gitlab-labkit 1.13.0 → 1.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8db8c324d6fe60ad1b16ab51dd87207d4a5d08e1d83ad99a3ae900392bd0739c
-  data.tar.gz: 4487ae2ff2bacac400f753c92012cd7b118525f0bed143794ca4fd12c14cca53
+  metadata.gz: 5840ade4baa1fb379ae82748354a74571d6806e529c205010139846489f50579
+  data.tar.gz: 802528c013a130b2925b19760a29e8d7c33aa9c042ed3a024ac0dc9bb8fa6127
 SHA512:
-  metadata.gz: 7292067a1a5d8e231776b65b381ba161a2123c6363df5ebd4269ae65b596871ebddb5bd610e5ab33da0939cdeab4639a51bcb2636046cfd8cb941ac6f6baa9bb
-  data.tar.gz: 771b7fded81f969ee414ef737b74fa9c22d620762f0e56c669e89de9c4ebf6c022fdbf91513fe630a580acfc8408d20a0eb55e3f05e0c97c412ab6ab818a75bf
+  metadata.gz: 9e3b44e0271effb09c593dc582cd69221c3f83b255535d5fd456033f22f6f933fe9c15e8a204d8868fa20644838bdfbf17578d151eb9fe906a731b650bbb1902
+  data.tar.gz: 98483520ad13fbfe52edd39ce6c879ea86b6240cdbf16e8deb9254abfce4d1e825029560119f79d76254efac3d97228ce35243cba21b3f269a32ec6f55612a36

data/lib/gitlab-labkit.rb

@@ -5,6 +5,12 @@
 # infrastructural concerns, partcularly related to
 # observability.
 module Labkit
+  class << self
+    def dev_or_test?
+      %w[development test].include?(ENV.fetch("RAILS_ENV", nil))
+    end
+  end
+
   autoload :System, "labkit/system"
 
   autoload :Context, "labkit/context"

data/lib/labkit/rate_limit/configuration.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Labkit
+  module RateLimit
+    class Configuration
+      attr_accessor :redis, :logger
+    end
+  end
+end

data/lib/labkit/rate_limit/evaluator.rb

@@ -1,123 +1,78 @@
 # frozen_string_literal: true
 
 require "openssl"
-require "labkit/logging/json_logger"
 
 module Labkit
   module RateLimit
-    # Evaluator contains the core rule-matching + Redis counter logic.
+    # Evaluator holds the static parts of a rate limit check (name, rules, Redis)
+    # and exposes a per-request #check(identifier) method.
+    # @api private
     class Evaluator
-      KNOWN_CHARACTERISTICS = [:user, :ip, :namespace, :plan, :endpoint].freeze
-      KNOWN_ACTIONS = [:block, :log].freeze
       REDIS_KEY_PREFIX = "labkit:rl"
       CHAR_VALUE_MAX_LENGTH = 200
-      UNKNOWN_SENTINEL = "unknown_characteristic"
-      CALL_SITE_PATTERN = /\A[a-z0-9_]+\z/
-
-      def initialize(call_site:, identifier:, rules:, redis:, logger: nil)
-        @call_site = call_site
-        @identifier = identifier
-        @rules = rules
-        @redis = redis
-        @logger = logger || build_default_logger
+      MISSING_VALUE_SENTINEL = "_unknown_"
+
+      def initialize(name:, rules:, redis:, logger:)
+        @name   = name
+        @rules  = rules
+        @redis  = redis
+        @logger = logger
       end
 
-      def evaluate
-        validate_call_site!
-        evaluate_rules
-      rescue ArgumentError
-        raise
+      def check(identifier)
+        check_rules(identifier)
       rescue StandardError => e
         # Intentionally broad: fail-open applies to any unexpected error (network,
-        # timeout, OOM, etc.), not only Redis protocol errors.
-        log_evaluate_error(e)
-        :allow
+        # timeout, OOM) not only Redis protocol errors.
+        log_error(e, identifier)
+        Result.new(matched: false, error: true)
       end
 
       private
 
-      def evaluate_rules
-        aggregate = :allow
-
-        @rules.each_with_index do |rule, index|
-          next unless rule_matches?(rule, @identifier)
+      def check_rules(identifier)
+        @rules.each do |rule|
+          next unless rule_matches?(rule, identifier)
 
