@grest-ts/http 0.0.48 → 0.0.50

package/src/schema/GGHttpPermissionsChecker.test.ts

@@ -0,0 +1,125 @@
+import {describe, it, expect} from "vitest";
+import type {GGTransportMiddleware} from "@grest-ts/context";
+import {FORBIDDEN, GG_ANY_PERMISSION, GG_NO_PERMISSIONS, GGPermission, IsString} from "@grest-ts/schema";
+import {GGHttpPermissionsChecker} from "./GGHttpPermissionsChecker";
+import {GGWireContextKey} from "./GGWireContextKey";
+
+class TestWire extends GGWireContextKey {
+    constructor(name: string, private readonly grants: readonly string[] | null) {
+        super(name, IsString.orUndefined);
+    }
+
+    public hasPermissions(): boolean {
+        return this.grants !== null;
+    }
+
+    public async getGrantedPermissions(): Promise<readonly string[]> {
+        return this.grants ?? [];
+    }
+}
+
+const plainMiddleware: GGTransportMiddleware = {};
+
+describe("GGHttpPermissionsChecker", () => {
+
+    describe("constructor / wire selection", () => {
+        it("ignores non-wire middlewares and wires without permissions", async () => {
+            const checker = new GGHttpPermissionsChecker([
+                plainMiddleware,
+                new TestWire("ambient", null),
+            ]);
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([]);
+            await expect(checker.assert("Api", "method", "anything")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+
+        it("collects scopes only from permission-bearing wires", async () => {
+            const checker = new GGHttpPermissionsChecker([
+                plainMiddleware,
+                new TestWire("ambient", null),
+                new TestWire("header", ["a", "b"]),
+                new TestWire("cookie", ["c"]),
+            ]);
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([["a", "b"], ["c"]]);
+        });
+    });
+
+    describe("assert — no permission wires (fail closed)", () => {
+        const checker = new GGHttpPermissionsChecker([]);
+
+        it("passes when nothing is required", async () => {
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([]);
+            expect(await checker.assert("Api", "method", undefined as unknown as GGPermission)).toEqual([]);
+        });
+
+        it("denies a real or any-permission requirement instead of skipping the check", async () => {
+            await expect(checker.assert("Api", "method", "items:read")).rejects.toBeInstanceOf(FORBIDDEN);
+            await expect(checker.assert("Api", "method", GG_ANY_PERMISSION)).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+    });
+
+    describe("assert — with permission wires", () => {
+        const checker = new GGHttpPermissionsChecker([new TestWire("header", ["items:read", "items:write"])]);
+
+        it("returns the resolved (frozen) array-of-arrays scopes when satisfied", async () => {
+            const scopes = await checker.assert("Api", "method", "items:read");
+            expect(scopes).toEqual([["items:read", "items:write"]]);
+            expect(Object.isFrozen(scopes)).toBe(true);
+        });
+
+        it("passes GG_NO_PERMISSIONS and undefined even when wires are present", async () => {
+            expect(await checker.assert("Api", "method", GG_NO_PERMISSIONS)).toEqual([["items:read", "items:write"]]);
+            expect(await checker.assert("Api", "method", undefined as unknown as GGPermission)).toEqual([["items:read", "items:write"]]);
+        });
+
+        it("throws FORBIDDEN when the required scope is missing", async () => {
+            await expect(checker.assert("Api", "method", "admin:all")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+
+        it("unions grants across wires when checking a requirement", async () => {
+            const twoWires = new GGHttpPermissionsChecker([
+                new TestWire("header", ["a"]),
+                new TestWire("cookie", ["b"]),
+            ]);
+            expect(await twoWires.assert("Api", "method", {allOf: ["a", "b"]})).toEqual([["a"], ["b"]]);
+            expect(await twoWires.assert("Api", "method", {anyOf: ["a", "z"]})).toEqual([["a"], ["b"]]);
+            await expect(twoWires.assert("Api", "method", "c")).rejects.toBeInstanceOf(FORBIDDEN);
+        });
+    });
+
+    describe("assertScopes", () => {
+        const checker = new GGHttpPermissionsChecker([]);
+
+        it("passes when scopes satisfy the requirement", () => {
+            expect(() => checker.assertGrants("Api", "method", [["x"]], "x")).not.toThrow();
+        });
+
+        it("throws FORBIDDEN when scopes do not satisfy", () => {
+            expect(() => checker.assertGrants("Api", "method", [["x"]], "y")).toThrow(FORBIDDEN);
+        });
+
+        it("throws FORBIDDEN when scopes are undefined and a real permission is required", () => {
+            expect(() => checker.assertGrants("Api", "method", undefined, "y")).toThrow(FORBIDDEN);
+        });
+
+        it("debug message includes schema.method and the described requirement", () => {
+            try {
+                checker.assertGrants("Api", "method", [["x"]], "y");
+                expect.unreachable();
+            } catch (e) {
+                expect(e).toBeInstanceOf(FORBIDDEN);
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain("Api.method requires");
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain('"y"');
+            }
+        });
+
+        it("omits the dot when method is empty (WS connect gate)", () => {
+            try {
+                checker.assertGrants("Api", "", undefined, "y");
+                expect.unreachable();
+            } catch (e) {
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).toContain("Api requires");
+                expect((e as InstanceType<typeof FORBIDDEN>).getDebugContext()?.debugMessage).not.toContain("Api. requires");
+            }
+        });
+    });
+});

