feat(moonzero): add JWT HS256 auth, YAML config loader, and zRPC service groups.

Self-built SHA-256 (FIPS 180-4) + HMAC-SHA256 (RFC 2104), verified against NIST/RFC vectors, back a compact HS256 JWT: jwt_sign/jwt_verify compare signatures in constant time, enforce exp/nbf, and refuse the alg:none downgrade; verified interop against the canonical jwt.io token. The auth middleware rejects absent/tampered/expired Bearer tokens with 401. A minimal-subset YAML parser (block maps, nesting, sequences, typed scalars, comments) feeds ServiceConf::from_yaml through the same field reader as the JSON loader. Config-driven RpcServer/RpcGroup register moonrpc Method handlers by gRPC path and dispatch unary calls, returning Unimplemented for unknown methods.

Signed-off-by: 林晨 (Leo Cheng) <chengkelfan@qq.com>

Author: Lfan-ke

README.md

@@ -63,9 +63,34 @@ let server = @moonzero.Server::new(conf, app)
 - **`maxbytes`** — rejects a request whose declared `Content-Length` exceeds the limit with `413`.
 - **`structured_logging`** — a [`RequestLog`](./logging.mbt) rendered as one JSON line per request (method, path, status, duration, request-id, client-ip, user-agent).
 
+## Auth, YAML config, and zRPC groups
+
+```moonbit
+// JWT HS256 — self-built SHA-256/HMAC (verified against NIST/RFC vectors)
+let token = @moonzero.jwt_sign(
+  Map([("sub", Json::string("alice")), ("exp", Json::number(1893456000.0))]),
+  "topsecret",
+)
+let server = @moonzero.Server::new(conf, app)
+  .use_(@moonzero.auth("topsecret", clock))   // 401 unless a valid Bearer JWT
+
+// YAML config — the etc/*.yaml format go-zero ships, same lenient defaults as JSON
+let conf = @moonzero.ServiceConf::from_yaml("name: greet\nport: 9000\nlog_level: error\n")
+
+// zRPC service groups over moonrpc — register Method handlers, dispatch by gRPC path
+let rpc = @moonzero.RpcServer::new(@moonzero.RpcServerConf::new(name="greeter", port=9090))
+rpc.group("hello.Greeter").register("SayHello", req => handle(req))
+rpc.dispatch("/hello.Greeter/SayHello", request)   // Ok(bytes) | Err(Unimplemented)
+```
+
+- **`jwt_sign` / `jwt_verify`** — compact HS256 tokens on a [self-built SHA-256 + HMAC-SHA256](./crypto.mbt), signatures compared in constant time, `exp`/`nbf` enforced, and the `alg:none` downgrade refused. Interop-verified against the canonical jwt.io token.
+- **`auth`** — the [middleware](./auth.mbt) that requires `Authorization: Bearer <jwt>` and answers `401` for an absent, malformed, tampered, or expired token.
+- **`ServiceConf::from_yaml`** — a [minimal-subset YAML parser](./yaml.mbt) (block maps, nesting, sequences, typed scalars, comments) feeding the same field reader as the JSON loader, so both formats agree field-for-field.
+- **`RpcServer` / `RpcGroup`** — [config-driven zRPC groups](./rpc.mbt) that register [`moonrpc`](https://github.com/Lfan-ke/moonrpc) `Method` handlers by gRPC path and dispatch unary calls, returning `Unimplemented` for an unknown method.
+
 ## Roadmap (transliterating go-zero)
 
-Typed config (JSON loading with defaults, timeout + log level) + service assembly + the base middleware onion (logging, recovery, CORS, request-id) + the resilience set (timeout, rate-limit, breaker, maxbytes, structured logging) + route groups are here. Next, feature-by-feature: YAML config loading, auth (JWT) + metrics/tracing/prometheus middleware, RPC service groups over `moonrpc`, and service discovery / registry — plus `moonctl`-driven scaffolding of a full `moonzero` service from a spec.
+Typed config (JSON + YAML loading with defaults, timeout + log level) + service assembly + the base middleware onion (logging, recovery, CORS, request-id) + the resilience set (timeout, rate-limit, breaker, maxbytes, structured logging) + route groups + JWT auth + zRPC service groups are here. Next, feature-by-feature: metrics/tracing/prometheus middleware, the real h2 transport under `moonrpc` for live RPC, and service discovery / registry (etcd/consul) — plus `moonctl`-driven scaffolding of a full `moonzero` service from a spec.
 
