Merge branch 'smh-fix-repository-exists' into 'master'

Unrevert RepositoryExists interceptor changes

See merge request gitlab-org/gitaly!3887

17 files changed, 246 insertions, 113 deletions

diff --git a/internal/praefect/protoregistry/protoregistry.go b/internal/praefect/protoregistry/protoregistry.go
index 6c9bbff5d..7434de176 100644
--- a/internal/praefect/protoregistry/protoregistry.go
+++ b/internal/praefect/protoregistry/protoregistry.go
@@ -172,7 +172,7 @@ func New(protos ...*descriptorpb.FileDescriptorProto) (*Registry, error) {
 					p.GetPackage(), svc.GetName(), method.GetName(),
 				)
 
-				if intercepted, err := protoutil.IsInterceptedService(svc); err != nil {
+				if intercepted, err := protoutil.IsInterceptedMethod(svc, method); err != nil {
 					return nil, fmt.Errorf("is intercepted: %w", err)
 				} else if intercepted {
 					interceptedMethods[fullMethodName] = struct{}{}
diff --git a/internal/praefect/repository_exists.go b/internal/praefect/repository_exists.go
index f8ae301cc..bbafff823 100644
--- a/internal/praefect/repository_exists.go
+++ b/internal/praefect/repository_exists.go
@@ -16,14 +16,10 @@ var (
 	errMissingRelativePath = status.Error(codes.InvalidArgument, "repository missing relative path")
 )
 
-// RepositoryExistsStreamInterceptor returns a stream interceptor that handles /gitaly.RepositoryService/RepositoryExists
-// calls by checking whether there is a record of the repository in the database.
-func RepositoryExistsStreamInterceptor(rs datastore.RepositoryStore) grpc.StreamServerInterceptor {
-	return func(srv interface{}, stream grpc.ServerStream, info *grpc.StreamServerInfo, handler grpc.StreamHandler) error {
-		if info.FullMethod != "/gitaly.RepositoryService/RepositoryExists" {
-			return handler(srv, stream)
-		}
-
+// RepositoryExistsHandler handles /gitaly.RepositoryService/RepositoryExists calls by checking
+// whether there is a record of the repository in the database.
+func RepositoryExistsHandler(rs datastore.RepositoryStore) grpc.StreamHandler {
+	return func(srv interface{}, stream grpc.ServerStream) error {
 		var req gitalypb.RepositoryExistsRequest
 		if err := stream.RecvMsg(&req); err != nil {
 			return fmt.Errorf("receive request: %w", err)
diff --git a/internal/praefect/repository_exists_test.go b/internal/praefect/repository_exists_test.go
index a5e894eaf..45e315299 100644
--- a/internal/praefect/repository_exists_test.go
+++ b/internal/praefect/repository_exists_test.go
@@ -20,7 +20,7 @@ import (
 	"google.golang.org/grpc/status"
 )
 
-func TestRepositoryExistsStreamInterceptor(t *testing.T) {
+func TestRepositoryExistsHandler(t *testing.T) {
 	t.Parallel()
 	errServedByGitaly := status.Error(codes.Unknown, "request passed to Gitaly")
 
@@ -76,22 +76,18 @@ func TestRepositoryExistsStreamInterceptor(t *testing.T) {
 
 			require.NoError(t, rs.CreateRepository(ctx, 0, "virtual-storage", "relative-path", "storage", nil, nil, false, false))
 
-			electionStrategy := config.ElectionStrategyPerRepository
-			if tc.routeToGitaly {
-				electionStrategy = config.ElectionStrategySQL
-			}
-
 			tmp := testhelper.TempDir(t)
 
 			ln, err := net.Listen("unix", filepath.Join(tmp, "praefect"))
 			require.NoError(t, err)
 
+			electionStrategy := config.ElectionStrategyPerRepository
+			if tc.routeToGitaly {
+				electionStrategy = config.ElectionStrategySQL
+			}
+
 			srv := NewGRPCServer(
-				config.Config{
-					Failover: config.Failover{
-						ElectionStrategy: electionStrategy,
-					},
-				},
+				config.Config{Failover: config.Failover{ElectionStrategy: electionStrategy}},
 				testhelper.DiscardTestEntry(t),
 				protoregistry.GitalyProtoPreregistered,
 				func(ctx context.Context, fullMethodName string, peeker proxy.StreamPeeker) (*proxy.StreamParameters, error) {
diff --git a/internal/praefect/server.go b/internal/praefect/server.go
index 4eb4b1c4c..7e9570a2e 100644
--- a/internal/praefect/server.go
+++ b/internal/praefect/server.go
@@ -106,10 +106,6 @@ func NewGRPCServer(
 		panichandler.StreamPanicHandler,
 	}
 