package/src/schema/GGHttpPermissionsChecker.ts

@@ -0,0 +1,35 @@
+import {GGWireContextKey} from "./GGWireContextKey";
+import type {GGTransportMiddleware} from "@grest-ts/context";
+import {FORBIDDEN, GGPermission, GGPermissionChecker} from "@grest-ts/schema";
+
+export class GGHttpPermissionsChecker {
+
+    private readonly middlewaresWithPermissions: GGWireContextKey[] = []
+
+    constructor(apiMiddlewares: readonly GGTransportMiddleware[]) {
+        for (const mw of apiMiddlewares) {
+            if (mw instanceof GGWireContextKey && mw.hasPermissions()) {
+                this.middlewaresWithPermissions.push(mw);
+            }
+        }
+        Object.freeze(this.middlewaresWithPermissions)
+    }
+
+    public async assert(schema: string, method: string, required: GGPermission): Promise<ReadonlyArray<ReadonlyArray<string>>> {
+        const scopes: Array<readonly string[]> = [];
+        for (let i = 0; i < this.middlewaresWithPermissions.length; i++) {
+            scopes.push(await this.middlewaresWithPermissions[i].getGrantedPermissions())
+        }
+        this.assertGrants(schema, method, scopes, required)
+        return Object.freeze(scopes) as readonly string[][]
+    }
+
+    public assertGrants(schema: string, method: string, granted: undefined | ReadonlyArray<ReadonlyArray<string>>, required: GGPermission): void {
+        if (!GGPermissionChecker.satisfies(required, granted)) {
+            throw new FORBIDDEN({
+                debugMessage: `${schema + (method ? "." + method : "")} requires ${GGPermissionChecker.describePermission(required)} — caller scopes did not satisfy`
+            })
+        }
+    }
+
+}

package/src/schema/GGHttpSchema.ts

@@ -1,15 +1,14 @@
 import {ERROR, ERROR_JSON, GGContractApiDefinition, GGContractClass, GGContractMethod, GGSchema, GGSchemaDescription, OK} from "@grest-ts/schema";
 import type {HttpMethod} from "@grest-ts/common";
 import type http from "http";
-import type {GGHttpServerMiddleware} from "../server/GGHttpSchema.startServer";
-import type {GGContextKey} from "@grest-ts/context";
+import type {GGContextKey, GGTransportMiddleware} from "@grest-ts/context";
 import type {OpenAPIV3_1} from "openapi-types";
 
 export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
 
     public readonly name: string
     public readonly pathPrefix: string
-    public readonly apiMiddlewares: readonly GGHttpTransportMiddleware[]
+    public readonly apiMiddlewares: readonly GGTransportMiddleware[]
     public readonly codec: Record<keyof TContract, GGHttpCodec>
     public readonly contract: GGContractClass<TContract> | null = null
 
