feat(server): declare gRPC auth (mode + scope + role) at the handler, enforce at the router

crates/openshell-core/build.rs

@@ -40,12 +40,23 @@ fn main() -> Result<(), Box<dyn std::error::Error>> {
     collect_proto_files(&proto_root, &mut proto_files)?;
     proto_files.sort();
 
+    let out_dir = PathBuf::from(env::var("OUT_DIR")?);
+    let descriptor_path = out_dir.join("openshell_descriptor.bin");
+
     // Configure tonic-build
     tonic_build::configure()
         .build_server(true)
         .build_client(true)
+        // Emit a binary FileDescriptorSet so the server can enumerate every
+        // RPC at runtime (used by the per-handler auth exhaustiveness test).
+        .file_descriptor_set_path(&descriptor_path)
         .compile_protos(&proto_files, &[proto_root.as_path()])?;
 
+    println!(
+        "cargo:rustc-env=OPENSHELL_DESCRIPTOR_PATH={}",
+        descriptor_path.display()
+    );
+
     Ok(())
 }
 

crates/openshell-core/src/lib.rs

@@ -43,3 +43,10 @@ pub const VERSION: &str = match option_env!("OPENSHELL_GIT_VERSION") {
     Some(v) => v,
     None => env!("CARGO_PKG_VERSION"),
 };
+
+/// Encoded protobuf `FileDescriptorSet` for every proto in `proto/`.
+///
+/// Emitted by `build.rs` via `tonic_build::configure().file_descriptor_set_path(...)`.
+/// Used by tests in `openshell-server` to enumerate every RPC and verify that
+/// each one has an `#[rpc_auth(...)]` declaration on its handler.
+pub const FILE_DESCRIPTOR_SET: &[u8] = include_bytes!(env!("OPENSHELL_DESCRIPTOR_PATH"));

crates/openshell-server-macros/Cargo.toml

@@ -0,0 +1,18 @@
+# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+[package]
+name = "openshell-server-macros"
+version.workspace = true
+edition.workspace = true
+rust-version.workspace = true
+license.workspace = true
+repository.workspace = true
+
+[lib]
+proc-macro = true
+
+[dependencies]
+proc-macro2 = "1"
+quote = "1"
+syn = { version = "2", features = ["full", "extra-traits"] }