-          result = evaluate_rule(rule, index)
-          aggregate = :block if result == :block
+          return evaluate_rule(rule, identifier)
         end
 
-        aggregate
-      end
-
-      def validate_call_site!
-        return if CALL_SITE_PATTERN.match?(@call_site)
-
-        raise ArgumentError, "Invalid call_site: #{@call_site.inspect}. Must match /\\A[a-z0-9_]+\\z/" if dev_or_test?
-
-        sanitized = @call_site.gsub(/[^a-z0-9_]/, "_")
-        @logger.warn(
-          message: "rate_limit_invalid_call_site",
-          call_site: @call_site,
-          sanitized: sanitized
-        )
-        @call_site = sanitized
+        Result.new(matched: false)
       end
 
       def rule_matches?(rule, identifier)
-        rule.match.all? do |key, value|
-          identifier[key] == value
-        end
+        rule.match.all? { |key, value| identifier[key] == value }
       end
 
-      def evaluate_rule(rule, index)
-        exceeded = false
-
-        rule.characteristics.each do |char|
-          char_value = resolve_characteristic(char, @identifier)
-
-          if char_value.nil?
-            log_skipped_characteristic(rule, index, char)
-            next
-          end
+      def evaluate_rule(rule, identifier)
+        redis_key = build_redis_key(rule, identifier)
+        resolved_limit = Integer(resolve_value(rule.limit))
+        resolved_period = Integer(resolve_value(rule.period))
 
-          redis_key = build_redis_key(@call_site, index, char, char_value)
-
-          count = incr_with_ttl(redis_key, rule.period)
-          rule_exceeded = count > rule.limit
-
-          exceeded = true if rule_exceeded
-
-          log_rule(rule, index, count, redis_key, rule_exceeded)
-        end
+        count = incr_with_ttl(redis_key, resolved_period)
+        exceeded = count > resolved_limit
 
-        exceeded && rule.action == :block ? :block : :allow
+        Result.new(matched: true, exceeded: exceeded, action: rule.action, rule: rule)
       end
 
-      def resolve_characteristic(char, identifier)
-        unless KNOWN_CHARACTERISTICS.include?(char)
-          raise ArgumentError, "Unknown characteristic: #{char.inspect}. Known: #{KNOWN_CHARACTERISTICS.inspect}" if dev_or_test?
-
-          @logger.warn(
-            message: "rate_limit_unknown_characteristic",
-            characteristic: char
-          )
-          return UNKNOWN_SENTINEL
+      def build_redis_key(rule, identifier)
+        key = "#{REDIS_KEY_PREFIX}:#{@name}:#{rule.name}"
+        rule.characteristics.each do |char|
+          value = resolve_char_value(char, identifier)
+          key += ":#{char}:#{encode_char_value(value)}"
         end
+        key
+      end
 
+      def resolve_char_value(char, identifier)
         value = identifier[char]
-
-        # Normalize endpoint: strip query string
-        value = Identifier.normalize_endpoint(value) if char == :endpoint
-
-        # Treat nil and empty-string the same: anonymous traffic must not collide on a shared bucket.
-        return nil if value.nil? || value.to_s.empty?
+        return MISSING_VALUE_SENTINEL if value.nil? || value.to_s.empty?
 
         value.to_s
       end
 
-      def build_redis_key(call_site, rule_index, char, char_value)
-        safe_value = encode_char_value(char_value.to_s)
-        "#{REDIS_KEY_PREFIX}:#{call_site}:#{rule_index}:#{char}:#{safe_value}"
+      def resolve_value(val)
+        val.respond_to?(:call) ? val.call : val
       end
 
       def encode_char_value(value)
@@ -135,57 +90,14 @@ module Labkit
         count
       end
 
