feat(core): add interceptors to start options by alkalescent · Pull Request #3031 · opentdf/platform

alkalescent · 2026-01-28T16:31:27Z

Proposed Changes

Enable the ability to add interceptors by adding them to the server startup options

Checklist

I have added or updated unit tests
I have added or updated integration tests (if appropriate)
I have added or updated documentation

Testing Instructions

gemini-code-assist · 2026-01-28T16:31:46Z

Summary of Changes

Hello @alkalescent, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces a new feature that allows developers to programmatically inject custom connect.Interceptors into the server's startup process. This provides a flexible way to extend the server's RPC handling capabilities, enabling custom logic to be applied to requests and responses for both standard Connect RPCs and internal IPC mechanisms, without relying on configuration files.

Highlights

Interceptor Extensibility: Added new fields ExtraConnectInterceptors and ExtraIPCInterceptors to the server configuration to allow programmatic injection of connect.Interceptors.
New Server Options: Introduced WithConnectInterceptors and WithIPCInterceptors options for the server StartConfig, enabling users to supply custom interceptors at startup.
Interceptor Integration: Integrated these newly provided interceptors into the server's RPC setup for both standard Connect RPCs and in-process IPCs.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Request flows through code, Interceptors guide its path, Logic finds its way.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces the ability to programmatically add connect.Interceptors at startup for both Connect and IPC RPCs. The changes are well-implemented across the server options, start logic, and RPC creation. I have a couple of suggestions to improve code conciseness and reduce duplication.

github-actions · 2026-01-28T16:36:30Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	184.007121ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	109.103588ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	377.376375ms
Throughput	264.99 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.094148723s
Average Latency	398.996823ms
Throughput	124.71 requests/second

github-actions · 2026-01-28T16:44:55Z

X-Test Results

opentdf~~platform~~XCI41N.dockerbuild
cukes-report
✅ js-v0.9.0
✅ java-v0.9.0
✅ js-pull-3031
bats-test-results
✅ go-v0.9.0
✅ java-pull-3031
✅ go-pull-3031

github-actions · 2026-01-28T17:06:19Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	152.375553ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	85.672111ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	368.498652ms
Throughput	271.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	37.821576636s
Average Latency	376.355873ms
Throughput	132.20 requests/second

github-actions · 2026-01-28T17:14:36Z

X-Test Results

opentdf~~platform~~BLXUQ8.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3031
✅ java-v0.9.0
bats-test-results
✅ java-pull-3031
✅ go-v0.9.0
✅ go-pull-3031

github-actions · 2026-01-28T17:24:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	183.895274ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.669038ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	361.99445ms
Throughput	276.25 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.493491204s
Average Latency	383.203935ms
Throughput	129.89 requests/second

github-actions · 2026-01-28T17:33:40Z

X-Test Results

opentdf~~platform~~MD7OE5.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3031
✅ java-v0.9.0
bats-test-results
✅ go-v0.9.0
test-cases-mapping-report
✅ java-pull-3031
✅ go-pull-3031

…erceptors

github-actions · 2026-02-03T15:24:39Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	198.225747ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	107.523188ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	367.192827ms
Throughput	272.34 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.611680473s
Average Latency	383.764944ms
Throughput	129.49 requests/second

github-actions · 2026-02-03T15:31:33Z

X-Test Results

opentdf~~platform~~NCISK3.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3031
✅ java-v0.9.0
bats-test-results
test-cases-mapping-report
✅ java-pull-3031
✅ go-v0.9.0
✅ go-pull-3031

github-actions · 2026-02-09T17:26:23Z

X-Test Failure Report

opentdf~~platform~~60Z1ZO.dockerbuild

github-actions · 2026-02-09T17:28:38Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.271501ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	111.613574ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	371.180622ms
Throughput	269.41 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.809943367s
Average Latency	396.338832ms
Throughput	125.60 requests/second

github-actions · 2026-02-09T17:31:32Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	187.628425ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	106.611302ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	359.935294ms
Throughput	277.83 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	40.097842897s
Average Latency	399.369782ms
Throughput	124.69 requests/second

