fix(core): DSPX-4694 honor reflection configuration

[jakedoublev]

Honors server.grpc.reflectionEnabled for external handlers and omits reflection from the in-process mux.

Tested: make test HAND_MODS=service/internal/server

Summary by CodeRabbit

• Configuration

  • gRPC reflection is now registered only when explicitly enabled.
  • Reflection handlers are no longer registered on the in-process server.

• Bug Fixes

  • Prevents unintended exposure of reflection endpoints when reflection is disabled.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: edf02d32-54f4-4622-8cf3-60c55b797dd8

📥 Commits

Reviewing files that changed from the base of the PR and between da8450b and e127a2c.

📒 Files selected for processing (2)

• service/internal/server/server.go
• service/internal/server/server_test.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The server now conditionally registers gRPC reflection handlers. Enabled reflection registers V1 and V1Alpha handlers on the external mux only. Disabled reflection registers no reflection handlers. Tests cover both configurations.

Changes

gRPC reflection registration

Layer / File(s)	Summary
Reflection configuration and registration flow service/internal/server/server.go	OpenTDFServer stores the reflection setting from GRPCConfig. Start() calls conditional registration. Enabled reflection registers V1 and V1Alpha handlers on the external mux only.
Reflection registration tests service/internal/server/server_test.go	Tests verify enabled registration on the external mux and no registration on the in-process mux. Disabled configuration registers no reflection handlers.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to e127a

gRPC reflection now follows the configured setting: it is exposed externally only when enabled and is unavailable in-process. The change has focused coverage for both configuration states and presents no remaining merge-blocking risk.

Suggested reviewers: pflynn-virtru

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 8 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: honoring the reflection configuration in the core server. It is concise and specific.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/dspx-4694-reflection-config

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the mux at night
V1 and V1Alpha hop into sight
The inner path stays clear and still
Config decides the handler’s will
Tests guard every route with skill}

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	186.625781ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	93.93854ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	347.752995ms
Throughput	287.56 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	44.472697624s
Average Latency	443.585498ms
Throughput	112.43 requests/second

[github-actions]

X-Test Failure Report

✅ js@main-v0.9.0
cukes-report
✅ java@main-v0.9.0
opentdfplatformQ4JWK0.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

X-Test Failure Report

govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	182.572131ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	96.79521ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	335.231153ms
Throughput	298.30 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	49.588527885s
Average Latency	495.01781ms
Throughput	100.83 requests/second

[github-actions]

X-Test Failure Report

opentdfplatformIVAXSZ.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	189.900173ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	100.78233ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	355.401448ms
Throughput	281.37 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	50.318028107s
Average Latency	502.056992ms
Throughput	99.37 requests/second

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	212.866802ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	115.352678ms

Benchmark Statistics

Name	№ Requests	Avg Duration	Min Duration	Max Duration

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	436.176649ms
Throughput	229.26 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	55.903547006s
Average Latency	557.783853ms
Throughput	89.44 requests/second

[github-actions]

⚠️ Govulncheck found vulnerabilities ⚠️

The following modules have known vulnerabilities:

• otdfctl
• service
• tests-bdd

See the workflow run for details.

[github-actions]

X-Test Results

✅ go@main-pull-4021
bats-test-results
✅ go@pull-4021-pull-4021
✅ go@main-main
✅ go@pull-4021-main
✅ java@main-pull-4021
✅ go@pull-4021-v0.9.0
✅ js@main-pull-4021
cukes-report
✅ java@main-main
✅ go@main-v0.9.0
✅ js@main-main
✅ java@main-v0.9.0
✅ js@main-v0.9.0
opentdfplatformH96YQM.dockerbuild
govulncheck-failure-8
govulncheck-failure-3
govulncheck-failure-1

[jakedoublev]

/backport

[opentdf-automation]

Successfully created backport PR for release/service/v0.25:

• fix(core): DSPX-4694 honor reflection configuration [backport to release/service/v0.25] #4025