-      def log_rule(rule, index, count, redis_key, exceeded)
-        @logger.info(
-          message: "rate_limit_check",
-          call_site: @call_site,
-          rule_index: index,
-          action: rule.action.to_s,
-          limit: rule.limit,
-          period: rule.period,
-          count: count,
-          matched: true,
-          exceeded: exceeded,
-          identifier: @identifier.to_h,
-          redis_key: redis_key
-        )
-      end
-
-      def log_skipped_characteristic(rule, index, char)
-        @logger.info(
-          message: "rate_limit_check",
-          call_site: @call_site,
-          rule_index: index,
-          action: rule.action.to_s,
-          limit: rule.limit,
-          period: rule.period,
-          characteristic: char,
-          matched: true,
-          skipped: true,
-          identifier: @identifier.to_h
-        )
-      end
-
-      def log_evaluate_error(error)
+      def log_error(error, identifier)
         @logger.warn(
-          message: "rate_limit_redis_error",
-          call_site: @call_site,
+          message: "rate_limit_error",
+          name: @name,
           error: error.class.to_s,
-          result: "allow"
+          identifier: identifier&.to_h
         )
       end
-
-      def dev_or_test?
-        # Memoized: ENV access is not free under concurrency.
-        return @dev_or_test unless @dev_or_test.nil?
-
-        env = ENV.fetch("LABKIT_ENV", nil)
-        @dev_or_test = env == "test" || env == "development"
-      end
-
-      def build_default_logger
-        Labkit::Logging::JsonLogger.new($stdout)
-      end
     end
   end
 end

data/lib/labkit/rate_limit/identifier.rb

@@ -4,6 +4,7 @@ module Labkit
   module RateLimit
     # Identifier is a value object wrapping a hash of key-value pairs that
     # describe the caller (e.g. user, ip, endpoint).
+    # Endpoint values are normalised at construction time (query string stripped).
     class Identifier
       # Normalize an endpoint value: strip query string.
       def self.normalize_endpoint(value)
@@ -15,7 +16,9 @@ module Labkit
       attr_reader :attributes
 
       def initialize(attributes = {})
-        @attributes = attributes.transform_keys(&:to_sym).freeze
+        normalised = attributes.transform_keys(&:to_sym)
+        normalised[:endpoint] = self.class.normalize_endpoint(normalised[:endpoint]) if normalised.key?(:endpoint)
+        @attributes = normalised.freeze
       end
 
       # Return the value for a characteristic key.

data/lib/labkit/rate_limit/limiter.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+require "labkit/logging/json_logger"
+
+module Labkit
+  module RateLimit
+    # Limiter is the primary public API for rate limiting.
+    # Instantiate once per call site (e.g. at application boot), then call
+    # #check(identifier) on every request. The internal Evaluator is reused
+    # across calls, avoiding per-request object allocation.
+    #
+    # @example
+    #   limiter = Labkit::RateLimit::Limiter.new(
+    #     name: "rack_request",
+    #     rules: [Labkit::RateLimit::Rule.new(name: "api_user", limit: 100, period: 60, characteristics: [:user])]
+    #   )
+    #   result = limiter.check({ user: 42, ip: "1.2.3.4" })
+    #   render_429 if result.exceeded? && result.action == :block
+    class Limiter
+      NAME_PATTERN = /\A[a-z0-9_]+\z/
+
+      def initialize(name:, rules:, redis: nil, logger: nil)
+        @logger = logger || RateLimit.config.logger || Labkit::Logging::JsonLogger.new($stdout)
+        validated_name = validate_name!(name)
+        @name = validated_name
+
+        @evaluator = Evaluator.new(
+          name: validated_name,
+          rules: prepare_rules(rules),
+          redis: redis || RateLimit.config.redis,
+          logger: @logger
+        )
+      end
+
+      # @param identifier [Identifier, Hash] caller attributes for this request
+      # @return [Result]
+      def check(identifier)
+        id = identifier.is_a?(Identifier) ? identifier : Identifier.new(identifier)
+        result = @evaluator.check(id)
+
+        if result.exceeded? && result.action == :block
+          @logger.warn(
+            message: "rate_limit_check",
+            name: @name,
+            rule_name: result.rule.name,
+            exceeded: true,
+            severity: "WARN"
+          )
+        end
+
+        result
+      end
+
+      private
+
+      def validate_name!(name)
+        raise ArgumentError, "name must be a non-empty String" unless name.is_a?(String) && !name.empty?
+        return name if NAME_PATTERN.match?(name)
+
+        raise ArgumentError, "Invalid name: #{name.inspect}. Must match /\\A[a-z0-9_]+\\z/" if Labkit.dev_or_test?
+
+        sanitized = name.gsub(/[^a-z0-9_]/, "_")
+        @logger.warn(message: "rate_limit_invalid_name", name: name, sanitized: sanitized)
+        sanitized
+      end
+
+      # Validates and deduplicates rule names before passing rules to Evaluator.
+      # In dev/test: raises on invalid format or duplicate names.
+      # In production: sanitizes invalid names (WARN) and drops duplicates (WARN, first wins).
+      # Returns an array of rules with sanitized names.
+      def prepare_rules(rules)
+        seen = {}
+        rules.each_with_index.filter_map do |rule, idx|
+          sanitized = sanitize_rule_name(rule.name)
+
+          if seen.key?(sanitized)
+            raise ArgumentError, "Duplicate rule name #{sanitized.inspect} at index #{idx}" if Labkit.dev_or_test?
+
+            @logger.warn(
+              message: "rate_limit_duplicate_rule_name",
+              name: sanitized,
+              dropped_occurrence: idx
+            )
+            next nil
+          end
+
+          seen[sanitized] = true
+          sanitized == rule.name ? rule : rule.with(name: sanitized) # rubocop:disable CodeReuse/ActiveRecord
+        end
+      end
+
+      def sanitize_rule_name(name)
+        s = name.to_s
+        return s if RULE_NAME_PATTERN.match?(s) && s.length <= RULE_NAME_MAX_LENGTH
+
+        sanitized = s.downcase.gsub(/[^a-z0-9_]/, "_")[0, RULE_NAME_MAX_LENGTH]
+        sanitized = "unnamed_rule" if sanitized.empty?
+        @logger.warn(
+          message: "rate_limit_invalid_rule_name",
+          original_name: s,
+          sanitized_name: sanitized
+        )
+        sanitized
+      end
+    end
+  end
+end

