Question: How to deal with phases/modes/roles where different clients have different mehods exposed to them?

[idanarye]

I want to create service that uses WebSockets, which means actual sessions. Upon connection, the client will have to do a handshake - declaring itself as either "Role A" or "Role B" by sending a login_a or login_b request (or maybe it'd be a parameter of the general login. I haven't decided yet). The login method, of course, will also send the parameters.

After which it'll be able to access the methods exposed to that role. Each role has different methods (though some can be shared, of course)

My question is about the rpc.discover method:

• Should it always return all the methods, or should it only return the methods available to that role (and in the handshake phase - only the login methods)
• If it's the former - how should I mark which methods are available for each role?
• If it's the latter - what do I do with openrpc.json? Can I make several such files (openrpc-handshake.json, openrpc-role-a.json, openrpc-role-b.json)? Or should the openrpc.json just return all the methods?

[github-actions]

Welcome to OpenRPC! Thank you for taking the time to create an issue. Please review the guidelines

[zcstarr]

We haven't done alot of auth style work within the spec, my instinct says this would be a good case for a extension. I'm just going to ideate a little on this live on the issue.

We recently added support for extensions in the toolkit, so it will validate the documents properly depending on what you define for the extension.

A little more about extensions:
https://github.com/open-rpc/tools/tree/main/packages/extensions

You would maybe add this to the methods that have class restrictions
x-role: ["admin", "user"]
x-role: ["*"]

You would define the extensions to then support the roles that you wanted , and then embed them directly on the methods. You could either go full specification or specify just the restricted roles. You'd then load your document and only return matching roles. I think it would be fairly quick to parse the document and check for the extension property. I think that's better than returning a list of methods to return.

When you define rpc.discover you'd just filter it based off of the roles on method probably mapping role -> method [] you could do this once at initialization vs. recalculating it everytime.

Does this make sense our extensions are fairly new we released it early this year but don't have many community extensions floating around in the wild