From 5c04ec2ba18be439eb3d6a276e8155bc76cbf877 Mon Sep 17 00:00:00 2001
From: Ishaan Jaff <ishaan@berri.ai>
Date: Wed, 24 Jun 2026 12:33:39 -0700
Subject: [PATCH] feat(ai-gateway): AppState carries authenticator + key cache

---
 litellm-rust/crates/ai-gateway/src/state.rs | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/litellm-rust/crates/ai-gateway/src/state.rs b/litellm-rust/crates/ai-gateway/src/state.rs
index c7ba92d9cbc..95102d30694 100644
--- a/litellm-rust/crates/ai-gateway/src/state.rs
+++ b/litellm-rust/crates/ai-gateway/src/state.rs
@@ -14,4 +14,16 @@ pub struct AppState {
     /// (`RealtimePool::disabled()`) when `REALTIME_POOL_SIZE=0`, in which case
     /// every realtime connect fresh-dials exactly as before.
     pub realtime_pool: Arc<RealtimePool>,
+    /// Verifies virtual keys. A trait object so the v0 "call Python" backend can be
+    /// swapped for a native Rust one at startup without touching routes or state.
+    pub authenticator: Arc<dyn crate::auth::KeyAuthenticator>,
+    /// Bounded TTL cache of verified keys, in front of `authenticator`.
+    pub key_cache: Arc<crate::auth::KeyCache>,
+}
+
+impl AppState {
+    /// Constant-time check of `token` against the configured master key.
+    pub fn is_master_key(&self, token: &str) -> bool {
+        crate::auth::user_api_key::is_master_key(self.master_key.as_deref(), token)
+    }
 }