data/lib/labkit/rate_limit/result.rb

@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Labkit
+  module RateLimit
+    # Result is the return value of Limiter#check.
+    # matched?  - true if a rule's match conditions were satisfied
+    # exceeded? - true if the matched rule's counter exceeded its limit
+    # action    - :block or :log (nil when matched? is false)
+    # rule      - the matched Rule object (nil when matched? is false)
+    # error?    - true if Redis was unavailable; result fails open (exceeded? is false)
+    Result = Data.define(:matched, :exceeded, :action, :rule, :error) do
+      def initialize(matched:, exceeded: false, action: nil, rule: nil, error: false)
+        super
+      end
+
+      def matched?
+        matched
+      end
+
+      def exceeded?
+        exceeded
+      end
+
+      def error?
+        error
+      end
+    end
+  end
+end

data/lib/labkit/rate_limit/rule.rb

@@ -2,14 +2,43 @@
 
 module Labkit
   module RateLimit
+    KNOWN_ACTIONS = [:block, :log].freeze
+    RULE_NAME_PATTERN = /\A[a-z0-9_]+\z/
+    RULE_NAME_MAX_LENGTH = 64
+
     # Rule is a value object describing a single rate limit rule.
-    Rule = Data.define(:match, :limit, :period, :action, :characteristics) do
-      def initialize(limit:, period:, characteristics:, match: {}, action: :block)
+    # name            - stable identifier used in Redis keys and log entries
+    # match           - hash of identifier key/value pairs that must all match for
+    #                   the rule to apply; empty hash matches any identifier
+    # limit           - request threshold; may be a callable (resolved per check)
+    # period          - window in seconds; may be a callable (resolved per check)
+    # action          - :block (enforce) or :log (count and log, but do not block)
+    # characteristics - identifier keys used to build the compound Redis counter key
+    #
+    # +name+ must be a lowercase alphanumeric-and-underscore string of at most 64
+    # characters. It is used as the middle segment of every Redis counter key for
+    # this rule, so changing a rule's name mid-window abandons its in-flight counters.
+    Rule = Data.define(:name, :match, :limit, :period, :action, :characteristics) do
+      def initialize(name:, limit:, period:, characteristics:, match: {}, action: :block)
+        raise ArgumentError, "name must be a String or Symbol, got #{name.class}" unless name.is_a?(String) || name.is_a?(Symbol)
+
+        name_str = name.to_s
+        raise ArgumentError, "name must not be empty" if name_str.empty?
+
+        action_sym = action.to_sym
+        raise ArgumentError, "Invalid action: #{action.inspect}. Must be one of: #{KNOWN_ACTIONS.inspect}" unless KNOWN_ACTIONS.include?(action_sym)
+
+        if Labkit.dev_or_test?
+          raise ArgumentError, "Invalid rule name: #{name.inspect}. Must match /\\A[a-z0-9_]+\\z/" unless RULE_NAME_PATTERN.match?(name_str)
+          raise ArgumentError, "Rule name too long: #{name.inspect}. Maximum 64 characters" if name_str.length > RULE_NAME_MAX_LENGTH
+        end
+
         super(
+          name: name_str.freeze,
           match: match.transform_keys(&:to_sym).freeze,
           limit: limit,
           period: period,
-          action: action.to_sym,
+          action: action_sym,
           characteristics: Array(characteristics).map(&:to_sym).freeze
         )
       end

