Connect for Go 1.20.0

Apply the Go 1.27 baseline first. These rules cover connectrpc.com/connect v1.20.0 with the google.golang.org/protobuf APIv2 runtime. The module requires Go 1.25 or newer; use a supported, patched Go toolchain matching the included baseline.

Handlers and authorization

• Authenticate protected RPCs in net/http middleware before invoking the Connect handler. Unary interceptors run after reading, decompressing, and decoding the request, so they cannot protect that work from unauthenticated callers. WithRequestGate is unavailable in 1.20.0.
• Apply shared security options to every generated New...Handler. Implement Interceptor.WrapStreamingHandler for streaming policy: UnaryInterceptorFunc affects only unary calls, including when a service also has server-streaming methods.
• Authorize the generated procedure identified by Spec().Procedure and each referenced resource against the authenticated principal. Validate and authorize each received streaming operation before its side effects; opening an authorized stream does not grant access to every object later named on it.
• Review WithInterceptors order: the first interceptor is outermost, and streaming receive wrappers see decoded messages in the reverse of the send order. Keep required controls on every procedure when using WithConditionalHandlerOptions; unmatched procedures must retain authentication, authorization, and size limits.
• Enforce the same policy across Connect, gRPC, gRPC-Web, binary Protobuf, and JSON, all supported by default on handlers. Client options such as WithGRPC() select a