feat(moonapi): HTTP Basic and API-key security extractors (FastAPI HTTPBasic / APIKey*).

Signed-off-by: 林晨 (Leo Cheng) <chengkelfan@qq.com>

Author: Lfan-ke

security_extractors.mbt

@@ -0,0 +1,73 @@
+// The non-OAuth2 security schemes' runtime extractors (← FastAPI's `HTTPBasic` and
+// `APIKeyHeader` / `APIKeyQuery` / `APIKeyCookie`). `security_scheme.mbt` already describes these to
+// clients under `securitySchemes`; this is the enforcement side — pulling the credential off the
+// request so a route can authenticate against it, the same way `Context::bearer_token` does for
+// OAuth2.
+
+///|
+/// The credentials carried in an HTTP Basic `Authorization` header (← FastAPI's
+/// `HTTPBasicCredentials`): the username and password from `base64(username:password)`.
+pub(all) struct HttpBasicCredentials {
+  username : String
+  password : String
+}
+
+///|
+/// The index of the first `:` in `s`, or `-1`.
+fn first_colon(s : String) -> Int {
+  for i = 0; i < s.length(); i = i + 1 {
+    if s[i] == ':' {
+      return i
+    }
+  }
+  -1
+}
+
+///|
+/// Parse an HTTP Basic `Authorization` header value into credentials (← FastAPI's `HTTPBasic`),
+/// or `None`. Matches the `Basic` scheme case-insensitively (RFC 7617), base64-decodes the rest, and
+/// splits on the first colon so a password may itself contain colons.
+pub fn parse_basic_auth(header : String) -> HttpBasicCredentials? {
+  let trimmed = trim_spaces(header)
+  let prefix = "basic "
+  guard trimmed.length() >= prefix.length() else { return None }
+  guard trimmed[0:prefix.length()].to_owned().to_lower() == prefix else {
+    return None
+  }
+  let encoded = trim_spaces(trimmed[prefix.length():].to_owned())
+  let decoded = @utf8.decode_lossy(@base64.decode_lossy(encoded)[:])
+  let colon = first_colon(decoded)
+  guard colon >= 0 else { return None }
+  Some({
+    username: decoded[0:colon].to_owned(),
+    password: decoded[colon + 1:].to_owned(),
+  })
+}
+
+///|
+/// The HTTP Basic credentials on this request (← FastAPI's `HTTPBasic` dependency), or `None`.
+pub fn Context::http_basic(self : Context) -> HttpBasicCredentials? {
+  match self.request.header("authorization") {
+    Some(h) => parse_basic_auth(h)
+    None => None
+  }
+}
+
+///|
+/// The API key carried in the request header `name` (← FastAPI's `APIKeyHeader`), or `None`. Header
+/// names are matched against the request's lower-cased headers.
+pub fn Context::api_key_header(self : Context, name : String) -> String? {
+  self.request.header(name.to_lower())
+}
+
+///|
+/// The API key carried in the query parameter `name` (← FastAPI's `APIKeyQuery`), or `None`.
+pub fn Context::api_key_query(self : Context, name : String) -> String? {
+  self.query(name)
+}
+
+///|
+/// The API key carried in the cookie `name` (← FastAPI's `APIKeyCookie`), or `None`.
+pub fn Context::api_key_cookie(self : Context, name : String) -> String? {
+  self.cookie(name)
+}

security_extractors_wbtest.mbt

@@ -0,0 +1,26 @@
+// HTTP Basic / API-key runtime extractors (← FastAPI's `HTTPBasic` / `APIKey*`).
+
+///|
+test "security: HTTP Basic auth parses username and password from the Authorization header" {
+  // RFC 7617 §2 example: "Aladdin:open sesame".
+  guard parse_basic_auth("Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==") is Some(creds) else {
+    fail("expected credentials")
+  }
+  assert_eq(creds.username, "Aladdin")
+  assert_eq(creds.password, "open sesame")
+  // The scheme name is case-insensitive.
+  guard parse_basic_auth("basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==") is Some(lower) else {
+    fail("expected credentials for a lowercase scheme")
+  }
+  assert_eq(lower.username, "Aladdin")
+  // A password containing a colon splits only on the first one.
+  guard parse_basic_auth("Basic dTpwOnE=") is Some(colonpw) else {
+    fail("expected credentials")
+  }
+  // "u:p:q" → username "u", password "p:q".
+  assert_eq(colonpw.username, "u")
+  assert_eq(colonpw.password, "p:q")
+  // A non-Basic scheme, or a value with no colon, yields None.
+  assert_eq(parse_basic_auth("Bearer abc") is None, true)
+  assert_eq(parse_basic_auth("Basic bm9jb2xvbg==") is None, true)
+}