fix(gateway): enforce audited production traversal

gateway/capability.go

@@ -8,8 +8,6 @@ import (
 
 var ErrNoCapabilityOverlap = errors.New("no capability overlap")
 
-const defaultClientDecode = "h264-hevc-opus"
-
 func DefaultCapabilities() protocol.CapabilityProfile {
 	return protocol.CapabilityProfile{
 		Transport:         "quic-tls13",
@@ -17,29 +15,19 @@ func DefaultCapabilities() protocol.CapabilityProfile {
 		Media:             "encoded",
 		Audio:             "encoded",
 		SourceRateControl: "server",
-		ClientDecode:      defaultClientDecode,
+		ClientDecode:      []string{"hevc-opus", "h264-opus"},
 	}
 }
 
+func capabilityProfileUnset(profile protocol.CapabilityProfile) bool {
+	return profile.Transport == "" && profile.Framing == "" && profile.Media == "" &&
+		profile.Audio == "" && profile.SourceRateControl == "" && len(profile.ClientDecode) == 0
+}
+
 func IntersectCapabilities(profiles ...protocol.CapabilityProfile) (protocol.CapabilityProfile, error) {
-	if len(profiles) == 0 {
+	selected, err := protocol.IntersectCapabilityProfiles(profiles...)
+	if err != nil {
 		return protocol.CapabilityProfile{}, ErrNoCapabilityOverlap
 	}
-	for _, profile := range profiles {
-		if err := profile.Validate(); err != nil {
-			return protocol.CapabilityProfile{}, ErrNoCapabilityOverlap
-		}
-	}
-	selected := profiles[0]
-	for _, profile := range profiles[1:] {
-		if selected.Transport != profile.Transport ||
-			selected.Framing != profile.Framing ||
-			selected.Media != profile.Media ||
-			selected.Audio != profile.Audio ||
-			selected.SourceRateControl != profile.SourceRateControl ||
-			selected.ClientDecode != profile.ClientDecode {
-			return protocol.CapabilityProfile{}, ErrNoCapabilityOverlap
-		}
-	}
 	return selected, nil
 }