gitlab-labkit 1.19.0 → 1.20.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb897d7171414d685d81aa2d55930e9633a46ac6aee0bdca4f36ed34b38e307e
-  data.tar.gz: bd171795616da76cf4262da0f70d6a4e3746bea4e5eab74b3fe554d3597a0c87
+  metadata.gz: 3b916b3579ca06fa9a40b34d2bac1d9ffb5bcb8a51415ad9438956c546400164
+  data.tar.gz: a680e485958792ac93e5be3fca0c7598db2c029349d6c7aa3c34a039daf2e350
 SHA512:
-  metadata.gz: 4d4174c89606b5949876451b31bdb40a76db573284ed5976afe9806eb33ac592e90d425cb8c3c48412756be9a7db777cfdb00f14649601ff8d0bcc05807bc8c9
-  data.tar.gz: b46236e5b3f59f97cd371f250c397553c32656a51994b556ae43fa4751b2eeb95c5b5bdbc3276d5ad156c861df7f7ff4f39ec93bd3826c854dbfff975fc77602
+  metadata.gz: 53acf37dbe0f4416c5952dfba12e3df3156f233243c69580bb3dfdef6b9727f73d586151a9809225e9a99d537e2499da4f66061c197462debc76d3b3c633160a
+  data.tar.gz: bd46d460f292290670b62801a5cb84958b187e086b662d9537df95d0ddc9af6bc1c956050d051a4c14383209b07923fbcfab0992d59c689a5c794811de0a43a2

data/lib/labkit/fields.rb

@@ -142,7 +142,7 @@ module Labkit
         Fields::HTTP_STATUS_CODE => %w[status_code extra.status status_text http_status],
         Fields::HTTP_URL => %w[req_url],
         Fields::DURATION_S => %w[duration duration_ms elapsed_time actual_duration time_ms total_time gitaly.duration],
-        Fields::REMOTE_IP => %w[ip source_ip ip_address meta.remote_ip],
+        Fields::REMOTE_IP => %w[ip source_ip ip_address],
         Fields::HTTP_HOST => %w[hostname request_host gitlab_host kubernetes.host],
         Fields::GL_PROJECT_ID => %w[extra.project_id meta.project_id meta.search.project_id job_project_id target_project_id],
         Fields::GL_PIPELINE_ID => %w[extra.pipeline_id meta.pipeline_id root_pipeline_id],

data/lib/labkit/rate_limit/evaluator.rb

@@ -42,21 +42,26 @@ module Labkit
 
       private
 
+      # :log rules are non-terminating: they emit metrics and continue,
+      # so a shadow :log rule cannot disable a following :block rule.
       def check_rules(identifier)
         @rules.each do |rule|
           next unless rule_matches?(rule, identifier)
 
           result = evaluate_rule(rule, identifier)
           report_matched_metrics(result)
-          return result
+          return result unless rule.action == :log
         end
 
         report_unmatched_metrics
         Result.new(matched: false, action: :allow)
       end
 
+      # Mirror of check_rules without metrics: peek skips :log rules (their state
+      # is unobservable through peek).
       def peek_rules(identifier)
         @rules.each do |rule|
+          next if rule.action == :log
           next unless rule_matches?(rule, identifier)
 
           return peek_rule(rule, identifier)

data/lib/labkit/rate_limit/metrics.rb

@@ -5,6 +5,9 @@ module Labkit
     module Metrics
       module_function
 
+      # :log rules are non-terminating: a check that matched only :log rules
+      # increments calls_total once per matched :log rule AND once with
+      # rule="unmatched", action="allow", since no terminating decision was made.
       def calls_total
         Labkit::Metrics::Client.counter(
           :gitlab_labkit_rate_limiter_calls_total,

data/lib/labkit/rate_limit/result.rb

@@ -8,9 +8,9 @@ module Labkit
     # action    - the outcome: what the caller should do
     #             :block = rule matched, exceeded, rule configured to block
     #             :log   = rule matched, exceeded, rule configured to log only
-    #             :allow = rule matched but count within limit, or
+    #             :allow = rule matched but count within limit, rule configured to allow,
     #                      no rule matched, or error (fail-open)
-    #             The rule's configured action is available via rule.action
+    #             The rule's configured action is available via rule.action.
     # rule      - the matched Rule object (nil when matched? is false)
     # error?    - true if Redis was unavailable; result fails open (exceeded? is false)
     # info      - Result::Info with per-window counters; nil when matched? is false or error?

data/lib/labkit/rate_limit/rule.rb

@@ -2,7 +2,7 @@
 
 module Labkit
   module RateLimit
-    KNOWN_ACTIONS = [:block, :log].freeze
+    KNOWN_ACTIONS = %i[block log allow].freeze
     RULE_NAME_PATTERN = /\A[a-z0-9_]+\z/
     RULE_NAME_MAX_LENGTH = 64
 
@@ -12,7 +12,9 @@ module Labkit
     #                   the rule to apply; empty hash matches any identifier
     # limit           - request threshold; may be a callable (resolved per check)
     # period          - window in seconds; may be a callable (resolved per check)
-    # action          - :block (enforce) or :log (count and log, but do not block)
+    # action          - :block (enforce), :log (count and log only, do not block,
+    #                   evaluation continues to subsequent rules), or :allow
+    #                   (bypass: short-circuit evaluation with no Redis writes)
     # characteristics - identifier keys used to build the compound Redis counter key
     #
     # +name+ must be a lowercase alphanumeric-and-underscore string of at most 64

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 1.19.0
+  version: 1.20.1
 platform: ruby
 authors:
 - Andrew Newdigate