spikard 0.8.3 → 0.10.2

data/vendor/crates/spikard-rb/src/grpc/handler.rs

@@ -1,30 +1,40 @@
-//! Ruby gRPC handler implementation using Magnus FFI
+//! Ruby gRPC handler implementation
 //!
-//! This module provides a bridge between Ruby code implementing gRPC handlers
-//! and Spikard's Rust-based gRPC runtime. It handles serialization/deserialization
-//! of protobuf messages as binary strings.
+//! This module provides Magnus bindings for gRPC request/response handling,
+//! enabling Ruby code to implement gRPC service handlers with full streaming support.
+
+// Allow dead code - these types are exported but not yet integrated into the main Ruby API
+#![allow(dead_code)]
 
 use bytes::Bytes;
+use futures::stream::StreamExt;
 use magnus::prelude::*;
 use magnus::value::{InnerValue, Opaque};
-use magnus::{Error, RHash, RString, Ruby, Symbol, TryConvert, Value, gc::Marker};
-use spikard_bindings_shared::grpc_metadata::{extract_metadata_to_hashmap, hashmap_to_metadata};
+use magnus::{Error, Module, RArray, RHash, RString, Ruby, Value};
+use spikard_http::grpc::streaming::{MessageStream, StreamingRequest};
 use spikard_http::grpc::{GrpcHandler, GrpcHandlerResult, GrpcRequestData, GrpcResponseData};
 use std::cell::RefCell;
 use std::collections::HashMap;
 use std::future::Future;
-use std::panic::AssertUnwindSafe;
 use std::pin::Pin;
 use std::sync::Arc;
-
-use crate::gvl::with_gvl;
-
-/// Ruby-facing gRPC request object
+use std::time::Duration;
+use tonic::metadata::MetadataMap;
+
+/// DOS protection limits
+const MAX_METADATA_ENTRIES: usize = 128;
+const MAX_METADATA_KEY_SIZE: usize = 1024;
+const MAX_METADATA_VALUE_SIZE: usize = 8192;
+const MAX_PAYLOAD_BYTES: usize = 100 * 1024 * 1024; // 100MB
+const MAX_STREAM_MESSAGES: usize = 10_000;
+const MAX_STREAM_TOTAL_BYTES: usize = 500 * 1024 * 1024; // 500MB total for streams
+const HANDLER_TIMEOUT_SECS: u64 = 30;
+
+/// Ruby gRPC request class
 ///
-/// This struct is exposed to Ruby code and contains the parsed components
-/// of a gRPC request. The payload is provided as a binary string that Ruby
-/// code can deserialize using the google-protobuf gem.
-#[derive(Debug, Clone)]
+/// Represents a gRPC request passed to Ruby handlers.
+/// Contains service name, method name, serialized payload, and metadata.
+#[derive(Clone)]
 #[magnus::wrap(class = "Spikard::Grpc::Request", free_immediately)]
 pub struct RubyGrpcRequest {
     service_name: String,
@@ -34,47 +44,61 @@ pub struct RubyGrpcRequest {
 }
 
 impl RubyGrpcRequest {
-    /// Create a new RubyGrpcRequest from GrpcRequestData
-    fn from_grpc_request(request: GrpcRequestData) -> Self {
-        let metadata = extract_metadata_to_hashmap(&request.metadata, true);
+    /// Create a new Ruby gRPC request
+    pub fn new(service_name: String, method_name: String, payload: Vec<u8>, metadata: HashMap<String, String>) -> Self {
         Self {
-            service_name: request.service_name,
-            method_name: request.method_name,
-            payload: request.payload.to_vec(),
+            service_name,
+            method_name,
+            payload,
             metadata,
         }
     }
 
-    /// Get the service name
-    fn service_name(&self) -> &str {
-        &self.service_name
+    /// Get service name
+    fn rb_service_name(&self) -> String {
+        self.service_name.clone()
     }
 
-    /// Get the method name
-    fn method_name(&self) -> &str {
-        &self.method_name
+    /// Get method name
+    fn rb_method_name(&self) -> String {
+        self.method_name.clone()
     }
 
-    /// Get the payload as a binary string
-    fn payload(ruby: &Ruby, rb_self: &Self) -> Value {
-        ruby.str_from_slice(&rb_self.payload).as_value()
+    /// Get payload as Ruby string (binary)
+    fn rb_payload(ruby: &Ruby, this: &Self) -> Result<Value, Error> {
+        Ok(ruby.str_from_slice(&this.payload).as_value())
     }
 
-    /// Get metadata as a Ruby hash
-    fn metadata(ruby: &Ruby, rb_self: &Self) -> Result<Value, Error> {
-        let hash = ruby.hash_new();
-        for (key, value) in &rb_self.metadata {
+    /// Get metadata as Ruby hash
+    fn rb_metadata(ruby: &Ruby, this: &Self) -> Result<Value, Error> {
+        let hash = ruby.hash_new_capa(this.metadata.len());
+        for (key, value) in &this.metadata {
             hash.aset(ruby.str_new(key), ruby.str_new(value))?;
         }
         Ok(hash.as_value())
     }
+
+    /// Get metadata value by key
+    fn rb_get_metadata(&self, key: String) -> Option<String> {
+        self.metadata.get(&key).cloned()
+    }
+
+    /// String representation for debugging
+    fn rb_inspect(&self) -> String {
+        format!(
+            "#<Spikard::Grpc::Request service_name={:?} method_name={:?} payload_size={}>",
+            self.service_name,
+            self.method_name,
+            self.payload.len()
+        )
+    }
 }
 