-	if conf.Failover.ElectionStrategy == config.ElectionStrategyPerRepository {
-		streamInterceptors = append(streamInterceptors, RepositoryExistsStreamInterceptor(rs))
-	}
-
 	grpcOpts = append(grpcOpts, proxyRequiredOpts(director)...)
 	grpcOpts = append(grpcOpts, []grpc.ServerOption{
 		grpc.StreamInterceptor(grpcmw.ChainStreamServer(streamInterceptors...)),
@@ -130,6 +126,13 @@ func NewGRPCServer(
 
 	srv := grpc.NewServer(grpcOpts...)
 	registerServices(srv, nodeMgr, txMgr, conf, queue, rs, assignmentStore, service.Connections(conns), primaryGetter)
+
+	if conf.Failover.ElectionStrategy == config.ElectionStrategyPerRepository {
+		proxy.RegisterStreamHandlers(srv, "gitaly.RepositoryService", map[string]grpc.StreamHandler{
+			"RepositoryExists": RepositoryExistsHandler(rs),
+		})
+	}
+
 	return srv
 }
 
diff --git a/internal/praefect/server_test.go b/internal/praefect/server_test.go
index 4f95c1dee..275f21903 100644
--- a/internal/praefect/server_test.go
+++ b/internal/praefect/server_test.go
@@ -608,7 +608,7 @@ func TestRenameRepository(t *testing.T) {
 	repoPaths := make([]string, len(gitalyStorages))
 	praefectCfg := config.Config{
 		VirtualStorages: []*config.VirtualStorage{{Name: "praefect"}},
-		Failover:        config.Failover{Enabled: true},
+		Failover:        config.Failover{Enabled: true, ElectionStrategy: config.ElectionStrategyPerRepository},
 	}
 
 	var repo *gitalypb.Repository
@@ -644,7 +644,10 @@ func TestRenameRepository(t *testing.T) {
 	ctx, cancel := testhelper.Context()
 	defer cancel()
 
-	cc, _, cleanup := runPraefectServer(t, ctx, praefectCfg, buildOptions{withQueue: evq})
+	cc, _, cleanup := runPraefectServer(t, ctx, praefectCfg, buildOptions{
+		withQueue:     evq,
+		withRepoStore: datastore.NewPostgresRepositoryStore(glsql.NewDB(t), nil),
+	})
 	defer cleanup()
 
 	// virtualRepo is a virtual repository all requests to it would be applied to the underline Gitaly nodes behind it
diff --git a/internal/protoutil/extension.go b/internal/protoutil/extension.go
index 33a294716..9e2e9f9a0 100644
--- a/internal/protoutil/extension.go
+++ b/internal/protoutil/extension.go
@@ -21,9 +21,19 @@ func GetOpExtension(m *descriptorpb.MethodDescriptorProto) (*gitalypb.OperationM
 	return ext.(*gitalypb.OperationMsg), nil
 }
 
-// IsInterceptedService returns whether the serivce is intercepted by Praefect.
-func IsInterceptedService(s *descriptorpb.ServiceDescriptorProto) (bool, error) {
-	return getBoolExtension(s.GetOptions(), gitalypb.E_Intercepted)
+// IsInterceptedMethod returns whether the RPC method is intercepted by Praefect.
+func IsInterceptedMethod(s *descriptorpb.ServiceDescriptorProto, m *descriptorpb.MethodDescriptorProto) (bool, error) {
+	isServiceIntercepted, err := getBoolExtension(s.GetOptions(), gitalypb.E_Intercepted)
+	if err != nil {
+		return false, fmt.Errorf("is service intercepted: %w", err)
+	}
+
+	isMethodIntercepted, err := getBoolExtension(m.GetOptions(), gitalypb.E_InterceptedMethod)
+	if err != nil {
+		return false, fmt.Errorf("is method intercepted: %w", err)
+	}
+
+	return isServiceIntercepted || isMethodIntercepted, nil
 }
 
 // GetRepositoryExtension gets the repository extension from a field descriptor
diff --git a/proto/go/gitalypb/lint.pb.go b/proto/go/gitalypb/lint.pb.go
index b0c1343c7..cb57cecac 100644
--- a/proto/go/gitalypb/lint.pb.go
+++ b/proto/go/gitalypb/lint.pb.go
@@ -193,6 +193,14 @@ var file_lint_proto_extTypes = []protoimpl.ExtensionInfo{
 		Filename:      "lint.proto",
 	},
 	{
+		ExtendedType:  (*descriptorpb.MethodOptions)(nil),
+		ExtensionType: (*bool)(nil),
+		Field:         82304,
+		Name:          "gitaly.intercepted_method",
+		Tag:           "varint,82304,opt,name=intercepted_method",
+		Filename:      "lint.proto",
+	},
+	{
 		ExtendedType:  (*descriptorpb.FieldOptions)(nil),
 		ExtensionType: (*bool)(nil),
 		Field:         91233,
@@ -242,6 +250,11 @@ var (
 	//
 	// optional gitaly.OperationMsg op_type = 82303;
 	E_OpType = &file_lint_proto_extTypes[1]
+	// intercepted_method indicates whether the proxy intercepts and handles the method call
+	// instead of proxying. Intercepted methods do not require operation type annotations.
+	//
+	// optional bool intercepted_method = 82304;
+	E_InterceptedMethod = &file_lint_proto_extTypes[2]
 )
 