 ## License
 

auth.mbt

@@ -0,0 +1,87 @@
+///|
+/// The `Bearer ` scheme prefix an `Authorization` header carries a JWT under.
+let bearer_prefix : String = "Bearer "
+
+///|
+/// Extract the raw token from an `Authorization: Bearer <token>` header value,
+/// or `None` if the value is absent or not a bearer credential. The scheme name
+/// is matched case-insensitively (RFC 7235 makes it case-insensitive), the token
+/// verbatim.
+fn strip_bearer(value : String?) -> String? {
+  match value {
+    Some(v) =>
+      if v.length() >= bearer_prefix.length() &&
+        v[0:bearer_prefix.length()].to_owned().to_lower() ==
+        bearer_prefix.to_lower() {
+        Some(v[bearer_prefix.length():].to_owned())
+      } else {
+        None
+      }
+    None => None
+  }
+}
+
+///|
+/// The event stream an unauthenticated request receives: a `401 Unauthorized`
+/// with a `WWW-Authenticate: Bearer` challenge and a short plain-text body. A
+/// pure value so the guard's rejection is testable without the async transport.
+fn unauthorized_events() -> Array[@moonasgi.Event] {
+  [
+    @moonasgi.Event::HttpResponseStart(status=401, headers=[
+      ("content-type", "text/plain; charset=utf-8"),
+      ("www-authenticate", "Bearer"),
+    ]),
+    @moonasgi.Event::HttpResponseBody(body=b"401 Unauthorized", more_body=false),
+  ]
+}
+
+///|
+/// Whether a request bearing `token` is authorised at `now_secs`: the token
+/// verifies against `secret` under HS256 and is neither expired nor
+/// not-yet-valid. A missing token is unauthorised. Exposed as a pure decision so
+/// the middleware's accept/reject is testable without driving the transport.
+pub fn jwt_authorized(
+  token : String?,
+  secret : String,
+  now_secs : Int64,
+) -> Bool {
+  match token {
+    Some(t) =>
+      try {
+        let _ = jwt_verify(t, secret, now_secs)
+        true
+      } catch {
+        _ => false
+      }
+    None => false
+  }
+}
+
+///|
+/// JWT auth middleware (← go-zero's `handler.Authorize`): require every HTTP
+/// request to carry a valid `Authorization: Bearer <jwt>` header. The token is
+/// verified against `secret` under HS256 at the current time read from `clock`
+/// (milliseconds, converted to the JWT seconds epoch); an absent, malformed,
+/// tampered, expired, or not-yet-valid token is rejected with `401 Unauthorized`
+/// before the wrapped app runs. Non-HTTP scopes (lifespan, websocket) pass
+/// through untouched.
+pub fn auth(secret : String, clock : Clock) -> Middleware {
+  inner => {
+    (scope, receive, send) => {
+      match scope {
+        Http(_) => {
+          let token = strip_bearer(scope_header(scope, "authorization"))
+          let now_secs = clock.now() / 1000L
+          if jwt_authorized(token, secret, now_secs) {
+            inner(scope, receive, send)
+          } else {
+            for event in unauthorized_events() {
+              send(event)
+            }
+          }
+        }
+        _ => inner(scope, receive, send)
+      }
+    }
+  }
+}

auth_wbtest.mbt

@@ -0,0 +1,56 @@
+///|
+test "strip_bearer extracts the token case-insensitively on the scheme" {
+  assert_eq(strip_bearer(Some("Bearer abc.def.ghi")), Some("abc.def.ghi"))
+  assert_eq(strip_bearer(Some("bearer abc.def.ghi")), Some("abc.def.ghi"))
+  assert_eq(strip_bearer(Some("BEARER xyz")), Some("xyz"))
+  assert_eq(strip_bearer(Some("Basic abc")), None)
+  assert_eq(strip_bearer(Some("abc")), None)
+  assert_eq(strip_bearer(None), None)
+}
+
+///|
+test "jwt_authorized accepts a valid bearer token and rejects the rest" {
+  let token = jwt_sign(
+    Map([("sub", Json::string("u1")), ("exp", Json::number(9999.0))]),
+    "k",
+  )
+  assert_eq(jwt_authorized(Some(token), "k", 100L), true)
+  // expired
+  assert_eq(jwt_authorized(Some(token), "k", 100000L), false)
+  // wrong secret
+  assert_eq(jwt_authorized(Some(token), "other", 100L), false)
+  // absent
+  assert_eq(jwt_authorized(None, "k", 100L), false)
+  // garbage
+  assert_eq(jwt_authorized(Some("not-a-jwt"), "k", 100L), false)
+}
+
+///|
+test "auth middleware assembles into an AsgiApp" {
+  let app = @moonapi.App::new()
+  app.get("/secret", _ctx => @moonapi.text(200, "classified"))
+  let clock = ManualClock::new().as_clock()
+  let _ = auth("k", clock)(app.to_asgi())
+}
+
+///|
+test "unauthorized_events carry a 401 and a bearer challenge" {
+  let events = unauthorized_events()
+  let mut status = 0
+  let mut challenge : String? = None
+  for e in events {
+    match e {
+      HttpResponseStart(status=s, headers~) => {
+        status = s
+        for h in headers {
+          if h.0 == "www-authenticate" {
+            challenge = Some(h.1)
+          }
+        }
+      }
+      _ => ()
+    }
+  }
+  assert_eq(status, 401)
+  assert_eq(challenge, Some("Bearer"))
+}