-/// Ruby-facing gRPC response object
+/// Ruby gRPC response class
 ///
-/// Ruby code creates instances of this class to return gRPC responses.
-/// The payload should be a binary string containing the serialized protobuf message.
-#[derive(Debug, Clone, Default)]
+/// Represents a gRPC response returned from Ruby handlers.
+/// Contains serialized payload and optional metadata.
+#[derive(Clone)]
 #[magnus::wrap(class = "Spikard::Grpc::Response", free_immediately)]
 pub struct RubyGrpcResponse {
     payload: RefCell<Vec<u8>>,
@@ -82,186 +106,678 @@ pub struct RubyGrpcResponse {
 }
 
 impl RubyGrpcResponse {
-    /// Initialize the response with a payload (called by Ruby's new)
-    fn initialize(&self, args: &[Value]) -> Result<(), Error> {
-        // Handle both positional and keyword arguments
-        let payload_value = if args.is_empty() {
-            return Err(Error::new(magnus::exception::arg_error(), "missing keyword: payload"));
-        } else if args.len() == 1 {
-            // Check if it's a hash (keyword args) or a string (positional arg)
-            if let Ok(hash) = RHash::try_convert(args[0]) {
-                // Keyword arguments: { payload: "data" }
-                hash.get(Symbol::new("payload"))
-                    .ok_or_else(|| Error::new(magnus::exception::arg_error(), "missing keyword: payload"))?
-            } else {
-                // Positional argument: "data"
-                args[0]
+    /// Create a new Ruby gRPC response from Ruby
+    fn rb_new(ruby: &Ruby, args: &[Value]) -> Result<Self, Error> {
+        let (payload, metadata) = match args {
+            [single] => {
+                if let Ok(hash) = RHash::try_convert(*single) {
+                    let payload_value = get_kw(hash, ruby, "payload")
+                        .ok_or_else(|| Error::new(magnus::exception::arg_error(), "Response.new requires a payload"))?;
+
+                    // Validate that payload is not nil
+                    if payload_value.is_nil() {
+                        return Err(Error::new(magnus::exception::arg_error(), "payload cannot be nil"));
+                    }
+
+                    let payload = RString::try_convert(payload_value)
+                        .map_err(|_| Error::new(magnus::exception::arg_error(), "payload must be a String"))?;
+                    let metadata_value = get_kw(hash, ruby, "metadata");
+                    let metadata = match metadata_value {
+                        Some(value) if !value.is_nil() => Some(RHash::try_convert(value)?),
+                        _ => None,
+                    };
+                    (payload, metadata)
+                } else {
+                    // Validate that single is not nil
+                    if single.is_nil() {
+                        return Err(Error::new(magnus::exception::arg_error(), "payload cannot be nil"));
+                    }
+
+                    let payload = RString::try_convert(*single)
+                        .map_err(|_| Error::new(magnus::exception::arg_error(), "payload must be a String"))?;
+                    (payload, None)
+                }
+            }
+            [payload_value, metadata_value] => {
+                // Validate that payload is not nil
+                if payload_value.is_nil() {
+                    return Err(Error::new(magnus::exception::arg_error(), "payload cannot be nil"));
+                }
+
+                let payload = RString::try_convert(*payload_value)
+                    .map_err(|_| Error::new(magnus::exception::arg_error(), "payload must be a String"))?;
+                let metadata = if metadata_value.is_nil() {
+                    None
+                } else {
+                    Some(RHash::try_convert(*metadata_value)?)
+                };
+                (payload, metadata)
+            }
+            _ => {
+                return Err(Error::new(
+                    magnus::exception::arg_error(),
+                    "Response.new expects payload or payload with metadata",
+                ));
             }
+        };
+        // SAFETY: RString::as_slice() is safe when the Ruby VM is active (which it is here since
+        // we're in a Ruby method call). The slice is immediately copied to owned Vec<u8>.
+        let payload_bytes = unsafe { payload.as_slice().to_vec() };
+
+        if payload_bytes.len() > MAX_PAYLOAD_BYTES {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!(
+                    "Payload size {} exceeds maximum {}",
+                    payload_bytes.len(),
+                    MAX_PAYLOAD_BYTES
+                ),
+            ));
+        }
+
+        let meta = if let Some(hash) = metadata {
+            ruby_hash_to_string_map(&hash)?
         } else {
-            return Err(Error::new(magnus::exception::arg_error(), "wrong number of arguments"));
+            HashMap::new()
         };
 
-        let payload_str = RString::try_convert(payload_value)
-            .map_err(|_| Error::new(magnus::exception::arg_error(), "payload must be a String (binary)"))?;
+        if meta.len() > MAX_METADATA_ENTRIES {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!(
+                    "Metadata entries {} exceeds maximum {}",
+                    meta.len(),
+                    MAX_METADATA_ENTRIES
+                ),
+            ));
+        }
 
-        let payload_bytes = unsafe { payload_str.as_slice() }.to_vec();
+        Ok(Self {
+            payload: RefCell::new(payload_bytes),
+            metadata: RefCell::new(meta),
+        })
+    }
+
+    /// Get payload
+    fn rb_payload(ruby: &Ruby, this: &Self) -> Result<Value, Error> {
+        let payload = this.payload.borrow();
+        Ok(ruby.str_from_slice(&payload).as_value())
+    }
 
-        *self.payload.borrow_mut() = payload_bytes;
-        *self.metadata.borrow_mut() = HashMap::new();
+    /// Set payload
+    fn rb_set_payload(&self, payload: RString) -> Result<(), Error> {
+        // SAFETY: RString::as_slice() is safe when Ruby VM is active.
+        let bytes = unsafe { payload.as_slice().to_vec() };
+        if bytes.len() > MAX_PAYLOAD_BYTES {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!("Payload size {} exceeds maximum {}", bytes.len(), MAX_PAYLOAD_BYTES),
+            ));
+        }
+        *self.payload.borrow_mut() = bytes;
         Ok(())
     }
 
