feat: make native TLS protocol boundary explicit

transport/native/server.go

@@ -12,6 +12,7 @@ import (
 	"context"
 	"crypto/tls"
 	"errors"
+	"fmt"
 	"io"
 	"net"
 	"net/http"
@@ -33,6 +34,7 @@ const (
 	defaultMaxBodyBytes      = 8 << 20
 	defaultReadBufferSize    = 4 << 10
 	maxPooledResponseBytes   = 64 << 10
+	nativeALPNProtocol       = "http/1.1"
 )
 
 // Server is a small HTTP/1.1 server with project-owned connection lifecycle.
@@ -194,9 +196,27 @@ func (s *Server) ServeTLS(ctx context.Context, listener net.Listener, config *tl
 	if config == nil {
 		return errors.New("go-omni/native: nil TLS config")
 	}
+	config, err := prepareTLSConfig(config)
+	if err != nil {
+		_ = listener.Close()
+		return err
+	}
 	return s.Serve(ctx, tls.NewListener(listener, config))
 }
 
+func prepareTLSConfig(config *tls.Config) (*tls.Config, error) {
+	clone := config.Clone()
+	if len(clone.NextProtos) == 0 {
+		clone.NextProtos = []string{nativeALPNProtocol}
+	}
+	for _, protocol := range clone.NextProtos {
+		if protocol != nativeALPNProtocol {
+			return nil, fmt.Errorf("go-omni/native: unsupported TLS ALPN protocol %q; only %q is supported", protocol, nativeALPNProtocol)
+		}
+	}
+	return clone, nil
+}
+
 // Serve accepts connections from listener until the context is canceled or an
 // unrecoverable accept error occurs. The listener is owned by the Server.
 func (s *Server) Serve(ctx context.Context, listener net.Listener) error {