 // Extension fields to descriptorpb.FieldOptions.
@@ -249,7 +262,7 @@ var (
 	// Used to mark field containing name of affected storage.
 	//
 	// optional bool storage = 91233;
-	E_Storage = &file_lint_proto_extTypes[2] // Random high number..
+	E_Storage = &file_lint_proto_extTypes[3] // Random high number..
 	// If this operation modifies a repository, this annotations
 	// will specify the location of the Repository field within
 	// the request message.
@@ -258,15 +271,15 @@ var (
 	// when parent message is marked as target or additional repository
 	//
 	// optional bool repository = 91234;
-	E_Repository = &file_lint_proto_extTypes[3]
+	E_Repository = &file_lint_proto_extTypes[4]
 	// Used to mark target repository
 	//
 	// optional bool target_repository = 91235;
-	E_TargetRepository = &file_lint_proto_extTypes[4]
+	E_TargetRepository = &file_lint_proto_extTypes[5]
 	// Used to mark additional repository
 	//
 	// optional bool additional_repository = 91236;
-	E_AdditionalRepository = &file_lint_proto_extTypes[5]
+	E_AdditionalRepository = &file_lint_proto_extTypes[6]
 )
 
 var File_lint_proto protoreflect.FileDescriptor
@@ -299,29 +312,34 @@ var file_lint_proto_rawDesc = []byte{
 	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xff, 0x82,
 	0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2e, 0x4f,
 	0x70, 0x65, 0x72, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x4d, 0x73, 0x67, 0x52, 0x06, 0x6f, 0x70, 0x54,
-	0x79, 0x70, 0x65, 0x3a, 0x39, 0x0a, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12, 0x1d,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe1, 0xc8,
-	0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x3a, 0x3f,
-	0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e, 0x67,
-	0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46,
-	0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe2, 0xc8, 0x05, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x3a,
-	0x4c, 0x0a, 0x11, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69,
-	0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x73, 0x18, 0xe3, 0xc8, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x74, 0x61, 0x72,
-	0x67, 0x65, 0x74, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x3a, 0x54, 0x0a,
-	0x15, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x70, 0x6f,
-	0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe4, 0xc8, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14, 0x61,
-	0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74,
-	0x6f, 0x72, 0x79, 0x42, 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63, 0x6f,
-	0x6d, 0x2f, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2d, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69, 0x74,
-	0x61, 0x6c, 0x79, 0x2f, 0x76, 0x31, 0x34, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f,
-	0x2f, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x33,
+	0x79, 0x70, 0x65, 0x3a, 0x4f, 0x0a, 0x12, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74,
+	0x65, 0x64, 0x5f, 0x6d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x1e, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0x80, 0x83, 0x05, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x11, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x65, 0x64, 0x4d, 0x65,
+	0x74, 0x68, 0x6f, 0x64, 0x3a, 0x39, 0x0a, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x12,
+	0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
+	0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe1,
+	0xc8, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x07, 0x73, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x3a,
+	0x3f, 0x0a, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe2, 0xc8, 0x05,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x72, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79,
+	0x3a, 0x4c, 0x0a, 0x11, 0x74, 0x61, 0x72, 0x67, 0x65, 0x74, 0x5f, 0x72, 0x65, 0x70, 0x6f, 0x73,
+	0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe3, 0xc8, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x10, 0x74, 0x61,
+	0x72, 0x67, 0x65, 0x74, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x3a, 0x54,
+	0x0a, 0x15, 0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x5f, 0x72, 0x65, 0x70,
+	0x6f, 0x73, 0x69, 0x74, 0x6f, 0x72, 0x79, 0x12, 0x1d, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x46, 0x69, 0x65, 0x6c, 0x64, 0x4f,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x73, 0x18, 0xe4, 0xc8, 0x05, 0x20, 0x01, 0x28, 0x08, 0x52, 0x14,
+	0x61, 0x64, 0x64, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x61, 0x6c, 0x52, 0x65, 0x70, 0x6f, 0x73, 0x69,
+	0x74, 0x6f, 0x72, 0x79, 0x42, 0x34, 0x5a, 0x32, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63,
+	0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2d, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69,
+	0x74, 0x61, 0x6c, 0x79, 0x2f, 0x76, 0x31, 0x34, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67,
+	0x6f, 0x2f, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x70, 0x62, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -347,20 +365,21 @@ var file_lint_proto_goTypes = []interface{}{
 	(*descriptorpb.FieldOptions)(nil),   // 5: google.protobuf.FieldOptions
 }
 var file_lint_proto_depIdxs = []int32{
-	0, // 0: gitaly.OperationMsg.op:type_name -> gitaly.OperationMsg.Operation
-	1, // 1: gitaly.OperationMsg.scope_level:type_name -> gitaly.OperationMsg.Scope
-	3, // 2: gitaly.intercepted:extendee -> google.protobuf.ServiceOptions
-	4, // 3: gitaly.op_type:extendee -> google.protobuf.MethodOptions
-	5, // 4: gitaly.storage:extendee -> google.protobuf.FieldOptions
-	5, // 5: gitaly.repository:extendee -> google.protobuf.FieldOptions
-	5, // 6: gitaly.target_repository:extendee -> google.protobuf.FieldOptions
-	5, // 7: gitaly.additional_repository:extendee -> google.protobuf.FieldOptions
-	2, // 8: gitaly.op_type:type_name -> gitaly.OperationMsg
-	9, // [9:9] is the sub-list for method output_type
-	9, // [9:9] is the sub-list for method input_type
-	8, // [8:9] is the sub-list for extension type_name
-	2, // [2:8] is the sub-list for extension extendee
-	0, // [0:2] is the sub-list for field type_name
+	0,  // 0: gitaly.OperationMsg.op:type_name -> gitaly.OperationMsg.Operation
+	1,  // 1: gitaly.OperationMsg.scope_level:type_name -> gitaly.OperationMsg.Scope
+	3,  // 2: gitaly.intercepted:extendee -> google.protobuf.ServiceOptions
+	4,  // 3: gitaly.op_type:extendee -> google.protobuf.MethodOptions
+	4,  // 4: gitaly.intercepted_method:extendee -> google.protobuf.MethodOptions
+	5,  // 5: gitaly.storage:extendee -> google.protobuf.FieldOptions
+	5,  // 6: gitaly.repository:extendee -> google.protobuf.FieldOptions
+	5,  // 7: gitaly.target_repository:extendee -> google.protobuf.FieldOptions
+	5,  // 8: gitaly.additional_repository:extendee -> google.protobuf.FieldOptions
+	2,  // 9: gitaly.op_type:type_name -> gitaly.OperationMsg
+	10, // [10:10] is the sub-list for method output_type
+	10, // [10:10] is the sub-list for method input_type
+	9,  // [9:10] is the sub-list for extension type_name
+	2,  // [2:9] is the sub-list for extension extendee
+	0,  // [0:2] is the sub-list for field type_name
 }
 
