@grest-ts/http 0.0.47 → 0.0.49

package/src/schema/GGHttpPermissionsChecker.test.ts

@@ -0,0 +1,125 @@
+import {describe, it, expect} from "vitest";
+import type {GGTransportMiddleware} from "@grest-ts/context";
+import {FORBIDDEN, GG_ANY_PERMISSION, GG_NO_PERMISSIONS, GGPermission, IsString} from "@grest-ts/schema";
+import {GGHttpPermissionsChecker} from "./GGHttpPermissionsChecker";
+import {GGWireContextKey} from "./GGWireContextKey";
+
+class TestWire extends GGWireContextKey {
+    constructor(name: string, private readonly grants: readonly string[] | null) {
+        super(name, IsString.orUndefined);
+    }
+
+    public hasPermissions(): boolean {
+        return this.grants !== null;
+    }
+
+    public async getGrantedPermissions(): Promise<readonly string[]> {
+        return this.grants ?? [];
+    }
+}
+
+const plainMiddleware: GGTransportMiddleware = {};
+
+describe("GGHttpPermissionsChecker", () => {
+
+    describe("constructor / wire selection", () => {
+        it("ignores non-wire middlewares and wires without permissions", async () => {
+            const checker = new GGHttpPermissionsChecker([
+                plainMiddleware,
+                new TestWire("ambient", null),
+            ]);
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([]);
+            await expect(checker.assert("Api", "method", "anything")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+
+        it("collects scopes only from permission-bearing wires", async () => {
+            const checker = new GGHttpPermissionsChecker([
+                plainMiddleware,
+                new TestWire("ambient", null),
+                new TestWire("header", ["a", "b"]),
+                new TestWire("cookie", ["c"]),
+            ]);
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([["a", "b"], ["c"]]);
+        });
+    });
+
+    describe("assert — no permission wires (fail closed)", () => {
+        const checker = new GGHttpPermissionsChecker([]);
+
+        it("passes when nothing is required", async () => {
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([]);
+            expect(await checker.assert("Api", "method", undefined as unknown as GGPermission)).toEqual([]);
+        });
+
+        it("denies a real or any-permission requirement instead of skipping the check", async () => {
+            await expect(checker.assert("Api", "method", "items:read")).rejects.toBeInstanceOf(FORBIDDEN);
+            await expect(checker.assert("Api", "method", GG_ANY_PERMISSION)).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+    });
+
+    describe("assert — with permission wires", () => {
+        const checker = new GGHttpPermissionsChecker([new TestWire("header", ["items:read", "items:write"])]);
+
+        it("returns the resolved (frozen) array-of-arrays scopes when satisfied", async () => {
+            const scopes = await checker.assert("Api", "method", "items:read");
+            expect(scopes).toEqual([["items:read", "items:write"]]);
+            expect(Object.isFrozen(scopes)).toBe(true);
+        });
+
+        it("passes GG_NO_PERMISSIONS and undefined even when wires are present", async () => {
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([["items:read", "items:write"]]);
+            expect(await checker.assert("Api", "method", undefined as unknown as GGPermission)).toEqual([["items:read", "items:write"]]);
+        });
+
+        it("throws FORBIDDEN when the required scope is missing", async () => {
+            await expect(checker.assert("Api", "method", "admin:all")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+
+        it("unions grants across wires when checking a requirement", async () => {
+            const twoWires = new GGHttpPermissionsChecker([
+                new TestWire("header", ["a"]),
+                new TestWire("cookie", ["b"]),
+            ]);
+            expect(await twoWires.assert("Api", "method", {allOf: ["a", "b"]})).toEqual([["a"], ["b"]]);
+            expect(await twoWires.assert("Api", "method", {anyOf: ["a", "z"]})).toEqual([["a"], ["b"]]);
+            await expect(twoWires.assert("Api", "method", "c")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+    });
+
+    describe("assertScopes", () => {
+        const checker = new GGHttpPermissionsChecker([]);
+
+        it("passes when scopes satisfy the requirement", () => {
+            expect(() => checker.assertGrants("Api", "method", [["x"]], "x")).not.toThrow();
+        });
+
+        it("throws FORBIDDEN when scopes do not satisfy", () => {
+            expect(() => checker.assertGrants("Api", "method", [["x"]], "y")).toThrow(FORBIDDEN);
+        });
+
+        it("throws FORBIDDEN when scopes are undefined and a real permission is required", () => {
+            expect(() => checker.assertGrants("Api", "method", undefined, "y")).toThrow(FORBIDDEN);
+        });
+
+        it("debug message includes schema.method and the described requirement", () => {
+            try {
+                checker.assertGrants("Api", "method", [["x"]], "y");
+                expect.unreachable();
+            } catch (e) {
+                expect(e).toBeInstanceOf(FORBIDDEN);
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain("Api.method requires");
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain('"y"');
+            }
+        });
+
+        it("omits the dot when method is empty (WS connect gate)", () => {
+            try {
+                checker.assertGrants("Api", "", undefined, "y");
+                expect.unreachable();
+            } catch (e) {
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain("Api requires");
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).not.toContain("Api. requires");
+            }
+        });
+    });
+});

