feat(cloud-auth): verify scoped bearer tokens

packages/cloud-platform/cloud/sdk/api.py

@@ -10,9 +10,9 @@ authentication can be added later without changing route signatures.
 
 from __future__ import annotations
 
-from dataclasses import dataclass
-from typing import TYPE_CHECKING, Protocol, runtime_checkable
+from typing import TYPE_CHECKING
 
+from cloud.auth import AuthProvider, NullAuthProvider, Principal
 from cloud.sdk.models import (
     DeviceResponse,
     ErrorResponse,
@@ -23,34 +23,12 @@ from cloud.sdk.models import (
     TaskSubmissionRequest,
     TaskSubmissionResponse,
 )
-from fastapi import APIRouter, Depends, HTTPException, Request, status
-from fastapi.responses import JSONResponse
+from fastapi import APIRouter, HTTPException, Request, status
 
 if TYPE_CHECKING:
     from cloud.plugins import PluginRegistry
     from cloud.pool import DevicePool
-    from cloud.scheduler import TaskConstraints, TaskScheduler
-
-
-@dataclass(frozen=True)
-class Principal:
-    """An authenticated principal. ``anonymous`` for the NullAuthProvider."""
-
-    id: str = "anonymous"
-
-
-@runtime_checkable
-class AuthProvider(Protocol):
-    """Returns a Principal if the request is allowed, None to reject."""
-
-    def authenticate(self, request: object) -> Principal | None: ...
-
-
-class NullAuthProvider:
-    """Default auth provider: every caller is anonymous-and-allowed."""
-
-    def authenticate(self, request: object) -> Principal | None:
-        return Principal()
+    from cloud.scheduler import TaskScheduler
 
 
 def create_cloud_router(