 func init() { file_lint_proto_init() }
@@ -389,7 +408,7 @@ func file_lint_proto_init() {
 			RawDescriptor: file_lint_proto_rawDesc,
 			NumEnums:      2,
 			NumMessages:   1,
-			NumExtensions: 6,
+			NumExtensions: 7,
 			NumServices:   0,
 		},
 		GoTypes:           file_lint_proto_goTypes,
diff --git a/proto/go/gitalypb/protolist.go b/proto/go/gitalypb/protolist.go
index a15916f70..afb0510ae 100644
--- a/proto/go/gitalypb/protolist.go
+++ b/proto/go/gitalypb/protolist.go
@@ -9,6 +9,7 @@ var GitalyProtos = []string{
 	"commit.proto",
 	"conflicts.proto",
 	"diff.proto",
+	"errors.proto",
 	"hook.proto",
 	"internal.proto",
 	"lint.proto",
diff --git a/proto/go/internal/linter/lint.go b/proto/go/internal/linter/lint.go
index ea84fd34e..6d8ed34b6 100644
--- a/proto/go/internal/linter/lint.go
+++ b/proto/go/internal/linter/lint.go
@@ -52,8 +52,8 @@ func ensureMethodOpType(fileDesc *descriptorpb.FileDescriptorProto, m *descripto
 }
 
