changes from ip to api key

Signed-off-by: Bruno Calza <brunoangelicalza@gmail.com>

cmd/api/config.go

@@ -51,7 +51,7 @@ type HTTPConfig struct {
 
 	RateLimInterval       string `default:"1s"`
 	MaxRequestPerInterval uint64 `default:"10"`
-	AllowList             string `default:""` // separated list of IPs (e.g. 127.0.0.1,192.168.0.1)
+	APIKey                string `default:""` // if client passes the key it will not be affected by rate limiter
 }
 
 // GatewayConfig contains configuration for the Gateway.

cmd/api/main.go

@@ -460,14 +460,12 @@ func createAPIServer(
 		return nil, fmt.Errorf("parsing http ratelimiter interval: %s", err)
 	}
 
-	allowList := strings.Split(httpConfig.AllowList, ",")
-
 	router, err := router.ConfiguredRouter(
 		g,
 		httpConfig.MaxRequestPerInterval,
 		rateLimInterval,
 		supportedChainIDs,
-		allowList,
+		httpConfig.APIKey,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("configuring router: %s", err)

docker/-w

@@ -0,0 +1,10 @@
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+Transfer-Encoding: chunked
+Connection: keep-alive
+Date: Wed, 26 Jul 2023 23:27:38 GMT
+Access-Control-Allow-Origin: *
+X-Kong-Upstream-Latency: 9924
+X-Kong-Proxy-Latency: 1
+Via: kong/3.0.2
+

docker/deployed/mainnet/api/config.json

@@ -4,7 +4,7 @@
         "Port": "8080",
         "RateLimInterval": "1s",
         "MaxRequestPerInterval": 10,
-        "AllowList" : "${HTTP_RATE_LIMITER_ALLOWLIST}", 
+        "ApiKey" : "${HTTP_RATE_LIMITER_API_KEY}", 
         "TLSCert": "${VALIDATOR_TLS_CERT}",
         "TLSKey": "${VALIDATOR_TLS_KEY}"
     },

docker/deployed/staging/api/config.json

@@ -3,7 +3,7 @@
     "Port": "8080",
     "RateLimInterval": "1s",
     "MaxRequestPerInterval": 10,
-    "AllowList" : "${HTTP_RATE_LIMITER_ALLOWLIST}", 
+    "ApiKey" : "${HTTP_RATE_LIMITER_API_KEY}", 
     "TLSCert": "${VALIDATOR_TLS_CERT}",
     "TLSKey": "${VALIDATOR_TLS_KEY}"
   },

docker/deployed/testnet/api/config.json

@@ -4,7 +4,7 @@
         "Port": "8080",
         "RateLimInterval": "1s",
         "MaxRequestPerInterval": 10,
-        "AllowList" : "${HTTP_RATE_LIMITER_ALLOWLIST}", 
+        "ApiKey" : "${HTTP_RATE_LIMITER_API_KEY}", 
         "TLSCert": "${VALIDATOR_TLS_CERT}",
         "TLSKey": "${VALIDATOR_TLS_KEY}"
     },

internal/router/middlewares/ratelim.go

@@ -22,9 +22,9 @@ type RateLimiterConfig struct {
 // RateLimiterRouteConfig specifies the maximum request per interval, and
 // interval length for a rate limiting rule.
 type RateLimiterRouteConfig struct {
-	MaxRPI    uint64
-	Interval  time.Duration
-	AllowList []string
+	MaxRPI   uint64
+	Interval time.Duration
+	APIKey   string
 }
 
 // RateLimitController creates a new middleware to rate limit requests.
@@ -60,9 +60,9 @@ func createRateLimiter(cfg RateLimiterRouteConfig, kf httplimit.KeyFunc) (*middl
 	}
 
 	return &middleware{
-		store:     defaultStore,
-		keyFunc:   kf,
-		allowlist: cfg.AllowList,
+		store:   defaultStore,
+		keyFunc: kf,
+		apiKey:  cfg.APIKey,
 	}, nil
 }
 
@@ -86,8 +86,8 @@ type middleware struct {
 	store   limiter.Store
 	keyFunc httplimit.KeyFunc
 
-	// list of ip addresses not affected by rate limiter
-	allowlist []string
+	// clients with key are not affected by rate limiter
+	apiKey string
 }
 
 // Handle returns the HTTP handler as a middleware. This handler calls Take() on
@@ -106,9 +106,9 @@ func (m *middleware) Handle(next http.Handler) http.Handler {
 			return
 		}
 
-		// skip rate limiting checks if key is in allowlist
-		for _, ip := range m.allowlist {
-			if strings.EqualFold(key, ip) {
+		// skip rate limiting checks if secret key is provided
+		if key := r.Header.Get("Secret-Key"); key != "" && m.apiKey != "" {
+			if strings.EqualFold(key, m.apiKey) {
 				next.ServeHTTP(w, r)
 				return
 			}

internal/router/middlewares/ratelim_test.go

@@ -31,7 +31,7 @@ func TestLimit1IP(t *testing.T) {
 		{name: "block-me", callRPS: 1000, limitRPS: 500, forwardedFor: false},
 
 		{name: "allow-me", callRPS: 1000, limitRPS: 500, forwardedFor: false, allow: true},
-		{name: "forwareded-allow-me", callRPS: 1000, limitRPS: 500, forwardedFor: true, allow: true},
+		{name: "forwarded-allow-me", callRPS: 1000, limitRPS: 500, forwardedFor: true, allow: true},
 	}
 
 	for _, tc := range tests {
@@ -58,7 +58,8 @@ func TestLimit1IP(t *testing.T) {
 				}
 
 				if tc.allow {
-					cfg.Default.AllowList = []string{ip}
+					r.Header.Set("Secret-Key", "MYSECRETKEY")
+					cfg.Default.APIKey = "MYSECRETKEY"
 				}
 
 				rlcm, err := RateLimitController(cfg)

internal/router/router.go

@@ -19,17 +19,17 @@ func ConfiguredRouter(
 	maxRPI uint64,
 	rateLimInterval time.Duration,
 	supportedChainIDs []tableland.ChainID,
-	allowList []string,
+	apiKey string,
 ) (*Router, error) {
 	// General router configuration.
 	router := newRouter()
 	router.use(middlewares.CORS, middlewares.TraceID)
 
 	cfg := middlewares.RateLimiterConfig{
 		Default: middlewares.RateLimiterRouteConfig{
-			MaxRPI:    maxRPI,
-			Interval:  rateLimInterval,
-			AllowList: allowList,
+			MaxRPI:   maxRPI,
+			Interval: rateLimInterval,
+			APIKey:   apiKey,
 		},
 	}
 	rateLim, err := middlewares.RateLimitController(cfg)

tests/fullstack/fullstack.go

@@ -131,7 +131,7 @@ func CreateFullStack(t *testing.T, deps Deps) FullStack {
 		require.NoError(t, err)
 	}
 
-	router, err := router.ConfiguredRouter(gatewayService, 10, time.Second, []tableland.ChainID{ChainID}, []string{})
+	router, err := router.ConfiguredRouter(gatewayService, 10, time.Second, []tableland.ChainID{ChainID}, "")
 	require.NoError(t, err)
 
 	server := httptest.NewServer(router.Handler())