@@ -17,7 +16,7 @@ export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
         pathPrefix: string,
         contract: GGContractClass<TContract>,
         wireCodec: Record<keyof TContract, GGHttpCodec>,
-        middlewares: readonly GGHttpTransportMiddleware[] = []
+        middlewares: readonly GGTransportMiddleware[] = []
     ) {
         this.name = contract.name
         this.pathPrefix = pathPrefix
@@ -37,7 +36,7 @@ export class GGHttpSchema<TContract extends GGContractApiDefinition, TContext> {
 export interface ClientHttpRouteToRpcTransformClientConfig {
     pathPrefix: string,
     contract: GGContractMethod,
-    middlewares: readonly GGHttpTransportMiddleware[]
+    middlewares: readonly GGTransportMiddleware[]
 }
 
 export interface ClientHttpRouteToRpcTransformClientCodec {
@@ -58,12 +57,13 @@ export interface GGHttpFetchRequest {
 
 export interface ClientHttpRouteToRpcTransformServerConfig {
     contract: GGContractMethod,
-    apiMiddlewares: readonly GGHttpTransportMiddleware[],
-    serverMiddlewares: readonly GGHttpServerMiddleware[]
+    /** Schema bindings + server middlewares, already merged into one ordered server pipeline. */
+    middlewares: readonly GGTransportMiddleware[]
 }
 
 export interface ClientHttpRouteToRpcTransformServerCodec {
-    parseRequest: (req: http.IncomingMessage) => Promise<unknown>,
+    readRequest: (req: http.IncomingMessage) => Promise<unknown>,
+    validateInput: (rawInput: unknown) => unknown,
     sendResponse: (res: http.ServerResponse, rpcResult: ERROR<string, unknown> | OK<unknown>) => Promise<void>
 }
 
@@ -137,66 +137,3 @@ export interface GGHttpCodec {
     toOpenApiOperation?(config: GGHttpCodecOpenApiConfig): Partial<OpenAPIV3_1.OperationObject>
 }
 
-// --------------------------------------------------------------------------------------------------------
-// Middleware
-// --------------------------------------------------------------------------------------------------------
-
-export interface GGHttpTransportMiddleware {
-    /**
-     * Request headers this middleware reads or writes, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Allow-Headers and OpenAPI parameter docs.
-     * Use {} if the middleware touches no custom request headers.
-     *
-     * @example
-     * headers: {
-     *   "authorization": IsString.nonEmpty.docs({title: "Bearer token", example: "Bearer ..."}),
-     *   "accept-language": IsLocale.orUndefined
-     * }
-     */
-    readonly headers: Record<string, GGSchema<string | undefined>>;
-
-    /**
-     * Response headers this middleware sets, mapped to their value schemas.
-     * Keys are header names; values describe the header value format for validation and docs.
-     * Used for CORS Access-Control-Expose-Headers and OpenAPI response header docs.
-     * Use {} if the middleware sets no custom response headers.
-     */
-    readonly responseHeaders: Record<string, GGSchema<string | undefined>>;
-
-    /**
-     * Cookies this middleware reads, mapped to their value schemas. Emitted as `in: cookie`
-     * parameters in OpenAPI so cookie-bound inputs are documented. Absent for header/plain
-     * middlewares.
-     */
-    readonly cookieParams?: Record<string, GGSchema<string | undefined>>;
-
-    /**
-     * Client-side: modify outgoing request (add headers, etc.)
-     */
-    updateRequest?(req: GGHttpRequest): void;
-
-    /**
-     * Server-side: parse incoming request (extract context from headers, etc.)
-     */
-    parseRequest?(req: GGHttpRequest): void;
-
-    /**
-     * Server-side: modify outgoing response
-     */
-    updateResponse?(res: GGHttpResponse): void;
-
-    /**
-     * Client-side: parse incoming response
-     */
-    parseResponse?(res: GGHttpResponse): void;
-}
-
-export interface GGHttpRequest {
-    headers?: Record<string, string | string[]>;
-    queryArgs?: Record<string, string | string[]>;
-}
-
-export interface GGHttpResponse {
-    headers: Record<string, string | string[]>;
-}

