phase 4: connectrpc on the gateway authenticated edge

Replace the native-gRPC server bootstrap with a single
`connectrpc.com/connect` HTTP/h2c listener. Connect-Go natively
serves Connect, gRPC, and gRPC-Web on the same port, so browsers can
now reach the authenticated surface without giving up the gRPC
framing native and desktop clients may use later. The decorator
stack (envelope → session → payload-hash → signature →
freshness/replay → rate-limit → routing/push) is reused unchanged
behind a small Connect → gRPC adapter and a `grpc.ServerStream`
shim around `*connect.ServerStream`.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

This commit is contained in:

Ilia Denisov

2026-05-07 11:49:28 +02:00

parent 39b7b2ef29

commit 118f7c17a2

30 changed files with 1009 additions and 772 deletions

									
										gateway/internal/grpcapi/envelope.go
									
		+1
		-2
	
												View File
												
				@@ -4,8 +4,7 @@ import (

					"bytes"

					"context"

					"fmt"

					"galaxy/gateway/proto/galaxy/gateway/v1"

					gatewayv1 "galaxy/gateway/proto/galaxy/gateway/v1"

					"buf.build/go/protovalidate"

					"google.golang.org/grpc"