github-actions · 2026-02-09T17:39:37Z

X-Test Results

opentdf~~platform~~JRQNYL.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3031
✅ java-v0.9.0
bats-test-results
test-cases-mapping-report
✅ java-pull-3031
✅ go-v0.9.0
✅ go-pull-3031

github-actions · 2026-02-09T18:03:11Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	197.418937ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	105.904167ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	374.602245ms
Throughput	266.95 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.29217419s
Average Latency	391.229378ms
Throughput	127.25 requests/second

github-actions · 2026-02-09T18:11:44Z

X-Test Results

opentdf~~platform~~IRSLQR.dockerbuild
cukes-report
✅ js-v0.9.0
✅ java-v0.9.0
✅ js-pull-3031
bats-test-results
test-cases-mapping-report
✅ go-v0.9.0
✅ java-pull-3031
✅ go-pull-3031

github-actions · 2026-02-09T18:39:45Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	159.324025ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	86.681252ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	369.16822ms
Throughput	270.88 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.138518497s
Average Latency	389.584655ms
Throughput	127.75 requests/second

github-actions · 2026-02-09T18:47:40Z

X-Test Results

opentdf~~platform~~ZZNMK3.dockerbuild
cukes-report
✅ js-v0.9.0
✅ js-pull-3031
bats-test-results
✅ java-v0.9.0
test-cases-mapping-report
✅ java-pull-3031
✅ go-v0.9.0
✅ go-pull-3031

cshamrick

This looks good! I believe we should include usage instructions in ./docs/CONFIGURING.md.

github-actions · 2026-02-09T20:22:35Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	193.796155ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	98.414393ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	364.014692ms
Throughput	274.71 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.484377059s
Average Latency	393.140542ms
Throughput	126.63 requests/second

github-actions · 2026-02-09T20:31:31Z

X-Test Results

opentdf~~platform~~COD4NB.dockerbuild
cukes-report
✅ js-pull-3031
✅ js-v0.9.0
✅ java-pull-3031
bats-test-results
test-cases-mapping-report
✅ java-v0.9.0
✅ go-pull-3031
✅ go-v0.9.0

github-actions · 2026-02-10T16:31:26Z

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	194.539051ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.917785ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	375.526649ms
Throughput	266.29 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	39.860614749s
Average Latency	396.062318ms
Throughput	125.44 requests/second

github-actions · 2026-02-10T16:38:18Z

X-Test Results

opentdf~~platform~~K0J7YN.dockerbuild
cukes-report
✅ js-pull-3031
✅ js-v0.9.0
✅ java-pull-3031
✅ java-v0.9.0
bats-test-results
test-cases-mapping-report
✅ go-pull-3031
✅ go-v0.9.0

gemini-code-assist

Code Review

This pull request introduces the ability to add custom Connect interceptors when starting the server, both for external RPCs and for in-process IPC calls. The changes include new server start options, updates to the server configuration and initialization logic, new documentation, and comprehensive tests. The implementation is solid, but I've suggested a refactoring in service/internal/server/server.go to improve the clarity of how interceptors are chained together.