-    /// Set metadata on the response
-    fn set_metadata(&self, metadata: Value) -> Result<(), Error> {
+    /// Get metadata
+    fn rb_metadata(ruby: &Ruby, this: &Self) -> Result<Value, Error> {
+        let meta = this.metadata.borrow();
+        let hash = ruby.hash_new_capa(meta.len());
+        for (key, value) in meta.iter() {
+            hash.aset(ruby.str_new(key), ruby.str_new(value))?;
+        }
+        Ok(hash.as_value())
+    }
+
+    /// Set metadata
+    fn rb_set_metadata(&self, metadata: Value) -> Result<(), Error> {
+        // Handle nil metadata - treat as empty hash
         if metadata.is_nil() {
+            *self.metadata.borrow_mut() = HashMap::new();
             return Ok(());
         }
 
         let hash = RHash::try_convert(metadata)?;
-        let metadata_map = hash.to_hash_map::<String, String>()?;
-        *self.metadata.borrow_mut() = metadata_map;
+        let meta = ruby_hash_to_string_map(&hash)?;
+        if meta.len() > MAX_METADATA_ENTRIES {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!(
+                    "Metadata entries {} exceeds maximum {}",
+                    meta.len(),
+                    MAX_METADATA_ENTRIES
+                ),
+            ));
+        }
+        *self.metadata.borrow_mut() = meta;
         Ok(())
     }
 
-    /// Get the payload
-    fn payload(ruby: &Ruby, rb_self: &Self) -> Value {
-        ruby.str_from_slice(&rb_self.payload.borrow()).as_value()
+    /// String representation
+    fn rb_inspect(&self) -> String {
+        format!(
+            "#<Spikard::Grpc::Response payload_size={}>",
+            self.payload.borrow().len()
+        )
     }
+}
 
-    /// Get metadata as a Ruby hash
-    fn get_metadata(ruby: &Ruby, rb_self: &Self) -> Result<Value, Error> {
-        let hash = ruby.hash_new();
-        for (key, value) in rb_self.metadata.borrow().iter() {
-            hash.aset(ruby.str_new(key), ruby.str_new(value))?;
+fn get_kw(hash: RHash, ruby: &Ruby, key: &str) -> Option<Value> {
+    hash.get(ruby.to_symbol(key)).or_else(|| hash.get(ruby.str_new(key)))
+}
+
+/// Convert Ruby hash to HashMap<String, String>
+fn ruby_hash_to_string_map(hash: &RHash) -> Result<HashMap<String, String>, Error> {
+    let mut map = HashMap::new();
+    hash.foreach(|key: Value, value: Value| {
+        let key_str = String::try_convert(key)?;
+        if key_str.len() > MAX_METADATA_KEY_SIZE {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!("Metadata key exceeds maximum size {}", MAX_METADATA_KEY_SIZE),
+            ));
         }
-        Ok(hash.as_value())
-    }
 
-    /// Convert to GrpcResponseData
-    fn into_grpc_response(self) -> Result<GrpcResponseData, String> {
-        let metadata = hashmap_to_metadata(&self.metadata.borrow())?;
+        let value_str = String::try_convert(value)?;
+        if value_str.len() > MAX_METADATA_VALUE_SIZE {
+            return Err(Error::new(
+                magnus::exception::arg_error(),
+                format!("Metadata value exceeds maximum size {}", MAX_METADATA_VALUE_SIZE),
+            ));
+        }
 
-        Ok(GrpcResponseData {
-            payload: Bytes::from(self.payload.borrow().clone()),
-            metadata,
-        })
+        map.insert(key_str, value_str);
+        Ok(magnus::r_hash::ForEach::Continue)
+    })?;
+    Ok(map)
+}
+
+/// Convert MetadataMap to HashMap<String, String>
+fn metadata_map_to_hashmap(metadata: &MetadataMap) -> HashMap<String, String> {
+    let mut map = HashMap::new();
+    for key_value in metadata.iter() {
+        if let tonic::metadata::KeyAndValueRef::Ascii(key, value) = key_value
+            && let Ok(value_str) = value.to_str()
+        {
+            map.insert(key.as_str().to_string(), value_str.to_string());
+        }
     }
+    map
 }
 
-/// Ruby gRPC handler wrapper
+/// Convert HashMap to MetadataMap
+fn hashmap_to_metadata_map(map: &HashMap<String, String>) -> Result<MetadataMap, tonic::Status> {
+    let mut metadata = MetadataMap::new();
+    for (key, value) in map {
+        let metadata_key = key
+            .parse::<tonic::metadata::MetadataKey<tonic::metadata::Ascii>>()
+            .map_err(|e| tonic::Status::invalid_argument(format!("Invalid metadata key '{}': {}", key, e)))?;
+        let metadata_value = value
+            .parse::<tonic::metadata::MetadataValue<tonic::metadata::Ascii>>()
+            .map_err(|e| tonic::Status::invalid_argument(format!("Invalid metadata value for key '{}': {}", key, e)))?;
+        metadata.insert(metadata_key, metadata_value);
+    }
+    Ok(metadata)
+}
+
+/// Convert Ruby exception to gRPC status
 ///
-/// Wraps a Ruby handler object and implements the GrpcHandler trait,
-/// allowing Ruby code to handle gRPC requests.
-#[derive(Clone)]
-pub struct RubyGrpcHandler {
-    inner: Arc<RubyGrpcHandlerInner>,
+/// Maps Ruby exceptions to appropriate gRPC status codes without exposing
+/// internal implementation details to clients.
+fn ruby_error_to_grpc_status(err: Error) -> tonic::Status {
+    let msg = err.to_string();
+
+    // Log the full error for debugging but return sanitized messages to clients
+    tracing::error!(error = %msg, "Ruby handler error");
+
+    // Check common Ruby exception types by message patterns
+    // Return sanitized error messages to avoid leaking internal details
+    if msg.contains("ArgumentError") || msg.contains("invalid") {
+        tonic::Status::invalid_argument("Invalid argument")
+    } else if msg.contains("PermissionError") || msg.contains("permission") {
+        tonic::Status::permission_denied("Permission denied")
+    } else if msg.contains("NotImplementedError") || msg.contains("not implemented") {
+        tonic::Status::unimplemented("Method not implemented")
+    } else if msg.contains("Timeout") || msg.contains("timeout") {
+        tonic::Status::deadline_exceeded("Request timeout")
+    } else if msg.contains("NotFoundError") || msg.contains("not found") {
+        tonic::Status::not_found("Resource not found")
+    } else {
+        tonic::Status::internal("Handler error")
+    }
 }
 
