perf: reduce gateway db pressure under load

apps/aether-gateway/src/control/auth/credentials.rs

@@ -90,6 +90,7 @@ pub(super) fn build_auth_context_cache_key(
     }
 
     let extracted = extract_request_credentials(headers, uri, signature);
+    let trusted_headers = extracted.trusted_headers;
     let bundle = extracted.bundle;
     if bundle.authorization_bearer.is_none()
         && bundle.x_api_key.is_none()
@@ -97,18 +98,41 @@ pub(super) fn build_auth_context_cache_key(
         && bundle.x_goog_api_key.is_none()
         && bundle.query_key.is_none()
         && bundle.cookie_header.is_none()
+        && trusted_headers.is_none()
     {
         return None;
     }
 
+    let (trusted_user_id, trusted_api_key_id, trusted_balance_remaining, trusted_access_allowed) =
+        trusted_headers
+            .map(|trusted| {
+                (
+                    trusted.user_id,
+                    trusted.api_key_id,
+                    trusted
+                        .balance_remaining
+                        .map(|value| value.to_string())
+                        .unwrap_or_default(),
+                    trusted
+                        .access_allowed
+                        .map(|value| value.to_string())
+                        .unwrap_or_default(),
+                )
+            })
+            .unwrap_or_default();
+
     Some(format!(
-        "{signature}\n{}\n{}\n{}\n{}\n{}\n{}",
+        "{signature}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}\n{}",
         bundle.authorization_bearer.unwrap_or_default(),
         bundle.x_api_key.unwrap_or_default(),
         bundle.api_key.unwrap_or_default(),
         bundle.x_goog_api_key.unwrap_or_default(),
         bundle.query_key.unwrap_or_default(),
         bundle.cookie_header.unwrap_or_default(),
+        trusted_user_id,
+        trusted_api_key_id,
+        trusted_balance_remaining,
+        trusted_access_allowed,
     ))
 }
 
@@ -551,6 +575,103 @@ mod tests {
         assert!(cache_key.contains("session=abc123"));
     }
 
+    #[test]
+    fn cache_key_includes_trusted_auth_headers() {
+        let mut first_headers = http::HeaderMap::new();
+        first_headers.insert(
+            crate::constants::GATEWAY_HEADER,
+            "rust-phase3b".parse().unwrap(),
+        );
+        first_headers.insert(
+            crate::constants::TRUSTED_AUTH_USER_ID_HEADER,
+            "user-1".parse().unwrap(),
+        );
+        first_headers.insert(
+            crate::constants::TRUSTED_AUTH_API_KEY_ID_HEADER,
+            "key-1".parse().unwrap(),
+        );
+        first_headers.insert(
+            crate::constants::TRUSTED_AUTH_BALANCE_HEADER,
+            "1.5".parse().unwrap(),
+        );
+        first_headers.insert(
+            crate::constants::TRUSTED_AUTH_ACCESS_ALLOWED_HEADER,
+            "true".parse().unwrap(),
+        );
+
+        let mut second_headers = first_headers.clone();
+        second_headers.insert(
+            crate::constants::TRUSTED_AUTH_USER_ID_HEADER,
+            "user-2".parse().unwrap(),
+        );
+        second_headers.insert(
+            crate::constants::TRUSTED_AUTH_ACCESS_ALLOWED_HEADER,
+            "false".parse().unwrap(),
+        );
+
+        let first = build_auth_context_cache_key(
+            &first_headers,
+            &uri("/v1/chat/completions"),
+            "openai:chat",
+        )
+        .expect("trusted cache key should exist");
+        let second = build_auth_context_cache_key(
+            &second_headers,
+            &uri("/v1/chat/completions"),
+            "openai:chat",
+        )
+        .expect("trusted cache key should exist");
+
+        assert_ne!(first, second);
+        assert!(first.contains("user-1"));
+        assert!(first.contains("key-1"));
+        assert!(first.contains("1.5"));
+        assert!(first.contains("true"));
+        assert!(second.contains("user-2"));
+        assert!(second.contains("false"));
+    }
+
+    #[test]
+    fn cache_key_ignores_untrusted_auth_identity_headers() {
+        let mut trusted_headers = http::HeaderMap::new();
+        trusted_headers.insert(
+            crate::constants::GATEWAY_HEADER,
+            "rust-phase3b".parse().unwrap(),
+        );
+        trusted_headers.insert(
+            crate::constants::TRUSTED_AUTH_USER_ID_HEADER,
+            "user-1".parse().unwrap(),
+        );
+        trusted_headers.insert(
+            crate::constants::TRUSTED_AUTH_API_KEY_ID_HEADER,
+            "key-1".parse().unwrap(),
+        );
+
+        let mut untrusted_headers = http::HeaderMap::new();
+        untrusted_headers.insert(
+            crate::constants::TRUSTED_AUTH_USER_ID_HEADER,
+            "user-1".parse().unwrap(),
+        );
+        untrusted_headers.insert(
+            crate::constants::TRUSTED_AUTH_API_KEY_ID_HEADER,
+            "key-1".parse().unwrap(),
+        );
+
+        let trusted = build_auth_context_cache_key(
+            &trusted_headers,
+            &uri("/v1/chat/completions"),
+            "openai:chat",
+        );
+        let untrusted = build_auth_context_cache_key(
+            &untrusted_headers,
+            &uri("/v1/chat/completions"),
+            "openai:chat",
+        );
+
+        assert!(trusted.is_some());
+        assert_eq!(untrusted, None);
+    }
+
     #[test]
     fn extracts_trusted_auth_headers() {
         let mut headers = http::HeaderMap::new();