package/src/schema/GGHttpPermissionsChecker.ts

@@ -0,0 +1,35 @@
+import {GGWireContextKey} from "./GGWireContextKey";
+import type {GGTransportMiddleware} from "@grest-ts/context";
+import {FORBIDDEN, GGPermission, GGPermissionChecker} from "@grest-ts/schema";
+
+export class GGHttpPermissionsChecker {
+
+    private readonly middlewaresWithPermissions: GGWireContextKey[] = []
+
+    constructor(apiMiddlewares: readonly GGTransportMiddleware[]) {
+        for (const mw of apiMiddlewares) {
+            if (mw instanceof GGWireContextKey && mw.hasPermissions()) {
+                this.middlewaresWithPermissions.push(mw);
+            }
+        }
+        Object.freeze(this.middlewaresWithPermissions)
+    }
+
+    public async assert(schema: string, method: string, required: GGPermission): Promise<ReadonlyArray<ReadonlyArray<string>>> {
+        const scopes: Array<readonly string[]> = [];
+        for (let i = 0; i < this.middlewaresWithPermissions.length; i++) {
+            scopes.push(await this.middlewaresWithPermissions[i].getGrantedPermissions())
+        }
+        this.assertGrants(schema, method, scopes, required)
+        return Object.freeze(scopes) as readonly string[][]
+    }
+
+    public assertGrants(schema: string, method: string, granted: undefined | ReadonlyArray<ReadonlyArray<string>>, required: GGPermission): void {
+        if (!GGPermissionChecker.satisfies(required, granted)) {
+            throw new FORBIDDEN({
+                debugMessage: `${schema + (method ? "." + method : "")} requires ${GGPermissionChecker.describePermission(required)} — caller scopes did not satisfy`
+            })
+        }
+    }
+
+}

package/src/schema/GGHttpSchema.ts

@@ -1,14 +1,14 @@
 import {ERROR, ERROR_JSON, GGContractApiDefinition, GGContractClass, GGContractMethod, GGSchema, GGSchemaDescription, OK} from "@grest-ts/schema";
 import type {HttpMethod} from "@grest-ts/common";
 import type http from "http";
-import type {GGHttpServerMiddleware} from "../server/GGHttpSchema.startServer";
+import type {GGContextKey, GGTransportMiddleware} from "@grest-ts/context";
 import type {OpenAPIV3_1} from "openapi-types";
 
 export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
 
     public readonly name: string
     public readonly pathPrefix: string
-    public readonly apiMiddlewares: readonly GGHttpTransportMiddleware[]
+    public readonly apiMiddlewares: readonly GGTransportMiddleware[]
     public readonly codec: Record<keyof TContract, GGHttpCodec>
     public readonly contract: GGContractClass<TContract> | null = null
 