-struct RubyGrpcHandlerInner {
+/// Extract RubyGrpcResponse from a Ruby value
+fn extract_ruby_response(response_value: Value) -> Result<(Vec<u8>, HashMap<String, String>), Error> {
+    // Try to extract as RubyGrpcResponse
+    if let Ok(response) = <&RubyGrpcResponse>::try_convert(response_value) {
+        let payload = response.payload.borrow().clone();
+        let metadata = response.metadata.borrow().clone();
+        return Ok((payload, metadata));
+    }
+
+    // Fallback: try to extract as raw bytes (RString)
+    if let Ok(bytes) = RString::try_convert(response_value) {
+        // SAFETY: RString::as_slice() is safe when Ruby VM is active.
+        let payload = unsafe { bytes.as_slice().to_vec() };
+        return Ok((payload, HashMap::new()));
+    }
+
+    Err(Error::new(
+        magnus::exception::type_error(),
+        "Response must be a Spikard::Grpc::Response or binary string",
+    ))
+}
+
+/// Ruby gRPC handler that bridges Ruby code to Rust's GrpcHandler trait
+pub struct RubyGrpcHandler {
+    /// Ruby handler proc/callable stored safely for cross-thread access
     handler: Opaque<Value>,
-    service_name: String,
+    /// Fully qualified service name
+    service_name: Arc<str>,
 }
 
 impl RubyGrpcHandler {
-    /// Create a new RubyGrpcHandler
-    ///
-    /// # Arguments
-    ///
-    /// * `handler` - A Ruby object that responds to `handle_request(request)`
-    /// * `service_name` - The fully qualified service name (e.g., "mypackage.MyService")
-    #[allow(dead_code)]
+    /// Create a new Ruby gRPC handler
     pub fn new(handler: Value, service_name: String) -> Self {
         Self {
-            inner: Arc::new(RubyGrpcHandlerInner {
-                handler: Opaque::from(handler),
-                service_name,
-            }),
+            handler: Opaque::from(handler),
+            service_name: Arc::from(service_name.as_str()),
         }
     }
 
-    /// Required by Ruby GC; invoked through the magnus mark hook.
-    #[allow(dead_code)]
-    pub fn mark(&self, marker: &Marker) {
-        if let Ok(ruby) = Ruby::get() {
-            let handler_val = self.inner.handler.get_inner_with(&ruby);
-            marker.mark(handler_val);
+    /// Create a RubyGrpcRequest from GrpcRequestData
+    fn create_ruby_request(_ruby: &Ruby, request: &GrpcRequestData) -> Result<RubyGrpcRequest, Error> {
+        let metadata = metadata_map_to_hashmap(&request.metadata);
+        Ok(RubyGrpcRequest::new(
+            request.service_name.clone(),
+            request.method_name.clone(),
+            request.payload.to_vec(),
+            metadata,
+        ))
+    }
+
+    /// Call the Ruby handler with a request
+    fn call_ruby_handler(ruby: &Ruby, handler: Value, request: RubyGrpcRequest) -> Result<Value, Error> {
+        let request_value = ruby.wrap(request);
+
+        // Check if handler is callable or has handle_request method
+        if handler.respond_to("call", false)? {
+            handler.funcall("call", (request_value,))
+        } else if handler.respond_to("handle_request", false)? {
+            handler.funcall("handle_request", (request_value,))
+        } else {
+            Err(Error::new(
+                magnus::exception::type_error(),
+                "Handler must be callable (respond to #call) or have a #handle_request method",
+            ))
         }
     }
 
-    /// Handle a gRPC request by calling into Ruby
-    fn handle_request(&self, request: GrpcRequestData) -> GrpcHandlerResult {
-        with_gvl(|| {
-            let result = std::panic::catch_unwind(AssertUnwindSafe(|| self.handle_request_inner(request)));
-            match result {
-                Ok(res) => res,
-                Err(_) => Err(tonic::Status::internal(
-                    "Unexpected panic while executing Ruby gRPC handler",
-                )),
-            }
-        })
+    /// Call the Ruby handler for server streaming
+    fn call_ruby_server_stream(ruby: &Ruby, handler: Value, request: RubyGrpcRequest) -> Result<Value, Error> {
+        let request_value = ruby.wrap(request);
+
+        // Check for handle_server_stream method first, then fall back to call
+        if handler.respond_to("handle_server_stream", false)? {
+            handler.funcall("handle_server_stream", (request_value,))
+        } else if handler.respond_to("call", false)? {
+            handler.funcall("call", (request_value,))
+        } else {
+            Err(Error::new(
+                magnus::exception::type_error(),
+                "Handler must have #handle_server_stream or #call method for server streaming",
+            ))
+        }
     }
 