config.mbt

@@ -36,6 +36,35 @@ pub fn ServiceConf::from_json(src : String) -> ServiceConf raise ConfigError {
     Object(m) => m
     _ => raise ConfigError("config root must be a JSON object")
   }
+  service_conf_of_object(obj)
+}
+
+///|
+/// Load a `ServiceConf` from a **YAML** config string — the format go-zero
+/// actually ships (`etc/*.yaml`) — with the same lenient, default-filling
+/// semantics as `from_json`: an empty document yields exactly
+/// `ServiceConf::new()`, and each omitted field falls back to its `new()`
+/// default. The YAML is parsed by the self-built `yaml_parse` (block mappings,
+/// nesting, sequences, scalars, comments) into a `Json` object, then decoded by
+/// the shared field reader — so JSON and YAML configs agree field-for-field.
+///
+/// Raises `ConfigError` on malformed YAML, a non-mapping root, or a field of the
+/// wrong type.
+pub fn ServiceConf::from_yaml(src : String) -> ServiceConf raise ConfigError {
+  let obj = match yaml_parse(src) {
+    Object(m) => m
+    _ => raise ConfigError("config root must be a YAML mapping")
+  }
+  service_conf_of_object(obj)
+}
+
+///|
+/// Decode a `ServiceConf` from an already-parsed config object, filling every
+/// omitted field from `ServiceConf::new()`'s defaults. Shared by the JSON and
+/// YAML loaders so both formats apply identical lenient semantics.
+fn service_conf_of_object(
+  obj : Map[String, Json],
+) -> ServiceConf raise ConfigError {
   let def = ServiceConf::new()
   let name = string_field(obj, "name", def.name)
   let host = string_field(obj, "host", def.host)

