glm-5.3-flash
d070e548ad
Tasks completed: server-core-types, server-auth, server-healthz-decoy, gateway-dispatch, server-adapter (5 of 17). - src/server/state.rs: DecoyConfig + RouterState (alkcall type paths, 6-endpoint reserved-path docs) - src/server/auth.rs: bearer middleware + ResolvedIdentity extractor (10 tests: missing/malformed/basic/failed-resolution matrix) - src/server/healthz.rs + decoy.rs: raw healthz; nginx-style 404, static site (path-traversal guarded), redirect decoys - src/gateway/dispatch.rs: GatewayDispatch invoke/invoke_streaming (internal:false, forwarded_for:None, bounded deadline) + src/gateway/error.rs: CallError→HTTP status mapping (HTTP_<status> passthrough, retryable→Retry-After) - src/server/adapter.rs: HttpAdapter ProtocolHandler — accept_bi → BiStream → TokioIo → hyper auto builder (h2 CONNECT enabled); integration tests over DuplexStream (request/response cycle, healthz, decoy 404) Verified: cargo test (46 lib tests), clippy -D warnings, fmt, test --all-features.
52 lines
1.9 KiB
Markdown
52 lines
1.9 KiB
Markdown
---
|
|
id: gateway-dispatch
|
|
name: GatewayDispatch — shared dispatch spine (invoke + streaming)
|
|
status: completed
|
|
depends_on: [server-core-types]
|
|
scope: moderate
|
|
risk: medium
|
|
impact: component
|
|
level: implementation
|
|
tags: [gateway, phase-1]
|
|
---
|
|
|
|
## Description
|
|
|
|
Port the dispatch spine from
|
|
`/workspace/@alkdev/alknet/crates/alknet-http/src/gateway/dispatch.rs`
|
|
to alkcall's API: `GatewayDispatch::new(registry, identity_provider)`,
|
|
`invoke()` (identity resolve → root OperationContext →
|
|
`OperationRegistry` invoke → ResponseEnvelope), and `invoke_streaming()`
|
|
(`BoxStream<ResponseEnvelope>` for Sub ops). The security invariants
|
|
must hold identically across both: `External`-only (Internal →
|
|
NOT_FOUND), `AccessControl::check` gating, no env-var reads. Port the
|
|
error mapping (`gateway/error.rs`) too: CallError → HTTP status per
|
|
docs/architecture/http-server.md §Error Mapping (NOT_FOUND→404,
|
|
FORBIDDEN→401/403, INVALID_INPUT→422, TIMEOUT→504, INTERNAL→500,
|
|
`HTTP_<status>` passthrough, retryable→Retry-After hint).
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [x] `invoke()` + `invoke_streaming()` ported against alkcall dispatch
|
|
- [x] Error mapping table ported with unit tests per row
|
|
- [x] Internal ops → 404 before ACL; ACL failure → 401/403 distinction preserved
|
|
- [x] `cargo test` passes
|
|
|
|
## References
|
|
|
|
- docs/architecture/http-server.md (§HTTP-to-call dispatch, §Error Mapping)
|
|
- docs/architecture/decisions/023-operation-error-schemas.md
|
|
- alkcall ADR-016 (error schemas), ADR-017 (privilege model)
|
|
|
|
## Notes
|
|
|
|
> Agent fills during implementation.
|
|
|
|
## Summary
|
|
|
|
Ported `src/gateway/dispatch.rs` (GatewayDispatch: invoke +
|
|
invoke_streaming, root OperationContext construction with
|
|
internal:false / forwarded_for:None, deadline bounded for once-ops) and
|
|
`src/gateway/error.rs` (CallError→HTTP mapping per row, HTTP_<status>
|
|
passthrough, retryable→Retry-After). Tests adapted to alkcall's
|
|
`ResponseEnvelope.result: Result<Value, CallError>` shape. |