refinement phase 9

server/src/API/Baya.Web.Api/Program.cs

@@ -110,7 +110,7 @@ TypeAdapterConfig.GlobalSettings.Scan(typeof(UserCreateCommand).Assembly,
 
 #region Plugin Services Configuration
 
-builder.Services.ConfigureGrpcPluginServices();
+builder.Services.ConfigureGrpcPluginServices(builder.Environment);
 
 #endregion
 

server/src/API/Plugins/Baya.Web.Plugins.Grpc/GrpcPluginStartup.cs

@@ -1,27 +1,36 @@
-using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Builder;
 using Microsoft.AspNetCore.Http;
 using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Hosting;
 using Baya.Web.Plugins.Grpc.Services;
 
 namespace Baya.Web.Plugins.Grpc;
 
+/// <summary>
+/// gRPC plugin wiring. The plugin exposes the User service over HTTP/2; the client is HTTP/JSON only, so this is
+/// an internal/optional surface. <b>gRPC reflection is enabled only in Development</b> (refinement-phase-9 §9.5) —
+/// reflection advertises the full service schema and must not be reachable in deployed environments. The endpoint
+/// shares the mixed-protocol Kestrel listener (refinement-phase-5 set <c>Http1AndHttp2</c>), so ALPN negotiates
+/// HTTP/2 for gRPC clients while the REST API keeps HTTP/1.1 — no dedicated port is required.
+/// </summary>
 public static class GrpcPluginStartup
 {
-    public static IServiceCollection ConfigureGrpcPluginServices(this IServiceCollection services)
+    public static IServiceCollection ConfigureGrpcPluginServices(this IServiceCollection services, IHostEnvironment environment)
     {
-     
-        
         services.AddGrpc();
-        services.AddGrpcReflection();
+
+        if (environment.IsDevelopment())
+            services.AddGrpcReflection();
 
         return services;
     }
 
     public static void ConfigureGrpcPipeline(this WebApplication app)
     {
-
         app.MapGrpcService<UserGrpcServices>();
-        app.MapGrpcReflectionService();
+
+        if (app.Environment.IsDevelopment())
+            app.MapGrpcReflectionService();
 
         app.MapGet("/GrpcUser", async context =>
         {
@@ -29,4 +38,4 @@ public static class GrpcPluginStartup
                 "Communication with this gRPC endpoint must be made through a gRPC client.");
         });
     }
-}
+}