Apply rate limiting to ConnectRPC path, deduplicate auth helpers

[haasonsaas]

Summary

Follow-up to #111 addressing remaining Bugbot review feedback:

• Rate limiting bypass (HIGH): ConnectRPC endpoints (/gate.v1.*) were served outside the chi router, bypassing rate limiter, body size limit, and security headers. Now wrapped with the same middleware. Note: this was pre-existing from the gRPC era — the old grpcMuxHandler also skipped chi middleware.
• Duplicated authReq (LOW): Identical auth header methods in sync/connectclient.go and connector/registration.go replaced with shared controlplaneclient.ApplyAuth()
• Set vs Add bug (LOW): The duplicated authReq used Set inside a multi-value loop. Eliminated by switching to ApplyAuth which sets headers directly.

Test plan

• go build ./... passes
• go vet ./... passes
• go test ./... -race passes
• Integration tests pass
• Verify ConnectRPC endpoints are rate limited (send >200 burst requests)

🤖 Generated with Claude Code

[cursor]

PR Summary

High Risk
High: changes request handling for all ConnectRPC endpoints by adding rate limiting/body-size/security headers and RealIP, which could impact client behavior under load or behind proxies. Also refactors shared auth header application across connector/sync clients, so mistakes would affect control-plane connectivity.

Overview
ConnectRPC (/gate.v1.*) requests are now wrapped with the same middleware stack as REST routes (RealIP, rate limiting, max body size, and security headers), closing a bypass where RPC calls skipped these protections.

Auth header setting for ConnectRPC clients is deduplicated by replacing per-client authReq helpers with a shared controlplaneclient.ApplyAuth() used by connector registration and sync clients.

CI Buf breaking detection is updated to compare against origin/main instead of main.

^{Reviewed by Cursor Bugbot for commit 5476317. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{Bugbot Autofix is ON, but it could not run because the spend limit has been reached. To enable Bugbot Autofix, have a team admin raise the spend limit in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 37f9358. Configure here.}

[cursor]

New ApplyAuth duplicates existing withAuth helper logic

Low Severity

The new ApplyAuth function duplicates the header-setting logic of the existing withAuth function in the same file. Both set the same Authorization and X-Org-Id headers on a ConnectRPC request. The private withAuth could delegate to ApplyAuth internally to keep a single source of truth for auth header logic.

Additional Locations (1)

• internal/controlplaneclient/client.go#L65-L74

 

^{Reviewed by Cursor Bugbot for commit 37f9358. Configure here.}