package/src/schema/GGWireContextKey.node.ts

@@ -0,0 +1,119 @@
+/**
+ * Server/inbound half of the wire model: define/create the verification handler, run it during
+ * the request pipeline (process), and expose the caller's grants to the permission gate
+ * (permissions). Node-only — keeps @grest-ts/locator out of the browser bundle.
+ */
+import {GGLocator, GGLocatorKey} from "@grest-ts/locator"
+import {GGWireContextKey} from "./GGWireContextKey"
+
+export interface GGWireServerHandler {
+    /** Verify the raw credential and mint the durable principal. Throws to reject the request. */
+    process: () => Promise<void>
+    /** The caller's grants from this wire — read off the durable principal minted in process(). */
+    permissions?: () => Promise<readonly string[]>
+}
+
+const HANDLER_KEYS = new WeakMap<GGWireContextKey, GGLocatorKey<GGWireServerHandler>>()
+const FACTORIES = new WeakMap<GGWireContextKey, unknown>()
+
+// Locator keys resolve by their string name, so the handler key must be unique per wire
+// instance — two wires over the same name (e.g. a public ambient cookie and a gated one
+// over the same cookie name) must not share a handler.
+let nextWireHandlerId = 0
+
+/** True once .define() has run on this wire — distinguishes verified wires from ambient ones. */
+export function wireIsDefined(wire: GGWireContextKey): boolean {
+    return FACTORIES.has(wire)
+}
+
+function handlerKeyFor(wire: GGWireContextKey): GGLocatorKey<GGWireServerHandler> {
+    let key = HANDLER_KEYS.get(wire)
+    if (!key) {
+        key = new GGLocatorKey<GGWireServerHandler>(`wire:${wire.name}:${nextWireHandlerId++}`)
+        HANDLER_KEYS.set(wire, key)
+    }
+    return key
+}
+
+function resolveHandler(wire: GGWireContextKey): GGWireServerHandler {
+    const handler = handlerKeyFor(wire).tryGet()
+    if (!handler) {
+        throw new Error(`Wire "${wire.name}" is used but not implemented — call ${wire.name}.define(...).create(deps) in compose().`)
+    }
+    return handler
+}
+
+/**
+ * Binds the verification handler's deps into one runtime's locator scope. Returned by
+ * `.define()`; `.create(deps)` runs once per scope (a fresh worker / restart gets its own).
+ */
+export class GGWireHandlerRegistration<Deps> {
+    constructor(
+        private readonly wire: GGWireContextKey,
+        private readonly factory: (deps: Deps) => GGWireServerHandler,
+    ) {
+    }
+
+    public create(deps: Deps): void {
+        const key = handlerKeyFor(this.wire)
+        if (GGLocator.getScope().has(key)) {
+            throw new Error(`Wire "${this.wire.name}" was already created in this runtime scope — .create() runs once per runtime.`)
+        }
+        GGLocator.getScope().set(key, this.factory(deps))
+    }
+}
+
+declare module "./GGWireContextKey" {
+    interface GGWireContextKey {
+        /** Attach the server-side verification handler. Process-global, frozen once — a second call throws. */
+        define<Deps>(factory: (deps: Deps) => GGWireServerHandler): GGWireHandlerRegistration<Deps>
+
+        /** @internal server pipeline hook — verify the credential and mint the durable principal. */
+        process(): Promise<void>
+
+        /** @internal If wire is handling permissions **/
+        hasPermissions(): boolean;
+
+        /** @internal permission-gate hook — the caller's grants from this wire. */
+        getGrantedPermissions(): Promise<readonly string[]>
+
+        /** @internal startup validation — true once .create() has run on the current runtime scope. */
+        hasHandler(): boolean
+
+        /** Drop the ephemeral raw credential after process(); ambient wires keep their value. */
+        clear(): void
+    }
+}
+
+GGWireContextKey.prototype.define = function (factory) {
+    if (FACTORIES.has(this)) {
+        throw new Error(`Wire "${this.name}" already has .define() — it can only be defined once.`)
+    }
+    FACTORIES.set(this, factory)
+    return new GGWireHandlerRegistration(this, factory as any)
+}
+
+GGWireContextKey.prototype.process = async function () {
+    if (!this.hasHandler()) return
+    await resolveHandler(this).process()
+}
+
+GGWireContextKey.prototype.hasPermissions = function (): boolean {
+    if (!this.hasHandler()) return false
+    const handler = resolveHandler(this)
+    return !!handler.permissions
+}
+
+GGWireContextKey.prototype.getGrantedPermissions = async function () {
+    if (!this.hasHandler()) return []
+    const handler = resolveHandler(this)
+    return handler.permissions ? await handler.permissions() : []
+}
+
+GGWireContextKey.prototype.hasHandler = function () {
+    return handlerKeyFor(this).has()
+}
+
+GGWireContextKey.prototype.clear = function () {
+    if (this.hasHandler() && this.has()) this.delete()
+}

