[antoinetoussaint-byte]

Folds #38 and #40. #38 (REST binding, documented operations) is closed as superseded; its three commits come first. #40 (mint the viewer's authority per consumed method) is the last commit. Based on main.

What

Server.Consumes lets a solution declare which operations of which consumed module its page may call. The runtime serves each one as a Connect unary procedure at /modules/<as>/<package.Service>/<Method>, so the page uses the module's own generated client (connect-es) unmodified, with base URL <apiBase>/modules/<as>.

A call is answered by the module, as the viewer:

• The runtime mints the declared Work Context (ForModule) with the declared scopes. With ViewerBearer, it forwards only the bearer to a module that authenticates the viewer itself.
• It forwards over the method's google.api.http binding (Transcoded, from feat: call composed modules over their REST binding; documented operations #38).
• The page names a procedure and a request message. It never names a path, a prefix, an audience or an authority.

Least privilege by default

• A method that is not declared is not_found. No request reaches the gateway.
• Serve refuses, at boot:
  • a module whose as is not in api.consumes (the CODEFLY__API_CONSUMES projection, read in loadConfig);
  • a method missing from the registry, or with no binding under /v1/<as>;
  • a streaming method;
  • a declaration that names no response fields.
• Response is a FieldMask over the method's output. WholeResponse must be said explicitly.
• Pin fixes part of every request server-side (proto.Merge). A pinned scalar replaces the page's value, and a pinned repeated value is added to the page's, so a filter clause the module ANDs stays in force.
• A module's refusal reaches the page in the Connect error:
  • a google.rpc.Status body keeps its code and message;
  • another small JSON refusal is the message, verbatim, under the code its status maps to;
  • anything else is reported by kind only.
    GatewayError carries the head of the refusal body privately for this. No handler error exposes it.
• PassthroughOperations renders the declaration for the interface artifact. InterfaceArtifact(dir, info, ops, modules...) renders a backend's whole artifact at the version its service.codefly.yaml declares (ServiceVersion), so each solution stops re-implementing that.

Who else reuses it

• Consumes (passthrough): every solution whose page calls a consumed module's operations; a consuming solution is the first.
• InterfaceArtifact / ServiceVersion: every solution backend that commits an interface artifact from its declared operations.

Classification

Fix at the owner. The generic relay every solution was writing per operation becomes the runtime's.

Stacked

On #38 (Transcoded), which is unmerged. Base is #38's branch so the diff is this change only. Consumer: a consuming solution drops about 1,800 relay lines.

Verified / not verified

• go test -race ./..., go vet, gofmt: green locally. New tests cover each item above: answered as the viewer with a masked response, bearer-only mode, undeclared paths, bearer required, the page cannot add fields, refusal relay (Status / other JSON / non-JSON), boot refusals, the api.consumes check, pin merge, and the interface document.
• Not verified: a live call through a deployed gateway and host proxy. It is exercised with an httptest gateway only.

🤖 Generated with Claude Code

[antoinetoussaint-byte]

Folded in #40 (one commit, fast-forward, no force-push): ca2fac1 feat: mint the viewer's authority per consumed method, not per module. The branch head is now ca2fac13a7519e96bb3e2b7812d5df57928a9d9d.

What it adds: ConsumedMethod.Scopes, which replaces the module's Scopes for that method only and is never unioned with them. A consumed module that is not ViewerBearer may now omit module-level scopes when every method declares its own. Each call mints only its method's scopes, and the mint cache is keyed by the exact ask. A refused mint reaches the page as the host's own Connect code (permission_denied, naming the missing permission) through the new WorkContextRefusal type, which still unwraps to *GatewayError. Boot refuses method scopes on a ViewerBearer module, a method with no effective scopes, and empty or duplicate actions.

Verified at ca2fac1: go build ./..., go test -race ./... and go vet ./... all pass. Not verified: a refused mint against live accounts through the auth gateway; the error shape was taken from the accounts handler, not observed live.

🤖 Generated with Claude Code