data/lib/labkit/rate_limit.rb

@@ -1,34 +1,50 @@
 # frozen_string_literal: true
 
 module Labkit
-  # RateLimit provides a simple rules-based rate limiting API backed by Redis counters.
+  # RateLimit provides a rules-based rate limiting API backed by Redis counters.
+  # Primary usage: instantiate a Limiter once per call site and reuse it.
+  #
+  # @example Configuration (e.g. in a Rails initializer)
+  #   Labkit::RateLimit.configure do |c|
+  #     c.redis  = Redis.current
+  #     c.logger = Labkit::Logging::JsonLogger.new($stdout)
+  #   end
+  #
+  # @example Per-call-site setup
+  #   RACK_LIMITER = Labkit::RateLimit::Limiter.new(
+  #     name: "rack_request",
+  #     rules: [...]
+  #   )
+  #   result = RACK_LIMITER.check(identifier)
   module RateLimit
+    autoload :Configuration, "labkit/rate_limit/configuration"
     autoload :Identifier, "labkit/rate_limit/identifier"
+    autoload :Result, "labkit/rate_limit/result"
     autoload :Rule, "labkit/rate_limit/rule"
     autoload :Evaluator, "labkit/rate_limit/evaluator"
+    autoload :Limiter, "labkit/rate_limit/limiter"
 
-    # Defined independently to avoid forcing eager load of Evaluator at module load time.
-    # Must stay in sync with Evaluator::KNOWN_CHARACTERISTICS.
-    KNOWN_CHARACTERISTICS = [:user, :ip, :namespace, :plan, :endpoint].freeze
+    class << self
+      def configure
+        yield config
+      end
 
-    # Check whether the given call_site + identifier combination is within the
-    # configured rules.
-    #
-    # @param call_site [String] machine-readable name of the call site
-    # @param identifier [Identifier, Hash] caller attributes
-    # @param rules [Array<Rule>] ordered list of rate limit rules
-    # @param redis [Object] Redis client (must respond to #incr and #expire)
-    # @param logger [Logger, nil] optional logger override
-    # @return [:allow, :block]
-    def self.check(call_site:, identifier:, rules:, redis:, logger: nil)
-      id = identifier.is_a?(Identifier) ? identifier : Identifier.new(identifier)
-      Evaluator.new(
-        call_site: call_site,
-        identifier: id,
-        rules: rules,
-        redis: redis,
-        logger: logger
-      ).evaluate
+      def config
+        @config ||= Configuration.new
+      end
+
+      # Convenience wrapper - creates a throw-away Limiter.
+      # Prefer Limiter for call sites that can cache the object.
+      #
+      # @param name [String] call site name
+      # @param identifier [Identifier, Hash] caller attributes
+      # @param rules [Array<Rule>] ordered list of rules (first match wins)
+      # @param redis [Object, nil] Redis client; falls back to config.redis
+      # @param logger [Logger, nil] logger; falls back to config.logger
+      # @return [Result]
+      def check(name:, identifier:, rules:, redis: nil, logger: nil)
+        Limiter.new(name: name, rules: rules, redis: redis, logger: logger).check(identifier)
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 1.13.0
+  version: 1.15.0
 platform: ruby
 authors:
 - Andrew Newdigate
@@ -599,8 +599,11 @@ files:
 - lib/labkit/middleware/sidekiq/user_experience_sli/server.rb
 - lib/labkit/net_http_publisher.rb
 - lib/labkit/rate_limit.rb
+- lib/labkit/rate_limit/configuration.rb
 - lib/labkit/rate_limit/evaluator.rb
 - lib/labkit/rate_limit/identifier.rb
+- lib/labkit/rate_limit/limiter.rb
+- lib/labkit/rate_limit/result.rb
 - lib/labkit/rate_limit/rule.rb
 - lib/labkit/rspec/README.md
 - lib/labkit/rspec/matchers.rb