-    fn handle_request_inner(&self, request: GrpcRequestData) -> GrpcHandlerResult {
-        let ruby =
-            Ruby::get().map_err(|_| tonic::Status::internal("Ruby VM unavailable while invoking gRPC handler"))?;
+    /// Call the Ruby handler for client streaming
+    fn call_ruby_client_stream(ruby: &Ruby, handler: Value, messages: Vec<Vec<u8>>) -> Result<Value, Error> {
+        // Convert messages to Ruby array of binary strings
+        let array = ruby.ary_new_capa(messages.len());
+        for msg in messages {
+            array.push(ruby.str_from_slice(&msg))?;
+        }
 
-        // Convert request to Ruby object
-        let ruby_request = RubyGrpcRequest::from_grpc_request(request);
-        let request_value = ruby.obj_wrap(ruby_request).as_value();
+        // Check for handle_client_stream method first, then fall back to call
+        if handler.respond_to("handle_client_stream", false)? {
+            handler.funcall("handle_client_stream", (array,))
+        } else if handler.respond_to("call", false)? {
+            handler.funcall("call", (array,))
+        } else {
+            Err(Error::new(
+                magnus::exception::type_error(),
+                "Handler must have #handle_client_stream or #call method for client streaming",
+            ))
+        }
+    }
 
-        // Call Ruby handler
-        let handler_value = self.inner.handler.get_inner_with(&ruby);
-        let response_value = handler_value
-            .funcall::<_, _, Value>("handle_request", (request_value,))
-            .map_err(|err| tonic::Status::internal(format!("Ruby gRPC handler failed: {}", err)))?;
+    /// Call the Ruby handler for bidirectional streaming
+    fn call_ruby_bidi_stream(ruby: &Ruby, handler: Value, messages: Vec<Vec<u8>>) -> Result<Value, Error> {
+        // Convert messages to Ruby array of binary strings
+        let array = ruby.ary_new_capa(messages.len());
+        for msg in messages {
+            array.push(ruby.str_from_slice(&msg))?;
+        }
 
-        // Convert Ruby response to GrpcResponseData
-        let ruby_response = <&RubyGrpcResponse>::try_convert(response_value).map_err(|err| {
-            tonic::Status::internal(format!(
-                "Handler must return Spikard::Grpc::Response, got error: {}",
-                err
+        // Check for handle_bidi_stream method first, then fall back to call
+        if handler.respond_to("handle_bidi_stream", false)? {
+            handler.funcall("handle_bidi_stream", (array,))
+        } else if handler.respond_to("call", false)? {
+            handler.funcall("call", (array,))
+        } else {
+            Err(Error::new(
+                magnus::exception::type_error(),
+                "Handler must have #handle_bidi_stream or #call method for bidirectional streaming",
             ))
-        })?;
+        }
+    }
 
-        ruby_response
-            .clone()
-            .into_grpc_response()
-            .map_err(|err| tonic::Status::internal(format!("Failed to build gRPC response: {}", err)))
+    /// Collect messages from Ruby Enumerator/Array into Vec<Bytes>
+    fn collect_ruby_stream(_ruby: &Ruby, value: Value) -> Result<Vec<Bytes>, Error> {
+        let mut messages = Vec::new();
+
+        // Check if it's an Array
+        if let Ok(array) = RArray::try_convert(value) {
+            for idx in 0..array.len() {
+                if messages.len() >= MAX_STREAM_MESSAGES {
+                    return Err(Error::new(
+                        magnus::exception::runtime_error(),
+                        format!("Stream exceeded maximum {} messages", MAX_STREAM_MESSAGES),
+                    ));
+                }
+
+                let item: Value = array.entry(idx as isize)?;
+                let bytes = Self::extract_message_bytes(item)?;
+                messages.push(bytes);
+            }
+            return Ok(messages);
+        }
+
+        // Check if it's an Enumerator (responds to each)
+        if value.respond_to("each", false)? {
+            // Use to_a to collect enumerable
+            let array: RArray = value.funcall("to_a", ())?;
+            for idx in 0..array.len() {
+                if messages.len() >= MAX_STREAM_MESSAGES {
+                    return Err(Error::new(
+                        magnus::exception::runtime_error(),
+                        format!("Stream exceeded maximum {} messages", MAX_STREAM_MESSAGES),
+                    ));
+                }
+
+                let item: Value = array.entry(idx as isize)?;
+                let bytes = Self::extract_message_bytes(item)?;
+                messages.push(bytes);
+            }
+            return Ok(messages);
+        }
+
+        Err(Error::new(
+            magnus::exception::type_error(),
+            "Stream must be an Array or Enumerable",
+        ))
+    }
+
+    /// Extract bytes from a Ruby value (RubyGrpcResponse or RString)
+    fn extract_message_bytes(value: Value) -> Result<Bytes, Error> {
+        // Try RubyGrpcResponse
+        if let Ok(response) = <&RubyGrpcResponse>::try_convert(value) {
+            let payload = response.payload.borrow().clone();
+            return Ok(Bytes::from(payload));
+        }
+
+        // Try RString
+        if let Ok(string) = RString::try_convert(value) {
+            // SAFETY: RString::as_slice() is safe when Ruby VM is active.
+            let bytes = unsafe { string.as_slice().to_vec() };
+            return Ok(Bytes::from(bytes));
+        }
+
+        Err(Error::new(
+            magnus::exception::type_error(),
+            "Stream message must be a Spikard::Grpc::Response or binary string",
+        ))
     }
 }
 