 func validateMethod(file *descriptorpb.FileDescriptorProto, service *descriptorpb.ServiceDescriptorProto, method *descriptorpb.MethodDescriptorProto, req *pluginpb.CodeGeneratorRequest) error {
-	if intercepted, err := protoutil.IsInterceptedService(service); err != nil {
-		return fmt.Errorf("is intercepted service: %w", err)
+	if intercepted, err := protoutil.IsInterceptedMethod(service, method); err != nil {
+		return fmt.Errorf("is intercepted method: %w", err)
 	} else if intercepted {
 		if _, err := protoutil.GetOpExtension(method); err != nil {
 			if errors.Is(err, protoregistry.NotFound) {
diff --git a/proto/go/internal/linter/lint_test.go b/proto/go/internal/linter/lint_test.go
index b6631cd0d..bbf868d20 100644
--- a/proto/go/internal/linter/lint_test.go
+++ b/proto/go/internal/linter/lint_test.go
@@ -38,6 +38,7 @@ func TestLintFile(t *testing.T) {
 				formatError("go/internal/linter/testdata/invalid.proto", "InvalidService", "InvalidMethod11", errors.New("unexpected count of storage field 1, expected 0, found storage label at: [RequestWithNestedStorageAndRepo.inner_message.storage_name]")),
 				formatError("go/internal/linter/testdata/invalid.proto", "InvalidService", "InvalidMethod13", errors.New("unexpected count of storage field 0, expected 1, found storage label at: []")),
 				formatError("go/internal/linter/testdata/invalid.proto", "InvalidService", "InvalidMethod14", errors.New("unexpected count of storage field 2, expected 1, found storage label at: [RequestWithMultipleNestedStorage.inner_message.storage_name RequestWithMultipleNestedStorage.storage_name]")),
+				formatError("go/internal/linter/testdata/invalid.proto", "InvalidService", "InvalidMethod15", errors.New("operation type defined on an intercepted method")),
 			},
 		},
 	} {
diff --git a/proto/go/internal/linter/testdata/invalid.pb.go b/proto/go/internal/linter/testdata/invalid.pb.go
index 97f9aa49d..cc379716f 100644
--- a/proto/go/internal/linter/testdata/invalid.pb.go
+++ b/proto/go/internal/linter/testdata/invalid.pb.go
@@ -828,7 +828,7 @@ var file_go_internal_linter_testdata_invalid_proto_rawDesc = []byte{
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x49, 0x6e, 0x76,
 	0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
 	0x73, 0x65, 0x22, 0x06, 0xfa, 0x97, 0x28, 0x02, 0x08, 0x02, 0x1a, 0x04, 0xf0, 0x97, 0x28, 0x01,
-	0x32, 0xfe, 0x08, 0x0a, 0x0e, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x53, 0x65, 0x72, 0x76,
+	0x32, 0xd9, 0x09, 0x0a, 0x0e, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x53, 0x65, 0x72, 0x76,
 	0x69, 0x63, 0x65, 0x12, 0x4b, 0x0a, 0x0e, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65,
 	0x74, 0x68, 0x6f, 0x64, 0x30, 0x12, 0x1a, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x49, 0x6e, 0x76,
 	0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
@@ -900,11 +900,17 @@ var file_go_internal_linter_testdata_invalid_proto_rawDesc = []byte{
 	0x74, 0x65, 0x64, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x1a, 0x1b, 0x2e, 0x74, 0x65, 0x73,
 	0x74, 0x2e, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52,
 	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xfa, 0x97, 0x28, 0x04, 0x08, 0x01, 0x10,
-	0x02, 0x42, 0x44, 0x5a, 0x42, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f,
-	0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2d, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69, 0x74, 0x61, 0x6c,
-	0x79, 0x2f, 0x76, 0x31, 0x34, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x69,
-	0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2f, 0x74,
-	0x65, 0x73, 0x74, 0x64, 0x61, 0x74, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x02, 0x12, 0x59, 0x0a, 0x0f, 0x49, 0x6e, 0x76, 0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x31, 0x35, 0x12, 0x1f, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x52, 0x65, 0x71, 0x75,
+	0x65, 0x73, 0x74, 0x57, 0x69, 0x74, 0x68, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x41, 0x6e,
+	0x64, 0x52, 0x65, 0x70, 0x6f, 0x1a, 0x1b, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x49, 0x6e, 0x76,
+	0x61, 0x6c, 0x69, 0x64, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x22, 0x08, 0x80, 0x98, 0x28, 0x01, 0xfa, 0x97, 0x28, 0x00, 0x42, 0x44, 0x5a, 0x42,
+	0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x6c, 0x61,
+	0x62, 0x2d, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2f, 0x76, 0x31, 0x34,
+	0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x2f, 0x6c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x64, 0x61,
+	0x74, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -964,22 +970,24 @@ var file_go_internal_linter_testdata_invalid_proto_depIdxs = []int32{
 	7,  // 22: test.InvalidService.InvalidMethod11:input_type -> test.RequestWithNestedStorageAndRepo
 	2,  // 23: test.InvalidService.InvalidMethod13:input_type -> test.InvalidTargetType
 	8,  // 24: test.InvalidService.InvalidMethod14:input_type -> test.RequestWithMultipleNestedStorage
-	3,  // 25: test.InterceptedWithOperationType.InvalidMethod:output_type -> test.InvalidMethodResponse
-	3,  // 26: test.InvalidService.InvalidMethod0:output_type -> test.InvalidMethodResponse
-	3,  // 27: test.InvalidService.InvalidMethod1:output_type -> test.InvalidMethodResponse
-	3,  // 28: test.InvalidService.InvalidMethod2:output_type -> test.InvalidMethodResponse
-	3,  // 29: test.InvalidService.InvalidMethod4:output_type -> test.InvalidMethodResponse
-	3,  // 30: test.InvalidService.InvalidMethod5:output_type -> test.InvalidMethodResponse
-	3,  // 31: test.InvalidService.InvalidMethod6:output_type -> test.InvalidMethodResponse
-	3,  // 32: test.InvalidService.InvalidMethod7:output_type -> test.InvalidMethodResponse
-	3,  // 33: test.InvalidService.InvalidMethod8:output_type -> test.InvalidMethodResponse
-	3,  // 34: test.InvalidService.InvalidMethod9:output_type -> test.InvalidMethodResponse
-	3,  // 35: test.InvalidService.InvalidMethod10:output_type -> test.InvalidMethodResponse
-	3,  // 36: test.InvalidService.InvalidMethod11:output_type -> test.InvalidMethodResponse
-	3,  // 37: test.InvalidService.InvalidMethod13:output_type -> test.InvalidMethodResponse
-	3,  // 38: test.InvalidService.InvalidMethod14:output_type -> test.InvalidMethodResponse
-	25, // [25:39] is the sub-list for method output_type
-	11, // [11:25] is the sub-list for method input_type
+	6,  // 25: test.InvalidService.InvalidMethod15:input_type -> test.RequestWithStorageAndRepo
+	3,  // 26: test.InterceptedWithOperationType.InvalidMethod:output_type -> test.InvalidMethodResponse
+	3,  // 27: test.InvalidService.InvalidMethod0:output_type -> test.InvalidMethodResponse
+	3,  // 28: test.InvalidService.InvalidMethod1:output_type -> test.InvalidMethodResponse
+	3,  // 29: test.InvalidService.InvalidMethod2:output_type -> test.InvalidMethodResponse
+	3,  // 30: test.InvalidService.InvalidMethod4:output_type -> test.InvalidMethodResponse
+	3,  // 31: test.InvalidService.InvalidMethod5:output_type -> test.InvalidMethodResponse
+	3,  // 32: test.InvalidService.InvalidMethod6:output_type -> test.InvalidMethodResponse
+	3,  // 33: test.InvalidService.InvalidMethod7:output_type -> test.InvalidMethodResponse
+	3,  // 34: test.InvalidService.InvalidMethod8:output_type -> test.InvalidMethodResponse
+	3,  // 35: test.InvalidService.InvalidMethod9:output_type -> test.InvalidMethodResponse
+	3,  // 36: test.InvalidService.InvalidMethod10:output_type -> test.InvalidMethodResponse
+	3,  // 37: test.InvalidService.InvalidMethod11:output_type -> test.InvalidMethodResponse
+	3,  // 38: test.InvalidService.InvalidMethod13:output_type -> test.InvalidMethodResponse
+	3,  // 39: test.InvalidService.InvalidMethod14:output_type -> test.InvalidMethodResponse
+	3,  // 40: test.InvalidService.InvalidMethod15:output_type -> test.InvalidMethodResponse
+	26, // [26:41] is the sub-list for method output_type
+	11, // [11:26] is the sub-list for method input_type
 	11, // [11:11] is the sub-list for extension type_name
 	11, // [11:11] is the sub-list for extension extendee
 	0,  // [0:11] is the sub-list for field type_name
diff --git a/proto/go/internal/linter/testdata/invalid.proto b/proto/go/internal/linter/testdata/invalid.proto
index 24490401c..a8c3ce54a 100644
--- a/proto/go/internal/linter/testdata/invalid.proto
+++ b/proto/go/internal/linter/testdata/invalid.proto
@@ -156,4 +156,10 @@ service InvalidService {
       scope_level: STORAGE
     };
   }
+
+  // Intercepted methods must not have operation type annotations.
+  rpc InvalidMethod15(RequestWithStorageAndRepo) returns (InvalidMethodResponse) {
+      option (gitaly.intercepted_method) = true;
+      option (gitaly.op_type) = {};
+  };
 }
diff --git a/proto/go/internal/linter/testdata/invalid_grpc.pb.go b/proto/go/internal/linter/testdata/invalid_grpc.pb.go
index 5955e41a6..2f109e568 100644
--- a/proto/go/internal/linter/testdata/invalid_grpc.pb.go
+++ b/proto/go/internal/linter/testdata/invalid_grpc.pb.go
@@ -133,6 +133,8 @@ type InvalidServiceClient interface {
 	InvalidMethod13(ctx context.Context, in *InvalidTargetType, opts ...grpc.CallOption) (*InvalidMethodResponse, error)
 	// should fail if multiple storage is specified for storage scoped RPC
 	InvalidMethod14(ctx context.Context, in *RequestWithMultipleNestedStorage, opts ...grpc.CallOption) (*InvalidMethodResponse, error)
+	// Intercepted methods must not have operation type annotations.
+	InvalidMethod15(ctx context.Context, in *RequestWithStorageAndRepo, opts ...grpc.CallOption) (*InvalidMethodResponse, error)
 }
 