crypto.mbt

@@ -0,0 +1,152 @@
+///|
+/// The 64 SHA-256 round constants (§4.2.2 of FIPS 180-4): the first 32 bits of
+/// the fractional parts of the cube roots of the first 64 primes.
+let sha256_k : Array[UInt] = [
+  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4,
+  0xab1c5ed5, 0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe,
+  0x9bdc06a7, 0xc19bf174, 0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f,
+  0x4a7484aa, 0x5cb0a9dc, 0x76f988da, 0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7,
+  0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967, 0x27b70a85, 0x2e1b2138, 0x4d2c6dfc,
+  0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85, 0xa2bfe8a1, 0xa81a664b,
+  0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070, 0x19a4c116,
+  0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,
+  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7,
+  0xc67178f2,
+]
+
+///|
+/// A 32-bit right-rotation, the diffusion operator SHA-256 is built from.
+fn rotr32(x : UInt, n : Int) -> UInt {
+  (x >> n) | (x << (32 - n))
+}
+
+///|
+/// SHA-256 (FIPS 180-4): hash an arbitrary byte string to a 32-byte digest. A
+/// self-built primitive — MoonBit's core ships no `crypto` — implementing the
+/// full message schedule and 64-round compression over 512-bit blocks with the
+/// standard length-padding. Verified against the NIST vectors (`""`, `"abc"`).
+/// The building block for `hmac_sha256`, and through it for JWT HS256 signing.
+pub fn sha256(msg : Bytes) -> Bytes {
+  let mut h0 : UInt = 0x6a09e667
+  let mut h1 : UInt = 0xbb67ae85
+  let mut h2 : UInt = 0x3c6ef372
+  let mut h3 : UInt = 0xa54ff53a
+  let mut h4 : UInt = 0x510e527f
+  let mut h5 : UInt = 0x9b05688c
+  let mut h6 : UInt = 0x1f83d9ab
+  let mut h7 : UInt = 0x5be0cd19
+  let bitlen = (msg.length() * 8).to_uint64()
+  let buf = Buffer()
+  buf.write_bytes(msg[:])
+  buf.write_byte(b'\x80')
+  while buf.length() % 64 != 56 {
+    buf.write_byte(b'\x00')
+  }
+  for i = 7; i >= 0; i = i - 1 {
+    buf.write_byte(((bitlen >> (i * 8)) & 0xFF).to_byte())
+  }
+  let data = buf.to_bytes()
+  let w : Array[UInt] = Array::make(64, 0U)
+  let nblocks = data.length() / 64
+  for b = 0; b < nblocks; b = b + 1 {
+    let off = b * 64
+    for i = 0; i < 16; i = i + 1 {
+      let j = off + i * 4
+      w[i] = (data[j].to_int().reinterpret_as_uint() << 24) |
+        (data[j + 1].to_int().reinterpret_as_uint() << 16) |
+        (data[j + 2].to_int().reinterpret_as_uint() << 8) |
+        data[j + 3].to_int().reinterpret_as_uint()
+    }
+    for i = 16; i < 64; i = i + 1 {
+      let s0 = rotr32(w[i - 15], 7) ^ rotr32(w[i - 15], 18) ^ (w[i - 15] >> 3)
+      let s1 = rotr32(w[i - 2], 17) ^ rotr32(w[i - 2], 19) ^ (w[i - 2] >> 10)
+      w[i] = w[i - 16] + s0 + w[i - 7] + s1
+    }
+    let mut a = h0
+    let mut bb = h1
+    let mut c = h2
+    let mut d = h3
+    let mut e = h4
+    let mut f = h5
+    let mut g = h6
+    let mut hh = h7
+    for i = 0; i < 64; i = i + 1 {
+      let s1 = rotr32(e, 6) ^ rotr32(e, 11) ^ rotr32(e, 25)
+      let ch = (e & f) ^ (e.lnot() & g)
+      let t1 = hh + s1 + ch + sha256_k[i] + w[i]
+      let s0 = rotr32(a, 2) ^ rotr32(a, 13) ^ rotr32(a, 22)
+      let maj = (a & bb) ^ (a & c) ^ (bb & c)
+      let t2 = s0 + maj
+      hh = g
+      g = f
+      f = e
+      e = d + t1
+      d = c
+      c = bb
+      bb = a
+      a = t1 + t2
+    }
+    h0 = h0 + a
+    h1 = h1 + bb
+    h2 = h2 + c
+    h3 = h3 + d
+    h4 = h4 + e
+    h5 = h5 + f
+    h6 = h6 + g
+    h7 = h7 + hh
+  }
+  let out = Buffer()
+  for hv in [h0, h1, h2, h3, h4, h5, h6, h7] {
+    out.write_byte((hv >> 24).to_byte())
+    out.write_byte((hv >> 16).to_byte())
+    out.write_byte((hv >> 8).to_byte())
+    out.write_byte(hv.to_byte())
+  }
+  out.to_bytes()
+}
+
+///|
+/// HMAC-SHA256 (RFC 2104): a keyed message-authentication code over `sha256`.
+/// A key longer than the 64-byte block is hashed first; a shorter key is
+/// zero-padded. The message is authenticated as
+/// `H((K ⊕ opad) ∥ H((K ⊕ ipad) ∥ msg))`. Verified against RFC 4231 test case
+/// 2. This is the signature function behind JWT HS256.
+pub fn hmac_sha256(key : Bytes, msg : Bytes) -> Bytes {
+  let block = 64
+  let k0 = Buffer()
+  if key.length() > block {
+    k0.write_bytes(sha256(key)[:])
+  } else {
+    k0.write_bytes(key[:])
+  }
+  while k0.length() < block {
+    k0.write_byte(b'\x00')
+  }
+  let kb = k0.to_bytes()
+  let ipad = Buffer()
+  let opad = Buffer()
+  for i = 0; i < block; i = i + 1 {
+    ipad.write_byte((kb[i].to_int() ^ 0x36).to_byte())
+    opad.write_byte((kb[i].to_int() ^ 0x5c).to_byte())
+  }
+  ipad.write_bytes(msg[:])
+  let inner = sha256(ipad.to_bytes())
+  opad.write_bytes(inner[:])
+  sha256(opad.to_bytes())
+}
+
+///|
+/// A constant-time byte-string equality: it inspects every byte of both inputs
+/// regardless of where they first differ, so an attacker cannot recover a valid
+/// signature byte-by-byte from response timing. Unequal lengths return `false`
+/// immediately (length is not secret). Used to compare JWT signatures.
+pub fn constant_time_eq(a : Bytes, b : Bytes) -> Bool {
+  if a.length() != b.length() {
+    return false
+  }
+  let mut diff = 0
+  for i = 0; i < a.length(); i = i + 1 {
+    diff = diff | (a[i].to_int() ^ b[i].to_int())
+  }
+  diff == 0
+}