package/src/schema/GGWireContextKey.ts

@@ -0,0 +1,46 @@
+import {GGContextKey, type GGTransportMiddleware} from "@grest-ts/context"
+import {GGContextKeySynchronizer} from "../client/GGContextKeySynchronizer"
+
+/** Outbound freshness gate for a smart wire. The outbound value is always the wire's own context value. */
+export interface GGWireClientHandler {
+    /** Async — true when the wire value is stale and recover() should run before the next outbound read. */
+    isStale?: () => boolean
+    /** Async — refresh the credential into the wire (via key.set); run by the synchronizer's waitFor before the outbound read. */
+    recover?: () => Promise<void>
+}
+
+/**
+ * Base for credential wires (GGHeader, GGCookie). A wire IS a GGContextKey and a transport
+ * middleware at once. Verified vs ambient is decided by whether `.define()` was called:
+ *  - verified (`.define()`d): the wire holds the raw inbound credential, which is verified
+ *    during process(), then clear()d before the handler runs — handlers read the durable key
+ *    minted by the handler, never the credential.
+ *  - ambient (never `.define()`d): the parsed value lands in the wire and persists through the
+ *    handler (read via WIRE.get()); no process, no clear, no implementation needed.
+ *
+ * The server/inbound half (define/create/process/permissions) is attached node-side via
+ * ./GGWireContextKey.node — the browser bundle never pulls @grest-ts/locator.
+ */
+export abstract class GGWireContextKey extends GGContextKey<string | undefined> implements GGTransportMiddleware {
+
+    private _clientHandler?: GGWireClientHandler
+
+    /**
+     * Attach the outbound freshness gate. Freeze-once. The outbound value is always the wire's
+     * context value; this only registers an isStale/recover gate that refreshes it before the read.
+     * GGAuthSession calls it internally on the wires it holds.
+     */
+    public defineClient(handler: GGWireClientHandler): void {
+        if (this._clientHandler) {
+            throw new Error(`Wire "${this.name}" already has .defineClient() — it can only be defined once.`)
+        }
+        this._clientHandler = handler
+        if (handler.isStale || handler.recover) {
+            GGContextKeySynchronizer.provide(this, {
+                isStale: handler.isStale ?? (() => false),
+                recover: handler.recover ?? (async () => {
+                }),
+            })
+        }
+    }
+}

package/src/schema/httpSchema.ts

@@ -1,6 +1,6 @@
 import {GGHttpCodec, GGHttpSchema} from "./GGHttpSchema";
-import {GGHttpTransportMiddleware} from "./GGHttpSchema";
 import {GGContractApiDefinition, GGContractClass} from "@grest-ts/schema";
+import type {GGTransportMiddleware} from "@grest-ts/context";
 
 /**
  * Create an HTTP API schema builder from a contract.
@@ -36,7 +36,7 @@ class GGHttpSchemaBuilder<TContract extends GGContractApiDefinition, TContext =
 
     private readonly _contract: GGContractClass<TContract>
     private _pathPrefix: string = ""
-    private _middlewares: GGHttpTransportMiddleware[] = []
+    private _middlewares: GGTransportMiddleware[] = []
 
     constructor(contract: GGContractClass<TContract>) {
         this._contract = contract;
@@ -47,7 +47,7 @@ class GGHttpSchemaBuilder<TContract extends GGContractApiDefinition, TContext =
         return this
     }
 
-    use<M extends GGHttpTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M> {
+    use<M extends GGTransportMiddleware>(middleware: M): GGHttpSchemaBuilder<TContract, TContext | M> {
         this._middlewares.push(middleware)
         return this as unknown as GGHttpSchemaBuilder<TContract, TContext | M>
     }

package/src/server/GGHttp.ts

@@ -1,23 +1,8 @@
 import {GGHttpSchema} from "../schema/GGHttpSchema";
 import {GGContractApiDefinition, GGContractImplementation} from "@grest-ts/schema";
-import {GGHttpServerMiddleware} from "./GGHttpSchema.startServer";
+import type {GGTransportMiddleware} from "@grest-ts/context";
 import {GGHttpServer} from "./GGHttpServer";
 