@@ -16,7 +16,7 @@ export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
         pathPrefix: string,
         contract: GGContractClass<TContract>,
         wireCodec: Record<keyof TContract, GGHttpCodec>,
-        middlewares: readonly GGHttpTransportMiddleware[] = []
+        middlewares: readonly GGTransportMiddleware[] = []
     ) {
         this.name = contract.name
         this.pathPrefix = pathPrefix
@@ -36,7 +36,7 @@ export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
 export interface ClientHttpRouteToRpcTransformClientConfig {
     pathPrefix: string,
     contract: GGContractMethod,
-    middlewares: readonly GGHttpTransportMiddleware[]
+    middlewares: readonly GGTransportMiddleware[]
 }
 
 export interface ClientHttpRouteToRpcTransformClientCodec {
@@ -57,12 +57,13 @@ export interface GGHttpFetchRequest {
 
 export interface ClientHttpRouteToRpcTransformServerConfig {
     contract: GGContractMethod,
-    apiMiddlewares: readonly GGHttpTransportMiddleware[],
-    serverMiddlewares: readonly GGHttpServerMiddleware[]
+    /** Schema bindings + server middlewares, already merged into one ordered server pipeline. */
+    middlewares: readonly GGTransportMiddleware[]
 }
 
 export interface ClientHttpRouteToRpcTransformServerCodec {
-    parseRequest: (req: http.IncomingMessage) => Promise<unknown>,
+    readRequest: (req: http.IncomingMessage) => Promise<unknown>,
+    validateInput: (rawInput: unknown) => unknown,
     sendResponse: (res: http.ServerResponse, rpcResult: ERROR<string, unknown> | OK<unknown>) => Promise<void>
 }
 
@@ -114,6 +115,13 @@ export interface GGHttpCodec {
      */
     readonly responseHeaders: Record<string, GGSchema<string | undefined>>;
 
+    /**
+     * Cookie context keys this route is permitted to modify (set/clear), declared via
+     * GGRpc.*(...).updatesCookie(key). A handler that changes a cookie its route did not
+     * declare is a SERVER_ERROR. Reading a cookie needs no declaration.
+     */
+    readonly updatesCookies?: readonly GGContextKey<string | undefined>[];
+
     createForClient(config: ClientHttpRouteToRpcTransformClientConfig): ClientHttpRouteToRpcTransformClientCodec
 
     createForServer(config: ClientHttpRouteToRpcTransformServerConfig): ClientHttpRouteToRpcTransformServerCodec
@@ -129,59 +137,3 @@ export interface GGHttpCodec {
     toOpenApiOperation?(config: GGHttpCodecOpenApiConfig): Partial<OpenAPIV3_1.OperationObject>
 }
 
-// --------------------------------------------------------------------------------------------------------
-// Middleware
-// --------------------------------------------------------------------------------------------------------
-
-export interface GGHttpTransportMiddleware {
-    /**
-     * Request headers this middleware reads or writes, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Allow-Headers and OpenAPI parameter docs.
-     * Use {} if the middleware touches no custom request headers.
-     *
-     * @example
-     * headers: {
-     *   "authorization": IsString.nonEmpty.docs({title: "Bearer token", example: "Bearer ..."}),
-     *   "accept-language": IsLocale.orUndefined
-     * }
-     */
-    readonly headers: Record<string, GGSchema<string | undefined>>;
-
-    /**
-     * Response headers this middleware sets, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Expose-Headers and OpenAPI response header docs.
-     * Use {} if the middleware sets no custom response headers.
-     */
-    readonly responseHeaders: Record<string, GGSchema<string | undefined>>;
-
-    /**
-     * Client-side: modify outgoing request (add headers, etc.)
-     */
-    updateRequest?(req: GGHttpRequest): void;
-
-    /**
-     * Server-side: parse incoming request (extract context from headers, etc.)
-     */
-    parseRequest?(req: GGHttpRequest): void;
-
-    /**
-     * Server-side: modify outgoing response
-     */
-    updateResponse?(res: GGHttpResponse): void;
-
-    /**
-     * Client-side: parse incoming response
-     */
-    parseResponse?(res: GGHttpResponse): void;
-}
-
-export interface GGHttpRequest {
-    headers?: Record<string, string | string[]>;
-    queryArgs?: Record<string, string | string[]>;
-}
-
-export interface GGHttpResponse {
-    headers: Record<string, string | string[]>;
-}