 impl GrpcHandler for RubyGrpcHandler {
     fn call(&self, request: GrpcRequestData) -> Pin<Box<dyn Future<Output = GrpcHandlerResult> + Send>> {
-        let handler = self.clone();
-        Box::pin(async move { handler.handle_request(request) })
+        let handler = self.handler.clone();
+
+        Box::pin(async move {
+            // Execute Ruby handler in a blocking context
+            tokio::task::spawn_blocking(move || {
+                let ruby = match Ruby::get() {
+                    Ok(r) => r,
+                    Err(e) => return Err(tonic::Status::internal(format!("Failed to get Ruby VM: {}", e))),
+                };
+
+                let handler_value = handler.get_inner_with(&ruby);
+
+                // Create Ruby request
+                let ruby_request = Self::create_ruby_request(&ruby, &request).map_err(ruby_error_to_grpc_status)?;
+
+                // Call handler
+                let response_value =
+                    Self::call_ruby_handler(&ruby, handler_value, ruby_request).map_err(ruby_error_to_grpc_status)?;
+
+                // Extract response
+                let (payload, metadata_map) =
+                    extract_ruby_response(response_value).map_err(ruby_error_to_grpc_status)?;
+
+                let metadata = hashmap_to_metadata_map(&metadata_map)?;
+
+                Ok(GrpcResponseData {
+                    payload: Bytes::from(payload),
+                    metadata,
+                })
+            })
+            .await
+            .map_err(|e| tonic::Status::internal(format!("Task join error: {}", e)))?
+        })
+    }
+
+    fn service_name(&self) -> &str {
+        self.service_name.as_ref()
+    }
+
+    fn call_server_stream(
+        &self,
+        request: GrpcRequestData,
+    ) -> Pin<Box<dyn Future<Output = Result<MessageStream, tonic::Status>> + Send>> {
+        let handler = self.handler.clone();
+
+        Box::pin(async move {
+            // Execute Ruby handler in blocking context and collect stream
+            let messages = tokio::task::spawn_blocking(move || {
+                let ruby = match Ruby::get() {
+                    Ok(r) => r,
+                    Err(e) => return Err(tonic::Status::internal(format!("Failed to get Ruby VM: {}", e))),
+                };
+
+                let handler_value = handler.get_inner_with(&ruby);
+
+                // Create Ruby request
+                let ruby_request = Self::create_ruby_request(&ruby, &request).map_err(ruby_error_to_grpc_status)?;
+
+                // Call handler for server streaming
+                let stream_value = Self::call_ruby_server_stream(&ruby, handler_value, ruby_request)
+                    .map_err(ruby_error_to_grpc_status)?;
+
+                // Collect stream messages
+                Self::collect_ruby_stream(&ruby, stream_value).map_err(ruby_error_to_grpc_status)
+            })
+            .await
+            .map_err(|e| tonic::Status::internal(format!("Task join error: {}", e)))??;
+
+            // Convert Vec<Bytes> to MessageStream
+            let stream = futures::stream::iter(messages.into_iter().map(Ok));
+            Ok(Box::pin(stream) as MessageStream)
+        })
     }
 
