gitlab-labkit 5.2.0 → 5.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 851e45a85816195a05e296d1d133dc187ead27af652de5fc1e80d47c180573b7
-  data.tar.gz: d23febee701ab99ddd7ebe16556ab9e51720df1136bbb015dd90bc8134336fa6
+  metadata.gz: 6a73e80c74e6f2578a9a86a5ad9c76c3c3c9ff4afc8c1deea262408763e84588
+  data.tar.gz: e7e1d625f3c634a04fd9a6aea0036270966c3b3a6e924edfebfd56713ede00ef
 SHA512:
-  metadata.gz: 9cffffdb5dea4360d98eefe0de1d3fed636cf8eef173952a0d5aa3c961e71741138eb600cc9e4711f24cd693d268369eb739357d70cf30a71f5e4a7d52c49a2e
-  data.tar.gz: 78b9e58851cb08944e2def719b9959ea3c62be1e27db9b0ddfb3a9ffa1bec2b7261e3750a8b24f3d3c4d7383dd7b537e3105a69b68537b17a29afd523c2ce9f0
+  metadata.gz: 77d32a2075415b452d10b1b01a4ef3679d46bbaacd1bef798ce2b17b0b0109a9ec26565f8065600df41f1090752ae311b5a90fadfd434b4e39025d57dcf2f46f
+  data.tar.gz: c8e099df23ea1312476d3d1301044f5de159b6ed25098d755b47df2b7653b8958a9f30c778d5742620c4d804255ac31250f7834e090981803e54d26f4ab6f67b

data/lib/labkit/rate_limit/README.md

@@ -171,8 +171,8 @@ A `Rule` is a `Data.define` value object with the following fields:
 |-------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `name`            | Stable identifier used in Redis keys and metric labels. Must match `/\A[a-z0-9_]+\z/`, max 64 chars. Renaming a rule abandons its in-flight counters.                |
 | `match`           | Hash of identifier key/value predicates that must **all** be satisfied for the rule to apply. Empty hash matches anything. See [Matchers](#matchers).                |
-| `limit`           | Integer request threshold per `period`. May be a callable resolved on every check.                                                                                   |
-| `period`          | Window length in seconds. May be a callable resolved on every check.                                                                                                 |
+| `limit`           | Integer request threshold per `period`, at least 1. May be a callable resolved on every check.                                                                       |
+| `period`          | Window length in seconds, at least 1; a fraction truncates to whole seconds. May be a callable resolved on every check.                                              |
 | `action`          | What the rule does when it matches. One of `:limit`, `:log`, `:skip`. Default `:limit`. See [Actions](#actions).                                                     |
 | `characteristics` | Array of identifier keys whose values are folded into the Redis counter key. Each unique combination gets its own counter.                                           |
 | `count_distinct`  | Optional identifier key. When set, the rule counts distinct values seen for that key within the window, backed by a Redis SET rather than a counter. Must not overlap `characteristics`. |
@@ -190,6 +190,13 @@ Labkit::RateLimit::Rule.new(
 )
 ```
 
+`Rule.new` raises `ArgumentError` for a static `limit` under 1 or a static
+`period` under one second, except on `:skip` rules where both are inert.
+Callables are not validated: a `limit` resolving to `0` blocks every matching
+request, which is how to express "deny all" dynamically, and a `period`
+resolving under one second reaches `EXPIRE` as `0` and deletes the counter on
+every write.
+
 ### Matchers
 
 A `match` hash gates whether a rule applies. Each value is normalised through

data/lib/labkit/rate_limit/rule.rb

@@ -10,8 +10,8 @@ module Labkit
     # name            - stable identifier used in Redis keys and log entries
     # match           - hash of identifier key/value pairs that must all match for
     #                   the rule to apply; empty hash matches any identifier
-    # limit           - request threshold; may be a callable (resolved per check)
-    # period          - window in seconds; may be a callable (resolved per check)
+    # limit           - request threshold, at least 1; may be a callable (resolved per check)
+    # period          - window in seconds, at least 1; may be a callable (resolved per check)
     # action          - :limit (enforce; the result blocks when the rule is over
     #                   its limit, which also terminates evaluation), :log (count
     #                   and log only, never blocks and never terminates),
@@ -56,6 +56,16 @@ module Labkit
         raise ArgumentError, "ban_for must be a Numeric of at least 1 second or a callable, got #{value.inspect}"
       end
 
+      # A static limit under 1 blocks every request, and a period under a second
+      # reaches EXPIRE as 0, deleting the counter on every write. A :skip rule
+      # counts nothing, and a callable may still resolve to 0 to mean "deny all".
+      def self.normalize_numeric(field, value, action_sym)
+        return value if action_sym == :skip || value.respond_to?(:call)
+        return value if value.is_a?(Numeric) && value >= 1
+
+        raise ArgumentError, "#{field} must be a Numeric of at least 1 or a callable, got #{value.inspect}"
+      end
+
       def self.normalize_count_distinct(value, characteristics_arr)
         sym =
           case value
@@ -94,8 +104,8 @@ module Labkit
         super(
           name: name_str.freeze,
           match: match.transform_keys(&:to_sym).transform_values { |v| Matcher.build(v) }.freeze,
-          limit: limit,
-          period: period,
+          limit: self.class.normalize_numeric(:limit, limit, action_sym),
+          period: self.class.normalize_numeric(:period, period, action_sym),
           action: action_sym,
           characteristics: characteristics_arr,
           count_distinct: count_distinct_sym,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-labkit
 version: !ruby/object:Gem::Version
-  version: 5.2.0
+  version: 5.2.1
 platform: ruby
 authors:
 - Andrew Newdigate