package/src/schema/GGWireContextKey.node.ts

@@ -0,0 +1,119 @@
+/**
+ * Server/inbound half of the wire model: define/create the verification handler, run it during
+ * the request pipeline (process), and expose the caller's grants to the permission gate
+ * (permissions). Node-only — keeps @grest-ts/locator out of the browser bundle.
+ */
+import {GGLocator, GGLocatorKey} from "@grest-ts/locator"
+import {GGWireContextKey} from "./GGWireContextKey"
+
+export interface GGWireServerHandler {
+    /** Verify the raw credential and mint the durable principal. Throws to reject the request. */
+    process: () => Promise<void>
+    /** The caller's grants from this wire — read off the durable principal minted in process(). */
+    permissions?: () => Promise<readonly string[]>
+}
+
+const HANDLER_KEYS = new WeakMap<GGWireContextKey, GGLocatorKey<GGWireServerHandler>>()
+const FACTORIES = new WeakMap<GGWireContextKey, unknown>()
+
+// Locator keys resolve by their string name, so the handler key must be unique per wire
+// instance — two wires over the same name (e.g. a public ambient cookie and a gated one
+// over the same cookie name) must not share a handler.
+let nextWireHandlerId = 0
+
+/** True once .define() has run on this wire — distinguishes verified wires from ambient ones. */
+export function wireIsDefined(wire: GGWireContextKey): boolean {
+    return FACTORIES.has(wire)
+}
+
+function handlerKeyFor(wire: GGWireContextKey): GGLocatorKey<GGWireServerHandler> {
+    let key = HANDLER_KEYS.get(wire)
+    if (!key) {
+        key = new GGLocatorKey<GGWireServerHandler>(`wire:${wire.name}:${nextWireHandlerId++}`)
+        HANDLER_KEYS.set(wire, key)
+    }
+    return key
+}
+
+function resolveHandler(wire: GGWireContextKey): GGWireServerHandler {
+    const handler = handlerKeyFor(wire).tryGet()
+    if (!handler) {
+        throw new Error(`Wire "${wire.name}" is used but not implemented — call ${wire.name}.define(...).create(deps) in compose().`)
+    }
+    return handler
+}
+
+/**
+ * Binds the verification handler's deps into one runtime's locator scope. Returned by
+ * `.define()`; `.create(deps)` runs once per scope (a fresh worker / restart gets its own).
+ */
+export class GGWireHandlerRegistration<Deps> {
+    constructor(
+        private readonly wire: GGWireContextKey,
+        private readonly factory: (deps: Deps) => GGWireServerHandler,
+    ) {
+    }
+
+    public create(deps: Deps): void {
+        const key = handlerKeyFor(this.wire)
+        if (GGLocator.getScope().has(key)) {
+            throw new Error(`Wire "${this.wire.name}" was already created in this runtime scope — .create() runs once per runtime.`)
+        }
+        GGLocator.getScope().set(key, this.factory(deps))
+    }
+}
+
+declare module "./GGWireContextKey" {
+    interface GGWireContextKey {
+        /** Attach the server-side verification handler. Process-global, frozen once — a second call throws. */
+        define<Deps>(factory: (deps: Deps) => GGWireServerHandler): GGWireHandlerRegistration<Deps>
+
+        /** @internal server pipeline hook — verify the credential and mint the durable principal. */
+        process(): Promise<void>
+
+        /** @internal If wire is handling permissions **/
+        hasPermissions(): boolean;
+
+        /** @internal permission-gate hook — the caller's grants from this wire. */
+        getGrantedPermissions(): Promise<readonly string[]>
+
+        /** @internal startup validation — true once .create() has run on the current runtime scope. */
+        hasHandler(): boolean
+
+        /** Drop the ephemeral raw credential after process(); ambient wires keep their value. */
+        clear(): void
+    }
+}
+
+GGWireContextKey.prototype.define = function (factory) {
+    if (FACTORIES.has(this)) {
+        throw new Error(`Wire "${this.name}" already has .define() — it can only be defined once.`)
+    }
+    FACTORIES.set(this, factory)
+    return new GGWireHandlerRegistration(this, factory as any)
+}
+
+GGWireContextKey.prototype.process = async function () {
+    if (!this.hasHandler()) return
+    await resolveHandler(this).process()
+}
+
+GGWireContextKey.prototype.hasPermissions = function (): boolean {
+    if (!this.hasHandler()) return false
+    const handler = resolveHandler(this)
+    return !!handler.permissions
+}
+
+GGWireContextKey.prototype.getGrantedPermissions = async function () {
+    if (!this.hasHandler()) return []
+    const handler = resolveHandler(this)
+    return handler.permissions ? await handler.permissions() : []
+}
+
+GGWireContextKey.prototype.hasHandler = function () {
+    return handlerKeyFor(this).has()
+}
+
+GGWireContextKey.prototype.clear = function () {
+    if (this.hasHandler() && this.has()) this.delete()
+}