-    fn service_name(&self) -> &'static str {
-        // We need to return a 'static str, but we have a String.
-        // For now, we'll leak the string to get a 'static reference.
-        // This is acceptable because service names are registered once at startup.
-        Box::leak(self.inner.service_name.clone().into_boxed_str())
+    fn call_client_stream(
+        &self,
+        request: StreamingRequest,
+    ) -> Pin<Box<dyn Future<Output = Result<GrpcResponseData, tonic::Status>> + Send>> {
+        let handler = self.handler.clone();
+
+        Box::pin(async move {
+            // Collect all incoming messages with size limits
+            let mut messages: Vec<Vec<u8>> = Vec::new();
+            let mut total_bytes: usize = 0;
+            let mut stream = request.message_stream;
+
+            while let Some(result) = stream.next().await {
+                if messages.len() >= MAX_STREAM_MESSAGES {
+                    return Err(tonic::Status::resource_exhausted(format!(
+                        "Client stream exceeded maximum {} messages",
+                        MAX_STREAM_MESSAGES
+                    )));
+                }
+                match result {
+                    Ok(bytes) => {
+                        total_bytes = total_bytes
+                            .checked_add(bytes.len())
+                            .ok_or_else(|| tonic::Status::resource_exhausted("Stream total size overflow"))?;
+
+                        if total_bytes > MAX_STREAM_TOTAL_BYTES {
+                            return Err(tonic::Status::resource_exhausted(format!(
+                                "Stream total bytes {} exceeds maximum {}",
+                                total_bytes, MAX_STREAM_TOTAL_BYTES
+                            )));
+                        }
+
+                        messages.push(bytes.to_vec());
+                    }
+                    Err(status) => return Err(status),
+                }
+            }
+
+            // Execute Ruby handler in blocking context with timeout
+            tokio::time::timeout(
+                Duration::from_secs(HANDLER_TIMEOUT_SECS),
+                tokio::task::spawn_blocking(move || {
+                    let ruby = match Ruby::get() {
+                        Ok(r) => r,
+                        Err(e) => return Err(tonic::Status::internal(format!("Failed to get Ruby VM: {}", e))),
+                    };
+
+                    let handler_value = handler.get_inner_with(&ruby);
+
+                    // Call handler with collected messages
+                    let response_value = Self::call_ruby_client_stream(&ruby, handler_value, messages)
+                        .map_err(ruby_error_to_grpc_status)?;
+
+                    // Extract response
+                    let (payload, metadata_map) =
+                        extract_ruby_response(response_value).map_err(ruby_error_to_grpc_status)?;
+
+                    let metadata = hashmap_to_metadata_map(&metadata_map)?;
+
+                    Ok(GrpcResponseData {
+                        payload: Bytes::from(payload),
+                        metadata,
+                    })
+                }),
+            )
+            .await
+            .map_err(|_| tonic::Status::deadline_exceeded("Handler timeout"))?
+            .map_err(|e| tonic::Status::internal(format!("Task join error: {}", e)))?
+        })
+    }
+
+    fn call_bidi_stream(
+        &self,
+        request: StreamingRequest,
+    ) -> Pin<Box<dyn Future<Output = Result<MessageStream, tonic::Status>> + Send>> {
+        let handler = self.handler.clone();
+
+        Box::pin(async move {
+            // Collect all incoming messages with size limits
+            let mut messages: Vec<Vec<u8>> = Vec::new();
+            let mut total_bytes: usize = 0;
+            let mut stream = request.message_stream;
+
+            while let Some(result) = stream.next().await {
+                if messages.len() >= MAX_STREAM_MESSAGES {
+                    return Err(tonic::Status::resource_exhausted(format!(
+                        "Client stream exceeded maximum {} messages",
+                        MAX_STREAM_MESSAGES
+                    )));
+                }
+                match result {
+                    Ok(bytes) => {
+                        total_bytes = total_bytes
+                            .checked_add(bytes.len())
+                            .ok_or_else(|| tonic::Status::resource_exhausted("Stream total size overflow"))?;
+
+                        if total_bytes > MAX_STREAM_TOTAL_BYTES {
+                            return Err(tonic::Status::resource_exhausted(format!(
+                                "Stream total bytes {} exceeds maximum {}",
+                                total_bytes, MAX_STREAM_TOTAL_BYTES
+                            )));
+                        }
+
+                        messages.push(bytes.to_vec());
+                    }
+                    Err(status) => return Err(status),
+                }
+            }
+
+            // Execute Ruby handler in blocking context with timeout
+            let response_messages = tokio::time::timeout(
+                Duration::from_secs(HANDLER_TIMEOUT_SECS),
+                tokio::task::spawn_blocking(move || {
+                    let ruby = match Ruby::get() {
+                        Ok(r) => r,
+                        Err(e) => return Err(tonic::Status::internal(format!("Failed to get Ruby VM: {}", e))),
+                    };
+
+                    let handler_value = handler.get_inner_with(&ruby);
+
+                    // Call handler for bidirectional streaming
+                    let stream_value = Self::call_ruby_bidi_stream(&ruby, handler_value, messages)
+                        .map_err(ruby_error_to_grpc_status)?;
+
+                    // Collect response stream
+                    Self::collect_ruby_stream(&ruby, stream_value).map_err(ruby_error_to_grpc_status)
+                }),
+            )
+            .await
+            .map_err(|_| tonic::Status::deadline_exceeded("Handler timeout"))?
+            .map_err(|e| tonic::Status::internal(format!("Task join error: {}", e)))??;
+
+            // Convert Vec<Bytes> to MessageStream
+            let stream = futures::stream::iter(response_messages.into_iter().map(Ok));
+            Ok(Box::pin(stream) as MessageStream)
+        })
     }
 }
 
-/// Initialize the gRPC module in Ruby
-pub fn init(ruby: &Ruby, spikard_module: &magnus::RModule) -> Result<(), Error> {
+/// Register the Ruby gRPC handler module
+pub fn init(_ruby: &Ruby, spikard_module: &magnus::RModule) -> Result<(), Error> {
     let grpc_module = spikard_module.define_module("Grpc")?;
 
-    // Define Spikard::Grpc::Request class
-    let request_class = grpc_module.define_class("Request", ruby.class_object())?;
-    request_class.define_method("service_name", magnus::method!(RubyGrpcRequest::service_name, 0))?;
-    request_class.define_method("method_name", magnus::method!(RubyGrpcRequest::method_name, 0))?;
-    request_class.define_method("payload", magnus::method!(RubyGrpcRequest::payload, 0))?;
-    request_class.define_method("metadata", magnus::method!(RubyGrpcRequest::metadata, 0))?;
-
-    // Define Spikard::Grpc::Response class
-    let response_class = grpc_module.define_class("Response", ruby.class_object())?;
-    response_class.define_alloc_func::<RubyGrpcResponse>();
-    response_class.define_method("initialize", magnus::method!(RubyGrpcResponse::initialize, -1))?;
-    response_class.define_method("metadata=", magnus::method!(RubyGrpcResponse::set_metadata, 1))?;
-    response_class.define_method("metadata", magnus::method!(RubyGrpcResponse::get_metadata, 0))?;
-    response_class.define_method("payload", magnus::method!(RubyGrpcResponse::payload, 0))?;
+    // Define Request class
+    let request_class = grpc_module.define_class("Request", _ruby.class_object())?;
+    request_class.define_method("service_name", magnus::method!(RubyGrpcRequest::rb_service_name, 0))?;
+    request_class.define_method("method_name", magnus::method!(RubyGrpcRequest::rb_method_name, 0))?;
+    request_class.define_method("payload", magnus::method!(RubyGrpcRequest::rb_payload, 0))?;
+    request_class.define_method("metadata", magnus::method!(RubyGrpcRequest::rb_metadata, 0))?;
+    request_class.define_method("get_metadata", magnus::method!(RubyGrpcRequest::rb_get_metadata, 1))?;
+    request_class.define_method("inspect", magnus::method!(RubyGrpcRequest::rb_inspect, 0))?;
+    request_class.define_method("to_s", magnus::method!(RubyGrpcRequest::rb_inspect, 0))?;
+
+    // Define Response class
+    let response_class = grpc_module.define_class("Response", _ruby.class_object())?;
+    response_class.define_singleton_method("new", magnus::function!(RubyGrpcResponse::rb_new, -1))?;
+    response_class.define_method("payload", magnus::method!(RubyGrpcResponse::rb_payload, 0))?;
+    response_class.define_method("payload=", magnus::method!(RubyGrpcResponse::rb_set_payload, 1))?;
+    response_class.define_method("metadata", magnus::method!(RubyGrpcResponse::rb_metadata, 0))?;
+    response_class.define_method("metadata=", magnus::method!(RubyGrpcResponse::rb_set_metadata, 1))?;
+    response_class.define_method("inspect", magnus::method!(RubyGrpcResponse::rb_inspect, 0))?;
+    response_class.define_method("to_s", magnus::method!(RubyGrpcResponse::rb_inspect, 0))?;
 
