graviton.protocol.http

Bearer-token authentication middleware.

Extracts Authorization: Bearer from the request, delegates to the configured JwtVerifier, and installs the resulting CallerContext on the fiber for the lifetime of the handler. Every downstream resource check, DB read, and audit event sees the same identity.

The middleware is a plain handler combinator — no dependency on HttpAppMiddleware — so it can be composed into both the HttpApi.routes pipeline and the legacy internal pipeline without bringing in the full middleware stack from zio-http.

Routes that should stay open (e.g. /api/health) should not be wrapped.

One streaming ingest path shared by the public API and local operator UI.

Development-only token mint endpoint. Active only when a dev shared secret has been configured via GRAVITON_SECURITY_DEV_SHARED_SECRET.

Never mount this endpoint in production. It exists so an operator or a developer can mint an HS256 JWT locally — no external IdP required — and immediately curl the protected HTTP routes. For production, configure an OIDC issuer and an RS256 verifier instead.

Enforces transport, origin, capability, rate, size, and audit policy.

Minimal "internal-only" guardrail:

• not meant for public clients
• token check is explicit and easy to wire behind a separate listener

Prefer mTLS in real deployments; this is the v1 minimum for avoiding accidental exposure.

Selects a server-owned tenant store before a response body can escape the request handler. Download streams therefore retain a concrete tenant store without depending on a FiberRef after the handler has returned.