package/src/schema/GGWireContextKey.ts

@@ -0,0 +1,46 @@
+import {GGContextKey, type GGTransportMiddleware} from "@grest-ts/context"
+import {GGContextKeySynchronizer} from "../client/GGContextKeySynchronizer"
+
+/** Outbound freshness gate for a smart wire. The outbound value is always the wire's own context value. */
+export interface GGWireClientHandler {
+    /** Async — true when the wire value is stale and recover() should run before the next outbound read. */
+    isStale?: () => boolean
+    /** Async — refresh the credential into the wire (via key.set); run by the synchronizer's waitFor before the outbound read. */
+    recover?: () => Promise<void>
+}
+
+/**
+ * Base for credential wires (GGHeader, GGCookie). A wire IS a GGContextKey and a transport
+ * middleware at once. Verified vs ambient is decided by whether `.define()` was called:
+ *  - verified (`.define()`d): the wire holds the raw inbound credential, which is verified
+ *    during process(), then clear()d before the handler runs — handlers read the durable key
+ *    minted by the handler, never the credential.
+ *  - ambient (never `.define()`d): the parsed value lands in the wire and persists through the
+ *    handler (read via WIRE.get()); no process, no clear, no implementation needed.
+ *
+ * The server/inbound half (define/create/process/permissions) is attached node-side via
+ * ./GGWireContextKey.node — the browser bundle never pulls @grest-ts/locator.
+ */
+export abstract class GGWireContextKey extends GGContextKey<string | undefined> implements GGTransportMiddleware {
+
+    private _clientHandler?: GGWireClientHandler
+
+    /**
+     * Attach the outbound freshness gate. Freeze-once. The outbound value is always the wire's
+     * context value; this only registers an isStale/recover gate that refreshes it before the read.
+     * GGAuthSession calls it internally on the wires it holds.
+     */
+    public defineClient(handler: GGWireClientHandler): void {
+        if (this._clientHandler) {
+            throw new Error(`Wire "${this.name}" already has .defineClient() — it can only be defined once.`)
+        }
+        this._clientHandler = handler
+        if (handler.isStale || handler.recover) {
+            GGContextKeySynchronizer.provide(this, {
+                isStale: handler.isStale ?? (() => false),
+                recover: handler.recover ?? (async () => {
+                }),
+            })
+        }
+    }
+}

package/src/schema/httpSchema.ts

@@ -1,8 +1,6 @@
-import type http from "http";
 import {GGHttpCodec, GGHttpSchema} from "./GGHttpSchema";
-import {GGHttpRequest, GGHttpTransportMiddleware} from "./GGHttpSchema";
-import {GGContractApiDefinition, GGContractClass, GGSchema} from "@grest-ts/schema";
-import {GGContextKey} from "@grest-ts/context";
+import {GGContractApiDefinition, GGContractClass} from "@grest-ts/schema";
+import type {GGTransportMiddleware} from "@grest-ts/context";
 
 /**
  * Create an HTTP API schema builder from a contract.
@@ -38,7 +36,7 @@ class GGHttpSchemaBuilder<TContract extends GGContractApiDefinition, TContext =
 
     private readonly _contract: GGContractClass<TContract>
     private _pathPrefix: string = ""
-    private _middlewares: GGHttpTransportMiddleware[] = []
+    private _middlewares: GGTransportMiddleware[] = []
 
     constructor(contract: GGContractClass<TContract>) {
         this._contract = contract;
@@ -49,62 +47,11 @@ class GGHttpSchemaBuilder<TContract extends GGContractApiDefinition, TContext =
         return this
     }
 
-    use<M extends GGHttpTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M> {
+    use<M extends GGTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M> {
         this._middlewares.push(middleware)
         return this as unknown as GGHttpSchemaBuilder<TContract, TContext | M>
     }
 
