the expected JWT audience (aud claim).
+	Audience string
+	// JWKSURL is the URL to fetch JSON Web Key Set for signature validation.
+	JWKSURL string
+	// RequiredCapability is the permission required for LLM inference (e.g., "llm:inference").
+	RequiredCapability string
 }
 
 // Route represents a single route and its upstream configuration.
@@ -98,18 +116,20 @@ func Load() (*Config, error) {
 		shutdownTimeout = d
 	}
 
-	// Load routes, models, and adapters from config file
+	// Load routes, models, adapters, and auth from config file
 	routes := make(map[string]*Route)
 	models := make(map[string]*ModelUpstream)
 	var adapters []*serviceadapter.ServiceAdapter
+	var authConfig AuthConfig
 	if configPath, ok := os.LookupEnv("CONFIG_PATH"); ok {
-		loadedRoutes, loadedModels, loadedAdapters, err := LoadRoutesAndModelsFromFile(configPath)
+		loadedRoutes, loadedModels, loadedAdapters, loadedAuth, err := LoadRoutesAndModelsFromFile(configPath)
 		if err != nil {
 			return nil, err
 		}
 		routes = loadedRoutes
 		models = loadedModels
 		adapters = loadedAdapters
+		authConfig = loadedAuth
 	}
 
 	return &Config{
@@ -118,5 +138,6 @@ func Load() (*Config, error) {
 		Routes:          routes,
 		Models:          models,
 		Adapters:        adapters,
+		Auth:            authConfig,
 	}, nil
 }