Documentation
¶
Index ¶
- Constants
- func ContextWithRateLimit(ctx context.Context, rps int) context.Context
- func GetKeyID(ctx context.Context) string
- func GetTenantID(ctx context.Context) string
- func IdleWriteDeadline(d time.Duration) func(http.Handler) http.Handler
- func WriteDeadline(d time.Duration) func(http.Handler) http.Handler
- type AuthCacheInvalidator
- type GlobalRateLimiter
- type IdempotencyStore
- type InflightLimiter
- type RateLimiter
Constants ¶
const KeyIDKey contextKey = "key_id"
const TenantIDKey contextKey = "tenant_id"
Variables ¶
This section is empty.
Functions ¶
func ContextWithRateLimit ¶
ContextWithRateLimit carries a tenant's api_rate_limit (requests/second) from auth to the rate limiter. Values <= 0 mean "use the default".
func GetKeyID ¶
GetKeyID returns the API key ID from the request context. Returns "" if no key ID is present (e.g. unauthenticated request).
func GetTenantID ¶
func IdleWriteDeadline ¶
IdleWriteDeadline is for long/streaming routes. No deadline applies while the handler is working (exec may run minutes before writing); once it writes, each Write/Flush gets a fresh deadline of d, so a reader that makes no progress for d is cut off while a steadily progressing stream is not.
Types ¶
type AuthCacheInvalidator ¶
type AuthCacheInvalidator struct {
// contains filtered or unexported fields
}
AuthCacheInvalidator allows callers to evict entries from the auth cache when keys are revoked or tenants are suspended.
func (*AuthCacheInvalidator) InvalidateKey ¶
func (a *AuthCacheInvalidator) InvalidateKey(keyID string)
InvalidateKey removes a single key from the auth cache.
func (*AuthCacheInvalidator) InvalidateTenant ¶
func (a *AuthCacheInvalidator) InvalidateTenant(tenantID string)
InvalidateTenant removes all cached keys belonging to the given tenant.
type GlobalRateLimiter ¶
type GlobalRateLimiter struct {
// contains filtered or unexported fields
}
GlobalRateLimiter enforces a single rate limit across all tenants to prevent multi-tenant aggregate abuse (e.g., attacker creating many tenants to multiply throughput).
func NewGlobalRateLimiter ¶
func NewGlobalRateLimiter(rps float64, burst int) *GlobalRateLimiter
func (*GlobalRateLimiter) Middleware ¶
func (gl *GlobalRateLimiter) Middleware(next http.Handler) http.Handler
type IdempotencyStore ¶
type IdempotencyStore struct {
// contains filtered or unexported fields
}
func NewIdempotencyStore ¶
func NewIdempotencyStore() *IdempotencyStore
func (*IdempotencyStore) Middleware ¶
func (s *IdempotencyStore) Middleware(next http.Handler) http.Handler
type InflightLimiter ¶
type InflightLimiter struct {
// contains filtered or unexported fields
}
InflightLimiter caps concurrent requests per tenant. It is meant for long-lived routes (exec, log follow, provisioning) so one tenant cannot occupy every slot of a shared pool.
func NewInflightLimiter ¶
func NewInflightLimiter(max int) *InflightLimiter
func (*InflightLimiter) Middleware ¶
func (il *InflightLimiter) Middleware(next http.Handler) http.Handler
type RateLimiter ¶
type RateLimiter struct {
// contains filtered or unexported fields
}
func NewRateLimiter ¶
func NewRateLimiter(rps float64, burst int) *RateLimiter
func (*RateLimiter) Middleware ¶
func (rl *RateLimiter) Middleware(next http.Handler) http.Handler
Source Files