feat: complete Rust backend UI compatibility

src/auth/api_key.rs

@@ -8,7 +8,7 @@ use crate::db::models::downstream_api_key::DownstreamApiKey;
 #[derive(Debug, Clone)]
 pub enum DownstreamAuthResult {
     /// Found in downstream_api_keys table.
-    Managed { key: DownstreamApiKey },
+    Managed { key: Box<DownstreamApiKey> },
     /// Matched the global proxy token from config.
     Global { token: String },
 }
@@ -23,6 +23,15 @@ pub async fn authorize_downstream_token(
     pool: &SqlitePool,
     global_proxy_token: Option<&str>,
 ) -> Result<DownstreamAuthResult, String> {
+    if global_proxy_token
+        .map(|global| !global.is_empty() && token == global)
+        .unwrap_or(false)
+    {
+        return Ok(DownstreamAuthResult::Global {
+            token: token.to_string(),
+        });
+    }
+
     // Try managed keys first
     if token.starts_with("sk-") {
         let key: Option<DownstreamApiKey> = sqlx::query_as::<_, DownstreamApiKey>(
@@ -34,30 +43,12 @@ pub async fn authorize_downstream_token(
         .map_err(|e| format!("Database error: {e}"))?;
 
         if let Some(k) = key {
-            return Ok(DownstreamAuthResult::Managed { key: k });
-        }
-
-        if global_proxy_token
-            .map(|global| !global.is_empty() && token == global)
-            .unwrap_or(false)
-        {
-            return Ok(DownstreamAuthResult::Global {
-                token: token.to_string(),
-            });
+            return Ok(DownstreamAuthResult::Managed { key: Box::new(k) });
         }
 
         return Err("Invalid API key".to_string());
     }
 
-    if global_proxy_token
-        .map(|global| !global.is_empty() && token == global)
-        .unwrap_or(false)
-    {
-        return Ok(DownstreamAuthResult::Global {
-            token: token.to_string(),
-        });
-    }
-
     Err("Invalid API key format".to_string())
 }
 
@@ -118,4 +109,14 @@ mod tests {
         assert!(verify_api_key(key, &hash1).unwrap());
         assert!(verify_api_key(key, &hash2).unwrap());
     }
+
+    #[tokio::test]
+    async fn test_global_proxy_token_authorizes_without_db_lookup() {
+        let pool = SqlitePool::connect("sqlite::memory:").await.unwrap();
+        let result = authorize_downstream_token("sk-global", &pool, Some("sk-global"))
+            .await
+            .unwrap();
+
+        assert!(matches!(result, DownstreamAuthResult::Global { .. }));
+    }
 }