 type invalidServiceClient struct {
@@ -260,6 +262,15 @@ func (c *invalidServiceClient) InvalidMethod14(ctx context.Context, in *RequestW
 	return out, nil
 }
 
+func (c *invalidServiceClient) InvalidMethod15(ctx context.Context, in *RequestWithStorageAndRepo, opts ...grpc.CallOption) (*InvalidMethodResponse, error) {
+	out := new(InvalidMethodResponse)
+	err := c.cc.Invoke(ctx, "/test.InvalidService/InvalidMethod15", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // InvalidServiceServer is the server API for InvalidService service.
 // All implementations must embed UnimplementedInvalidServiceServer
 // for forward compatibility
@@ -290,6 +301,8 @@ type InvalidServiceServer interface {
 	InvalidMethod13(context.Context, *InvalidTargetType) (*InvalidMethodResponse, error)
 	// should fail if multiple storage is specified for storage scoped RPC
 	InvalidMethod14(context.Context, *RequestWithMultipleNestedStorage) (*InvalidMethodResponse, error)
+	// Intercepted methods must not have operation type annotations.
+	InvalidMethod15(context.Context, *RequestWithStorageAndRepo) (*InvalidMethodResponse, error)
 	mustEmbedUnimplementedInvalidServiceServer()
 }
 
@@ -336,6 +349,9 @@ func (UnimplementedInvalidServiceServer) InvalidMethod13(context.Context, *Inval
 func (UnimplementedInvalidServiceServer) InvalidMethod14(context.Context, *RequestWithMultipleNestedStorage) (*InvalidMethodResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method InvalidMethod14 not implemented")
 }
+func (UnimplementedInvalidServiceServer) InvalidMethod15(context.Context, *RequestWithStorageAndRepo) (*InvalidMethodResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method InvalidMethod15 not implemented")
+}
 func (UnimplementedInvalidServiceServer) mustEmbedUnimplementedInvalidServiceServer() {}
 
 // UnsafeInvalidServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -583,6 +599,24 @@ func _InvalidService_InvalidMethod14_Handler(srv interface{}, ctx context.Contex
 	return interceptor(ctx, in, info, handler)
 }
 