-/**
- * Resolves the caller's permission scopes for the current request. The function
- * is called once between transport middleware and the handler. Sync or async —
- * both supported (the gate awaits).
- *
- * Return `null` when no caller identity is available (the gate will throw
- * NOT_AUTHORIZED for non-public methods). Return a (possibly empty) set
- * otherwise; the gate will call satisfies() against the method's permission.
- *
- * The resolver should read whatever app-defined context the upstream auth
- * middleware populated — it should NOT parse the token itself.
- */
-export type GGScopeResolver =
-    () => ReadonlySet<string> | null | Promise<ReadonlySet<string> | null>
-
 export class GGHttp<TContext = undefined> {
 
     /**
@@ -26,32 +11,17 @@ export class GGHttp<TContext = undefined> {
      * Do not tighten back to private.
      */
     protected readonly httpServer: GGHttpServer
-    private readonly middlewares: GGHttpServerMiddleware[] = [];
-    private permissionResolver?: GGScopeResolver;
+    private readonly middlewares: GGTransportMiddleware[] = [];
 
     constructor(httpServer: GGHttpServer) {
         this.httpServer = httpServer;
     }
 
-    public use<M extends GGHttpServerMiddleware>(middleware: M): GGHttp<TContext | M> {
+    public use<M extends GGTransportMiddleware>(middleware: M): GGHttp<TContext | M> {
         this.middlewares.push(middleware);
         return this as any;
     }
 
-    /**
-     * Register a scope resolver. Subsequent .http(...) calls capture this
-     * resolver and use it to gate every request against the contract's
-     * declared `permission`.
-     *
-     * Calling order matters: .use(auth) → .usePermissions(getScopes) → .http(api).
-     * If .http() runs before .usePermissions(), the call sees no resolver — and
-     * the startup check will hard-fail if its schema has any non-public method.
-     */
-    public usePermissions(resolver: GGScopeResolver): this {
-        this.permissionResolver = resolver;
-        return this;
-    }
-
     public http<TContract extends GGContractApiDefinition, TSchemaContext>(
         schema: GGHttpSchema<TContract, TSchemaContext>,
         implementation: GGContractImplementation<TContract>
@@ -59,7 +29,6 @@ export class GGHttp<TContext = undefined> {
         schema.register(implementation, {
             http: this.httpServer,
             middlewares: this.middlewares,
-            permissionResolver: this.permissionResolver,
         });
         return this as any;
     }

package/src/server/GGHttpSchema.startServer.ts

@@ -6,20 +6,19 @@
 import http from "http";
 import {GGLocator} from "@grest-ts/locator";
 import {ClientHttpRouteToRpcTransformServerCodec, GGHttpCodec, GGHttpSchema} from "../schema/GGHttpSchema";
-import {describePermission, ERROR, FORBIDDEN, GG_NO_PERMISSIONS, GGContractApiDefinition, GGContractImplementation, GGContractMethod, GGPermissionChecker, NOT_AUTHORIZED, OK, satisfies, SERVER_ERROR} from "@grest-ts/schema";
+import {ERROR, GGContractApiDefinition, GGContractImplementation, GGContractMethod, OK, SERVER_ERROR} from "@grest-ts/schema";
 import {HttpMethod} from "@grest-ts/common";
 import {GG_DISCOVERY} from "@grest-ts/discovery";
-import {GGContext, GGContextStore} from "@grest-ts/context";
+import {GGContext, GGContextStore, type GGTransportMiddleware} from "@grest-ts/context";
 import {GG_TRACE} from "@grest-ts/trace";
 import {GG_HTTP_REQUEST} from "./GG_HTTP_REQUEST";
-import {GG_COOKIE_WRITES} from "../schema/cookieMiddleware";
+import {GG_COOKIE_WRITES} from "../schema/GGCookie";
 import {GG_METRICS} from "@grest-ts/metrics";
 import {GGHttpMetrics} from "./GGHttpMetrics";
 import {GG_HTTP_SERVER} from "./GG_HTTP_SERVER";
 import {GGHttpServer} from "./GGHttpServer";
 import {GGLog} from "@grest-ts/logger";
-import {GG_PERMISSIONS} from "./GG_PERMISSIONS";
-import type {GGScopeResolver} from "./GGHttp";
+import {GGHttpPermissionsChecker} from "../schema/GGHttpPermissionsChecker";
 
