From eddc9ee9af0ba35c0e7e2626a6f88328bb925de1 Mon Sep 17 00:00:00 2001 From: Paolo Di Tommaso Date: Thu, 12 Dec 2024 18:57:49 +0100 Subject: [PATCH] User email as rate limiter key Signed-off-by: Paolo Di Tommaso --- .../wave/controller/ContainerController.groovy | 2 +- .../wave/controller/RegistryProxyController.groovy | 2 +- .../io/seqera/wave/ratelimit/AcquireRequest.groovy | 2 +- .../wave/ratelimit/impl/SpillwayRateLimiter.groovy | 12 ++++++------ .../builder/impl/ContainerBuildServiceImpl.groovy | 2 +- .../groovy/io/seqera/wave/tower/PlatformId.groovy | 4 ++++ .../io/seqera/wave/tower/PlatformIdTest.groovy | 3 ++- 7 files changed, 16 insertions(+), 11 deletions(-) diff --git a/src/main/groovy/io/seqera/wave/controller/ContainerController.groovy b/src/main/groovy/io/seqera/wave/controller/ContainerController.groovy index a65568c40..0286dc5f2 100644 --- a/src/main/groovy/io/seqera/wave/controller/ContainerController.groovy +++ b/src/main/groovy/io/seqera/wave/controller/ContainerController.groovy @@ -265,7 +265,7 @@ class ContainerController { final ip = addressResolver.resolve(httpRequest) // check the rate limit before continuing if( rateLimiterService ) - rateLimiterService.acquirePull(new AcquireRequest(identity.userId as String, ip)) + rateLimiterService.acquirePull(new AcquireRequest(identity.userEmail, ip)) // create request data final data = makeRequestData(req, identity, ip) final token = containerService.computeToken(data) diff --git a/src/main/groovy/io/seqera/wave/controller/RegistryProxyController.groovy b/src/main/groovy/io/seqera/wave/controller/RegistryProxyController.groovy index 263763299..634e7cad3 100644 --- a/src/main/groovy/io/seqera/wave/controller/RegistryProxyController.groovy +++ b/src/main/groovy/io/seqera/wave/controller/RegistryProxyController.groovy @@ -123,7 +123,7 @@ class RegistryProxyController { if( route.manifest && route.digest ){ String ip = addressResolver.resolve(httpRequest) - rateLimiterService?.acquirePull( new AcquireRequest(route.identity.userId as String, ip) ) + rateLimiterService?.acquirePull( new AcquireRequest(route.identity.userEmail, ip) ) } // check if it's a container under build diff --git a/src/main/groovy/io/seqera/wave/ratelimit/AcquireRequest.groovy b/src/main/groovy/io/seqera/wave/ratelimit/AcquireRequest.groovy index 5404af93f..ae6354245 100644 --- a/src/main/groovy/io/seqera/wave/ratelimit/AcquireRequest.groovy +++ b/src/main/groovy/io/seqera/wave/ratelimit/AcquireRequest.groovy @@ -35,7 +35,7 @@ class AcquireRequest { /** * Principal key to use in the search. Can be null */ - String userId + String user /** * Secondary key to use if principal is not present diff --git a/src/main/groovy/io/seqera/wave/ratelimit/impl/SpillwayRateLimiter.groovy b/src/main/groovy/io/seqera/wave/ratelimit/impl/SpillwayRateLimiter.groovy index e2c9eab60..83ee12bc3 100644 --- a/src/main/groovy/io/seqera/wave/ratelimit/impl/SpillwayRateLimiter.groovy +++ b/src/main/groovy/io/seqera/wave/ratelimit/impl/SpillwayRateLimiter.groovy @@ -68,20 +68,20 @@ class SpillwayRateLimiter implements RateLimiterService { @Override void acquireBuild(AcquireRequest request) throws SlowDownException { - Spillway resource = request.userId ? authsBuilds : anonymousBuilds - String key = request.userId ?: request.ip + Spillway resource = request.user ? authsBuilds : anonymousBuilds + String key = request.user ?: request.ip if (!resource.tryCall(key)) { - final prefix = request.userId ? 'user' : 'IP' + final prefix = request.user ? 'user' : 'IP' throw new SlowDownException("Request exceeded build rate limit for $prefix $key") } } @Override void acquirePull(AcquireRequest request) throws SlowDownException { - Spillway resource = request.userId ? authsPulls : anonymousPulls - String key = request.userId ?: request.ip + Spillway resource = request.user ? authsPulls : anonymousPulls + String key = request.user ?: request.ip if (!resource.tryCall(key)) { - final prefix = request.userId ? 'user' : 'IP' + final prefix = request.user ? 'user' : 'IP' throw new SlowDownException("Request exceeded pull rate limit for $prefix $key") } } diff --git a/src/main/groovy/io/seqera/wave/service/builder/impl/ContainerBuildServiceImpl.groovy b/src/main/groovy/io/seqera/wave/service/builder/impl/ContainerBuildServiceImpl.groovy index 895a90210..63793b1f8 100644 --- a/src/main/groovy/io/seqera/wave/service/builder/impl/ContainerBuildServiceImpl.groovy +++ b/src/main/groovy/io/seqera/wave/service/builder/impl/ContainerBuildServiceImpl.groovy @@ -198,7 +198,7 @@ class ContainerBuildServiceImpl implements ContainerBuildService, JobHandler