+func _InvalidService_InvalidMethod15_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(RequestWithStorageAndRepo)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(InvalidServiceServer).InvalidMethod15(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/test.InvalidService/InvalidMethod15",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(InvalidServiceServer).InvalidMethod15(ctx, req.(*RequestWithStorageAndRepo))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // InvalidService_ServiceDesc is the grpc.ServiceDesc for InvalidService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -642,6 +676,10 @@ var InvalidService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "InvalidMethod14",
 			Handler:    _InvalidService_InvalidMethod14_Handler,
 		},
+		{
+			MethodName: "InvalidMethod15",
+			Handler:    _InvalidService_InvalidMethod15_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "go/internal/linter/testdata/invalid.proto",
diff --git a/proto/go/internal/linter/testdata/valid.pb.go b/proto/go/internal/linter/testdata/valid.pb.go
index 70cfd8344..b136201be 100644
--- a/proto/go/internal/linter/testdata/valid.pb.go
+++ b/proto/go/internal/linter/testdata/valid.pb.go
@@ -581,7 +581,7 @@ var file_go_internal_linter_testdata_valid_proto_rawDesc = []byte{
 	0x12, 0x12, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x1a, 0x13, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69,
 	0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x1a, 0x04, 0xf0, 0x97, 0x28, 0x01, 0x32,
-	0xc2, 0x04, 0x0a, 0x0c, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x88, 0x05, 0x0a, 0x0c, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x53, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
 	0x12, 0x3d, 0x0a, 0x0a, 0x54, 0x65, 0x73, 0x74, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x12,
 	0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x1a, 0x13, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x52,
@@ -617,12 +617,16 @@ var file_go_internal_linter_testdata_valid_proto_rawDesc = []byte{
 	0x64, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x4e, 0x65, 0x73, 0x74, 0x65, 0x64, 0x52, 0x65,
 	0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x13, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c,
 	0x69, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x08, 0xfa, 0x97, 0x28, 0x04,
-	0x08, 0x01, 0x10, 0x02, 0x42, 0x44, 0x5a, 0x42, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63,
-	0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2d, 0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69,
-	0x74, 0x61, 0x6c, 0x79, 0x2f, 0x76, 0x31, 0x34, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67,
-	0x6f, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x2f, 0x6c, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x64, 0x61, 0x74, 0x61, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x08, 0x01, 0x10, 0x02, 0x12, 0x44, 0x0a, 0x0c, 0x54, 0x65, 0x73, 0x74, 0x4d, 0x65, 0x74, 0x68,
+	0x6f, 0x64, 0x31, 0x30, 0x12, 0x19, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69,
+	0x64, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x13, 0x2e, 0x74, 0x65, 0x73, 0x74, 0x2e, 0x56, 0x61, 0x6c, 0x69, 0x64, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x04, 0x80, 0x98, 0x28, 0x01, 0x42, 0x44, 0x5a, 0x42, 0x67, 0x69,
+	0x74, 0x6c, 0x61, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x67, 0x69, 0x74, 0x6c, 0x61, 0x62, 0x2d,
+	0x6f, 0x72, 0x67, 0x2f, 0x67, 0x69, 0x74, 0x61, 0x6c, 0x79, 0x2f, 0x76, 0x31, 0x34, 0x2f, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x67, 0x6f, 0x2f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
+	0x2f, 0x6c, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x2f, 0x74, 0x65, 0x73, 0x74, 0x64, 0x61, 0x74, 0x61,
+	0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -670,17 +674,19 @@ var file_go_internal_linter_testdata_valid_proto_depIdxs = []int32{
 	7,  // 13: test.ValidService.TestMethod7:input_type -> test.ValidInnerNestedRequest
 	2,  // 14: test.ValidService.TestMethod8:input_type -> test.ValidStorageRequest
 	5,  // 15: test.ValidService.TestMethod9:input_type -> test.ValidStorageNestedRequest
-	3,  // 16: test.InterceptedService.TestMethod:output_type -> test.ValidResponse
-	3,  // 17: test.ValidService.TestMethod:output_type -> test.ValidResponse
-	3,  // 18: test.ValidService.TestMethod2:output_type -> test.ValidResponse
-	3,  // 19: test.ValidService.TestMethod3:output_type -> test.ValidResponse
-	3,  // 20: test.ValidService.TestMethod5:output_type -> test.ValidResponse
-	3,  // 21: test.ValidService.TestMethod6:output_type -> test.ValidResponse
-	3,  // 22: test.ValidService.TestMethod7:output_type -> test.ValidResponse
-	3,  // 23: test.ValidService.TestMethod8:output_type -> test.ValidResponse
-	3,  // 24: test.ValidService.TestMethod9:output_type -> test.ValidResponse
-	16, // [16:25] is the sub-list for method output_type
-	7,  // [7:16] is the sub-list for method input_type
+	2,  // 16: test.ValidService.TestMethod10:input_type -> test.ValidStorageRequest
+	3,  // 17: test.InterceptedService.TestMethod:output_type -> test.ValidResponse
+	3,  // 18: test.ValidService.TestMethod:output_type -> test.ValidResponse
+	3,  // 19: test.ValidService.TestMethod2:output_type -> test.ValidResponse
+	3,  // 20: test.ValidService.TestMethod3:output_type -> test.ValidResponse
+	3,  // 21: test.ValidService.TestMethod5:output_type -> test.ValidResponse
+	3,  // 22: test.ValidService.TestMethod6:output_type -> test.ValidResponse
+	3,  // 23: test.ValidService.TestMethod7:output_type -> test.ValidResponse
+	3,  // 24: test.ValidService.TestMethod8:output_type -> test.ValidResponse
+	3,  // 25: test.ValidService.TestMethod9:output_type -> test.ValidResponse
+	3,  // 26: test.ValidService.TestMethod10:output_type -> test.ValidResponse
+	17, // [17:27] is the sub-list for method output_type
+	7,  // [7:17] is the sub-list for method input_type
 	7,  // [7:7] is the sub-list for extension type_name
 	7,  // [7:7] is the sub-list for extension extendee
 	0,  // [0:7] is the sub-list for field type_name
diff --git a/proto/go/internal/linter/testdata/valid.proto b/proto/go/internal/linter/testdata/valid.proto
index eb77fdab4..0e3614792 100644
--- a/proto/go/internal/linter/testdata/valid.proto
+++ b/proto/go/internal/linter/testdata/valid.proto
@@ -107,4 +107,9 @@ service ValidService {
       scope_level: STORAGE
     };
   }
+
+  // Intercepted methods do not need operation type annotations.
+  rpc TestMethod10(ValidStorageRequest) returns (ValidResponse) {
+    option (gitaly.intercepted_method) = true;
+  }
 }
diff --git a/proto/go/internal/linter/testdata/valid_grpc.pb.go b/proto/go/internal/linter/testdata/valid_grpc.pb.go
index 9814297f4..d545af891 100644
--- a/proto/go/internal/linter/testdata/valid_grpc.pb.go
+++ b/proto/go/internal/linter/testdata/valid_grpc.pb.go
@@ -112,6 +112,8 @@ type ValidServiceClient interface {
 	TestMethod7(ctx context.Context, in *ValidInnerNestedRequest, opts ...grpc.CallOption) (*ValidResponse, error)
 	TestMethod8(ctx context.Context, in *ValidStorageRequest, opts ...grpc.CallOption) (*ValidResponse, error)
 	TestMethod9(ctx context.Context, in *ValidStorageNestedRequest, opts ...grpc.CallOption) (*ValidResponse, error)
+	// Intercepted methods do not need operation type annotations.
+	TestMethod10(ctx context.Context, in *ValidStorageRequest, opts ...grpc.CallOption) (*ValidResponse, error)
 }
 