     Ok(())
 }
@@ -269,89 +785,50 @@ pub fn init(ruby: &Ruby, spikard_module: &magnus::RModule) -> Result<(), Error>
 #[cfg(test)]
 mod tests {
     use super::*;
-    use bytes::Bytes;
-    use tonic::metadata::MetadataMap;
 
     #[test]
-    fn test_ruby_grpc_request_creation() {
-        let request = GrpcRequestData {
-            service_name: "test.TestService".to_string(),
-            method_name: "TestMethod".to_string(),
-            payload: Bytes::from("test payload"),
-            metadata: MetadataMap::new(),
-        };
-
-        let ruby_request = RubyGrpcRequest::from_grpc_request(request);
-        assert_eq!(ruby_request.service_name, "test.TestService");
-        assert_eq!(ruby_request.method_name, "TestMethod");
-        assert_eq!(ruby_request.payload, b"test payload");
-    }
+    fn test_metadata_conversion() {
+        let mut map = HashMap::new();
+        map.insert("authorization".to_string(), "Bearer token".to_string());
+        map.insert("content-type".to_string(), "application/grpc".to_string());
 
-    #[test]
-    fn test_metadata_extraction() {
-        use spikard_bindings_shared::grpc_metadata::extract_metadata_to_hashmap;
-
-        let mut metadata = MetadataMap::new();
-        metadata.insert(
-            "content-type",
-            "application/grpc".parse().expect("Valid metadata value"),
-        );
-        metadata.insert(
-            "authorization",
-            "Bearer token123".parse().expect("Valid metadata value"),
-        );
+        let metadata = hashmap_to_metadata_map(&map).expect("valid metadata map");
+        let converted = metadata_map_to_hashmap(&metadata);
 
-        let extracted = extract_metadata_to_hashmap(&metadata, false);
-        assert_eq!(
-            extracted.get("content-type").expect("content-type header"),
-            "application/grpc"
-        );
-        assert_eq!(
-            extracted.get("authorization").expect("authorization header"),
-            "Bearer token123"
-        );
-    }
-
-    #[test]
-    fn test_grpc_response_conversion() {
-        let response = RubyGrpcResponse {
-            payload: RefCell::new(b"test response".to_vec()),
-            metadata: RefCell::new(HashMap::new()),
-        };
-
-        let grpc_response = response.into_grpc_response();
-        assert!(grpc_response.is_ok());
-        let grpc_response = grpc_response.expect("Valid grpc response");
-        assert_eq!(grpc_response.payload, Bytes::from("test response"));
+        assert_eq!(converted.get("authorization"), Some(&"Bearer token".to_string()));
+        assert_eq!(converted.get("content-type"), Some(&"application/grpc".to_string()));
     }
 
     #[test]
-    fn test_grpc_response_with_metadata() {
+    fn test_ruby_grpc_request_creation() {
         let mut metadata = HashMap::new();
-        metadata.insert("x-custom-header".to_string(), "custom-value".to_string());
+        metadata.insert("key".to_string(), "value".to_string());
 
-        let response = RubyGrpcResponse {
-            payload: RefCell::new(b"test".to_vec()),
-            metadata: RefCell::new(metadata),
-        };
+        let request = RubyGrpcRequest::new(
+            "test.Service".to_string(),
+            "Method".to_string(),
+            vec![1, 2, 3],
+            metadata,
+        );
 
-        let grpc_response = response.into_grpc_response();
-        assert!(grpc_response.is_ok());
-        let grpc_response = grpc_response.expect("Valid grpc response");
-        assert!(!grpc_response.metadata.is_empty());
+        assert_eq!(request.service_name, "test.Service");
+        assert_eq!(request.method_name, "Method");
+        assert_eq!(request.payload, vec![1, 2, 3]);
+        assert_eq!(request.metadata.get("key"), Some(&"value".to_string()));
     }
 
     #[test]
-    fn test_invalid_metadata_key() {
-        let mut metadata = HashMap::new();
-        metadata.insert("invalid\nkey".to_string(), "value".to_string());
-
-        let response = RubyGrpcResponse {
-            payload: RefCell::new(b"test".to_vec()),
-            metadata: RefCell::new(metadata),
-        };
+    fn test_inspect_format() {
+        let request = RubyGrpcRequest::new(
+            "test.Service".to_string(),
+            "Method".to_string(),
+            vec![1, 2, 3, 4, 5],
+            HashMap::new(),
+        );
 
-        let result = response.into_grpc_response();
-        assert!(result.is_err());
+        let repr = request.rb_inspect();
+        assert!(repr.contains("test.Service"));
+        assert!(repr.contains("Method"));
+        assert!(repr.contains("payload_size=5"));
     }
 }