-    useHeader<Input>(contextKey: GGContextKey<Input>): GGHttpSchemaBuilder<TContract, TContext | Input> {
-        const codec = contextKey.getCodec("http");
-        if (!codec) {
-            throw new Error(`Context key '${contextKey.name}' does not have an 'http-header' codec registered.`);
-        }
-
-        // Build the typed header map from codec.inputSchema — the IsObject({headerName: schema})
-        // that describes which headers this codec reads and what format each value has.
-        const inputSchema = codec.inputSchema;
-        const headers: Record<string, GGSchema<string | undefined>> = {};
-        if (inputSchema) {
-            const desc = inputSchema.toSchemaDescription();
-            if (desc.node.kind === 'object') {
-                for (const [k, fieldDesc] of Object.entries(desc.node.properties)) {
-                    headers[k] = fieldDesc.schema as GGSchema<string | undefined>;
-                }
-            }
-        }
-
-        const middleware: GGHttpTransportMiddleware = {
-            headers,
-            responseHeaders: {},
-            updateRequest(req: GGHttpRequest) {
-                const contextValue = contextKey.get();
-                if (contextValue !== undefined) {
-                    const result = codec.decode(contextValue);
-                    if (result.success) {
-                        Object.assign(req.headers, result.value);
-                    }
-                } else {
-                    const emptyResult = codec.decode({} as Input);
-                    if (emptyResult.success) {
-                        for (const key of Object.keys(emptyResult.value as object)) {
-                            delete req.headers[key];
-                        }
-                    }
-                }
-            },
-            parseRequest(req: http.IncomingMessage) {
-                const headers = req.headers as Record<string, string>;
-                const result = codec.encode(headers);
-                if (result.success) {
-                    contextKey.set(result.value);
-                }
-            }
-        };
-
-        this._middlewares.push(middleware);
-        return this as unknown as GGHttpSchemaBuilder<TContract, TContext | Input>;
-    }
-
     routes(mapping: { [K in keyof TContract]: GGHttpCodec }): GGHttpSchema<TContract, TContext> {
         return new GGHttpSchema(this._pathPrefix, this._contract, mapping, this._middlewares)
     }

package/src/server/GGHttp.ts

@@ -1,23 +1,8 @@
 import {GGHttpSchema} from "../schema/GGHttpSchema";
 import {GGContractApiDefinition, GGContractImplementation} from "@grest-ts/schema";
-import {GGHttpServerMiddleware} from "./GGHttpSchema.startServer";
+import type {GGTransportMiddleware} from "@grest-ts/context";
 import {GGHttpServer} from "./GGHttpServer";
 
-/**
- * Resolves the caller's permission scopes for the current request. The function
- * is called once between transport middleware and the handler. Sync or async —
- * both supported (the gate awaits).
- *
- * Return `null` when no caller identity is available (the gate will throw
- * NOT_AUTHORIZED for non-public methods). Return a (possibly empty) set
- * otherwise; the gate will call satisfies() against the method's permission.
- *
- * The resolver should read whatever app-defined context the upstream auth
- * middleware populated — it should NOT parse the token itself.
- */
-export type GGScopeResolver =
-    () => ReadonlySet<string> | null | Promise<ReadonlySet<string> | null>
-
 export class GGHttp<TContext = undefined> {
 
     /**
@@ -26,32 +11,17 @@ export class GGHttp<TContext = undefined> {
      * Do not tighten back to private.
      */
     protected readonly httpServer: GGHttpServer
-    private readonly middlewares: GGHttpServerMiddleware[] = [];
-    private permissionResolver?: GGScopeResolver;
+    private readonly middlewares: GGTransportMiddleware[] = [];
 
     constructor(httpServer: GGHttpServer) {
         this.httpServer = httpServer;
     }
 
-    public use<M extends GGHttpServerMiddleware>(middleware: M): GGHttp<TContext | M> {
+    public use<M extends GGTransportMiddleware>(middleware: M): GGHttp<TContext | M> {
         this.middlewares.push(middleware);
         return this as any;
     }
 
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    public usePermissions(resolver: GGScopeResolver): this {
-        this.permissionResolver = resolver;
-        return this;
-    }
-
     public http<TContract extends GGContractApiDefinition, TSchemaContext>(
         schema: GGHttpSchema<TContract, TSchemaContext>,
         implementation: GGContractImplementation<TContract>
@@ -59,7 +29,6 @@ export class GGHttp<TContext = undefined> {
         schema.register(implementation, {
             http: this.httpServer,
             middlewares: this.middlewares,
-            permissionResolver: this.permissionResolver,
         });
         return this as any;
     }