 type validServiceClient struct {
@@ -194,6 +196,15 @@ func (c *validServiceClient) TestMethod9(ctx context.Context, in *ValidStorageNe
 	return out, nil
 }
 
+func (c *validServiceClient) TestMethod10(ctx context.Context, in *ValidStorageRequest, opts ...grpc.CallOption) (*ValidResponse, error) {
+	out := new(ValidResponse)
+	err := c.cc.Invoke(ctx, "/test.ValidService/TestMethod10", in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // ValidServiceServer is the server API for ValidService service.
 // All implementations must embed UnimplementedValidServiceServer
 // for forward compatibility
@@ -206,6 +217,8 @@ type ValidServiceServer interface {
 	TestMethod7(context.Context, *ValidInnerNestedRequest) (*ValidResponse, error)
 	TestMethod8(context.Context, *ValidStorageRequest) (*ValidResponse, error)
 	TestMethod9(context.Context, *ValidStorageNestedRequest) (*ValidResponse, error)
+	// Intercepted methods do not need operation type annotations.
+	TestMethod10(context.Context, *ValidStorageRequest) (*ValidResponse, error)
 	mustEmbedUnimplementedValidServiceServer()
 }
 
@@ -237,6 +250,9 @@ func (UnimplementedValidServiceServer) TestMethod8(context.Context, *ValidStorag
 func (UnimplementedValidServiceServer) TestMethod9(context.Context, *ValidStorageNestedRequest) (*ValidResponse, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method TestMethod9 not implemented")
 }
+func (UnimplementedValidServiceServer) TestMethod10(context.Context, *ValidStorageRequest) (*ValidResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method TestMethod10 not implemented")
+}
 func (UnimplementedValidServiceServer) mustEmbedUnimplementedValidServiceServer() {}
 
 // UnsafeValidServiceServer may be embedded to opt out of forward compatibility for this service.
@@ -394,6 +410,24 @@ func _ValidService_TestMethod9_Handler(srv interface{}, ctx context.Context, dec
 	return interceptor(ctx, in, info, handler)
 }
 
+func _ValidService_TestMethod10_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(ValidStorageRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(ValidServiceServer).TestMethod10(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: "/test.ValidService/TestMethod10",
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(ValidServiceServer).TestMethod10(ctx, req.(*ValidStorageRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // ValidService_ServiceDesc is the grpc.ServiceDesc for ValidService service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -433,6 +467,10 @@ var ValidService_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "TestMethod9",
 			Handler:    _ValidService_TestMethod9_Handler,
 		},
+		{
+			MethodName: "TestMethod10",
+			Handler:    _ValidService_TestMethod10_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "go/internal/linter/testdata/valid.proto",
diff --git a/proto/lint.proto b/proto/lint.proto
index ff7c21728..572cc6c7f 100644
--- a/proto/lint.proto
+++ b/proto/lint.proto
@@ -40,6 +40,9 @@ extend google.protobuf.ServiceOptions {
 extend google.protobuf.MethodOptions {
   // Random high number..
   OperationMsg op_type = 82303;
+  // intercepted_method indicates whether the proxy intercepts and handles the method call
+  // instead of proxying. Intercepted methods do not require operation type annotations.
+  bool intercepted_method = 82304;
 }
 
 extend google.protobuf.FieldOptions {