 export interface GGHttpSchemaConfig {
     /**
@@ -29,17 +28,7 @@ export interface GGHttpSchemaConfig {
     /**
      * Additional middlewares to apply to all routes.
      */
-    middlewares?: GGHttpServerMiddleware[];
-    /**
-     * Optional scope resolver. When set, the gate calls it once per request,
-     * populates GG_PERMISSIONS, and rejects requests whose contract permission
-     * is not satisfied by the resolved scopes.
-     */
-    permissionResolver?: GGScopeResolver;
-}
-
-export interface GGHttpServerMiddleware {
-    process?(): Promise<void>
+    middlewares?: GGTransportMiddleware[];
 }
 
 declare module "../schema/GGHttpSchema" {
@@ -81,9 +70,10 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
     const scope = GGLocator.getScope();
     const parentContext = GGContextStore.tryGetContext();
 
+    const permissionsChecker = new GGHttpPermissionsChecker(apiMiddlewares);
     for (const mw of apiMiddlewares) {
-        const hKeys = Object.keys(mw.headers);
-        const rhKeys = Object.keys(mw.responseHeaders);
+        const hKeys = Object.keys(mw.headers ?? {});
+        const rhKeys = Object.keys(mw.responseHeaders ?? {});
         if (hKeys.length) server.registerCorsHeaders(hKeys);
         if (rhKeys.length) server.registerCorsExposeHeaders(rhKeys);
     }
@@ -107,8 +97,6 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
     // @TODO This is not really used and only for testkit so it would register implementation of the contract... Not cool
     httpSchema.contract.implement(implementation);
 
-    if (config.permissionResolver) server._markResolverWired(httpSchema);
-
     for (const methodName in httpSchema.codec) {
         // Wire format.
         const codec: GGHttpCodec = httpSchema.codec[methodName]
@@ -125,8 +113,7 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
         // build request mapping
         const requestParser: ClientHttpRouteToRpcTransformServerCodec = codec.createForServer({
             contract: contractFunctionSchema,
-            apiMiddlewares: apiMiddlewares,
-            serverMiddlewares: config.middlewares
+            middlewares: [...apiMiddlewares, ...(config.middlewares ?? [])]
         })
         const cookieWriteNames = new Set((codec.updatesCookies ?? []).map(k => k.name))
         server.registerRoute(codec.method, pathPrefix + codec.path, async (req: http.IncomingMessage, res: http.ServerResponse): Promise<void> => {
@@ -138,22 +125,10 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
                 const startTime = performance.now()
                 let rpcResult: ERROR<string, unknown> | OK<unknown>
                 try {
-                    const rpcInput = await requestParser.parseRequest(req)
+                    const rawInput = await requestParser.readRequest(req)
+                    await permissionsChecker.assert(httpSchema.name, methodName, contractFunctionSchema.permission)
                     try {
-                        if (config.permissionResolver) {
-                            const scopes = await config.permissionResolver()
-                            if (scopes != null) GG_PERMISSIONS.set(new GGPermissionChecker(scopes))
-                            const required = contractFunctionSchema.permission
-                            if (required !== undefined && required !== GG_NO_PERMISSIONS) {
-                                if (scopes == null) throw new NOT_AUTHORIZED({
-                                    debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} but no caller identity was resolved`
-                                })
-                                if (!satisfies(required, scopes)) throw new FORBIDDEN({
-                                    debugMessage: `${httpSchema.name}.${methodName} requires ${describePermission(required)} — caller scopes did not satisfy`
-                                })
-                            }
-                        }
-                        rpcResult = {success: true, type: "OK", data: await implFn(rpcInput)}
+                        rpcResult = {success: true, type: "OK", data: await implFn(requestParser.validateInput(rawInput))}
                         // GGLog.debug(httpSchema, "Response", rpcResult) // This is very slow to log this (like 3x performance loss)
                     } catch (error: unknown) {
                         rpcResult = ERROR.fromUnknown(error);
@@ -170,7 +145,7 @@ function setupRoutes<TContract extends GGContractApiDefinition>(
                     metrics(rpcResult?.type, httpSchema.name, codec.method, pathPrefix, codec.path, startTime)
                 }
             });
-        })
+        }, `${httpSchema.name}.${methodName}`)
     }
 }