import { withPluginRuntimeGatewayRequestScope } from "../plugins/runtime/gateway-request-scope.js";

import { formatControlPlaneActor, resolveControlPlaneActor } from "./control-plane-audit.js";

import { consumeControlPlaneWriteBudget } from "./control-plane-rate-limit.js";

import { ADMIN_SCOPE, authorizeOperatorScopesForMethod } from "./method-scopes.js";

import {

ADMIN_SCOPE,

authorizeOperatorScopesForMethod,

authorizeOperatorScopesForRequiredScope,

} from "./method-scopes.js";

import {

createCoreGatewayMethodDescriptors,

createGatewayMethodDescriptorsFromHandlers,

isCoreGatewayMethodClassified,

type GatewayMethodRegistry,

} from "./methods/registry.js";

import { isOperatorScope } from "./operator-scopes.js";

import { isRoleAuthorizedForMethod, parseGatewayRole } from "./role-policy.js";

import type {

GatewayRequestHandler,

method: string,

client: GatewayRequestOptions["client"],

params: unknown,

methodRegistry: GatewayMethodRegistry,

) {

// Pre-connect and health requests are allowed through; role/scope checks require the

// authenticated connect metadata established by the gateway handshake.

if (scopes.includes(ADMIN_SCOPE)) {

return null;

}

const scopeAuth = authorizeOperatorScopesForMethod(method, scopes, params);

const registeredScope = methodRegistry.getScope(method);

const scopeAuth = isOperatorScope(registeredScope)

? authorizeOperatorScopesForRequiredScope(registeredScope, scopes)

: authorizeOperatorScopesForMethod(method, scopes, params);

if (!scopeAuth.allowed) {

return errorShape(ErrorCodes.INVALID_REQUEST, `missing scope: ${scopeAuth.missingScope}`);

}

const { req, respond, client, isWebchatConnect, context } = opts;

const methodRegistry =

opts.methodRegistry ?? createRequestGatewayMethodRegistry(opts.extraHandlers);

const authError = authorizeGatewayMethod(req.method, client, req.params);

const authError = authorizeGatewayMethod(req.method, client, req.params, methodRegistry);

if (authError) {

respond(false, undefined, authError);

return;