🤖 I have created a release *beep* *boop* --- ## [0.13.0](service/v0.12.0...service/v0.13.0) (2026-02-18) ### ⚠ BREAKING CHANGES * **policy:** remove namespace certificate feature ([#3051](#3051)) ### Features * **authz:** add casbin roleprovider interface ([#3069](#3069)) ([9d6b3f3](9d6b3f3)) * **core:** add interceptors to start options ([#3031](#3031)) ([e0b4e93](e0b4e93)) ### Bug Fixes * **deps:** bump github.com/opentdf/platform/lib/fixtures from 0.4.0 to 0.5.0 in /service ([#3034](#3034)) ([66b61b1](66b61b1)) * **deps:** bump github.com/opentdf/platform/lib/ocrypto from 0.9.0 to 0.10.0 in /service ([#3080](#3080)) ([49582f0](49582f0)) * **deps:** bump github.com/opentdf/platform/protocol/go from 0.15.0 to 0.16.0 in /service ([#3083](#3083)) ([a332f95](a332f95)) * **deps:** vulnerability fix in connect-rpc validate and ristretto ([#3065](#3065)) ([8860fed](8860fed)) * Go 1.25 ([#3053](#3053)) ([65eb7c3](65eb7c3)) * **kas:** dont hardcode P-256 curve ([#3073](#3073)) ([826d857](826d857)) * **kas:** Fix EC P-521 typo ([#3075](#3075)) ([abc088d](abc088d)) * **policy:** reject unencrypted private keys for modes 1/2 ([#3072](#3072)) ([e2dc6d8](e2dc6d8)) ### Code Refactoring * **policy:** remove namespace certificate feature ([#3051](#3051)) ([48abb81](48abb81)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: opentdf-automation[bot] <149537512+opentdf-automation[bot]@users.noreply.github.com>

add interceptors

2e5e405

github-actions Bot added the size/s label Jan 28, 2026

gemini-code-assist Bot reviewed Jan 28, 2026

View reviewed changes

Comment thread service/internal/server/server.go Outdated

Comment thread service/pkg/server/start.go Outdated

gemini suggestions

b4b3057

fix

000f1c9

Merge branch 'main' of github.com:opentdf/platform into DSPX-2264-int…

4016b84

…erceptors

alkalescent marked this pull request as ready for review February 6, 2026 16:05

alkalescent requested a review from a team as a code owner February 6, 2026 16:05

jakedoublev requested a review from cshamrick February 6, 2026 16:44

alkalescent linked an issue Feb 6, 2026 that may be closed by this pull request

Add programmatic Connect/IPC interceptor options and consolidate Connect RPC wiring #3052

Closed

alkalescent added 2 commits February 9, 2026 12:22

tests

b1a759d

gemini suggestions

c87fc26

lint

add44e8

lint

28e8fa2

update test

cf1b1b5

merge conflict

c0cdbf7

cshamrick reviewed Feb 9, 2026

View reviewed changes

docs

2b2b855

cshamrick reviewed Feb 10, 2026

View reviewed changes

Comment thread docs/Configuring.md

alkalescent added 2 commits February 10, 2026 10:29

add additional interceptors after defaults

7d7d3de

add more tests

e348114

gemini-code-assist Bot reviewed Feb 10, 2026

View reviewed changes

cshamrick approved these changes Feb 10, 2026

View reviewed changes

alkalescent added this pull request to the merge queue Feb 10, 2026

Merged via the queue into main with commit e0b4e93 Feb 10, 2026
39 checks passed

alkalescent deleted the DSPX-2264-interceptors branch February 10, 2026 18:11

opentdf-automation Bot mentioned this pull request Feb 9, 2026

chore(main): release service 0.13.0 #3058

Merged

Uh oh!

Conversation

alkalescent commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Proposed Changes

Checklist

Testing Instructions

Uh oh!

gemini-code-assist Bot commented Jan 28, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jan 28, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jan 28, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jan 28, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jan 28, 2026

X-Test Results

Uh oh!

github-actions Bot commented Jan 28, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Jan 28, 2026

X-Test Results

Uh oh!

github-actions Bot commented Feb 3, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 3, 2026

X-Test Results

Uh oh!

github-actions Bot commented Feb 9, 2026

X-Test Failure Report

Uh oh!

github-actions Bot commented Feb 9, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 9, 2026

Benchmark authorization.GetDecisions Results:

Benchmark authorization.v2.GetMultiResourceDecision Results:

Benchmark Statistics

Bulk Benchmark Results

TDF3 Benchmark Results:

Uh oh!

github-actions Bot commented Feb 9, 2026

X-Test Results

Uh oh!

github-actions Bot commented Feb 9, 2026

alkalescent commented Jan 28, 2026 •

edited

Loading