@digitraffic/common 2024.5.13-1 → 2024.6.14-1

package/dist/__test__/infra/acl-builder.test.mjs

@@ -1,5 +1,6 @@
 import { AclBuilder } from "../../aws/infra/acl-builder.mjs";
 import { App, Stack } from "aws-cdk-lib";
+import { expect } from "@jest/globals";
 describe("acl-builder tests", () => {
     function createBuilder() {
         const app = new App();
@@ -21,5 +22,28 @@ describe("acl-builder tests", () => {
         const acl = createBuilder().withIpRestrictionRule(["1.2.3.4", "1.2.6.6"]).build();
         expect(acl.rules).toHaveLength(1);
     });
+    test("throttle rules", () => {
+        for (const aclBuilder of [
+            createBuilder().withThrottleDigitrafficUserIp(100),
+            createBuilder().withThrottleDigitrafficUserIpAndUriPath(100),
+            createBuilder().withThrottleAnonymousUserIp(100),
+            createBuilder().withThrottleAnonymousUserIpAndUriPath(100)
+        ]) {
+            const acl = aclBuilder.build();
+            // Check that the rule exists and a custom response is defined
+            expect(acl.rules).toHaveLength(1);
+            expect(Object.keys(acl.customResponseBodies)).toHaveLength(1);
+            // Check that the rule does throttle
+            const throttleRule = acl.rules[0];
+            expect(throttleRule.statement.rateBasedStatement).toBeDefined();
+            expect(throttleRule.action.block).toBeDefined();
+        }
+    });
+    test("Cannot define two rules with the same name", () => {
+        expect(() => createBuilder()
+            .withThrottleAnonymousUserIp(10)
+            .withThrottleAnonymousUserIp(200)
+            .build()).toThrow();
+    });
 });
 //# sourceMappingURL=acl-builder.test.mjs.map

package/dist/aws/infra/acl-builder.d.mts

@@ -13,9 +13,19 @@ export declare class AclBuilder {
     readonly _rules: CfnWebACL.RuleProperty[];
     _scope: string;
     _name: string;
+    _customResponseBodies: Record<string, CfnWebACL.CustomResponseBodyProperty>;
     constructor(construct: Construct);
     isRuleDefined(rules: AWSManagedWafRule[] | "all", rule: AWSManagedWafRule): boolean;
     withAWSManagedRules(rules?: AWSManagedWafRule[] | "all"): AclBuilder;
     withIpRestrictionRule(addresses: string[]): AclBuilder;
+    withThrottleRule(name: string, priority: number, limit: number, customResponseBodyKey: string, isHeaderRequired: boolean, isBasedOnIpAndUriPath: boolean): AclBuilder;
+    withCustomResponseBody(key: string, customResponseBody: CfnWebACL.CustomResponseBodyProperty): this;
+    withThrottleDigitrafficUserIp(limit: number): AclBuilder;
+    withThrottleDigitrafficUserIpAndUriPath(limit: number): AclBuilder;
+    withThrottleAnonymousUserIp(limit: number): AclBuilder;
+    withThrottleAnonymousUserIpAndUriPath(limit: number): AclBuilder;
+    _isCustomResponseBodyKeySet(key: string): boolean;
+    _addThrottleResponseBody(customResponseBodyKey: string, limit: number): void;
+    _logMissingLimit(method: string): void;
     build(): CfnWebACL;
 }

package/dist/aws/infra/acl-builder.mjs

@@ -1,4 +1,5 @@
 import { CfnIPSet, CfnWebACL } from "aws-cdk-lib/aws-wafv2";
+import { logger } from "../runtime/dt-logger-default.mjs";
 /**
  * Builder class for building CfnWebACL.
  *
@@ -11,6 +12,7 @@ export class AclBuilder {
     _rules = [];
     _scope = "CLOUDFRONT";
     _name = "WebACL";
+    _customResponseBodies = {};
     constructor(construct) {
         this._construct = construct;
     }
@@ -55,10 +57,98 @@ export class AclBuilder {
         });
         return this;
     }
+    withThrottleRule(name, priority, limit, customResponseBodyKey, isHeaderRequired, isBasedOnIpAndUriPath) {
+        this._rules.push({
+            name,
+            priority,
+            visibilityConfig: {
+                sampledRequestsEnabled: true,
+                cloudWatchMetricsEnabled: true,
+                metricName: name
+            },
+            action: {
+                block: {
+                    customResponse: {
+                        responseCode: 429,
+                        customResponseBodyKey
+                    }
+                }
+            },
+            statement: createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath)
+        });
+        return this;
+    }
+    withCustomResponseBody(key, customResponseBody) {
+        if (key in this._customResponseBodies) {
+            logger.warn({
+                method: "acl-builder.withCustomResponseBody",
+                message: `Overriding custom response body with key ${key}`
+            });
+        }
+        this._customResponseBodies[key] = customResponseBody;
+        return this;
+    }
+    withThrottleDigitrafficUserIp(limit) {
+        if (limit == null) {
+            this._logMissingLimit("withThrottleDigitrafficUserIp");
+            return this;
+        }
+        const customResponseBodyKey = `IP_THROTTLE_DIGITRAFFIC_USER_${limit}`;
+        this._addThrottleResponseBody(customResponseBodyKey, limit);
+        return this.withThrottleRule("ThrottleRuleWithDigitrafficUser", 1, limit, customResponseBodyKey, true, false);
+    }
+    withThrottleDigitrafficUserIpAndUriPath(limit) {
+        if (limit == null) {
+            this._logMissingLimit("withThrottleDigitrafficUserIpAndUriPath");
+            return this;
+        }
+        const customResponseBodyKey = `IP_PATH_THROTTLE_DIGITRAFFIC_USER_${limit}`;
+        this._addThrottleResponseBody(customResponseBodyKey, limit);
+        return this.withThrottleRule("ThrottleRuleIPQueryWithDigitrafficUser", 2, limit, customResponseBodyKey, true, true);
+    }
+    withThrottleAnonymousUserIp(limit) {
+        if (limit == null) {
+            this._logMissingLimit("withThrottleAnonymousUserIp");
+            return this;
+        }
+        const customResponseBodyKey = `IP_THROTTLE_ANONYMOUS_USER_${limit}`;
+        this._addThrottleResponseBody(customResponseBodyKey, limit);
+        return this.withThrottleRule("ThrottleRuleWithAnonymousUser", 3, limit, customResponseBodyKey, false, false);
+    }
+    withThrottleAnonymousUserIpAndUriPath(limit) {
+        if (limit == null) {
+            this._logMissingLimit("withThrottleAnonymousUserIpAndUriPath");
+            return this;
+        }
+        const customResponseBodyKey = `IP_PATH_THROTTLE_ANONYMOUS_USER_${limit}`;
+        this._addThrottleResponseBody(customResponseBodyKey, limit);
+        return this.withThrottleRule("ThrottleRuleIPQueryWithAnonymousUser", 4, limit, customResponseBodyKey, false, true);
+    }
+    _isCustomResponseBodyKeySet(key) {
+        return key in this._customResponseBodies;
+    }
+    _addThrottleResponseBody(customResponseBodyKey, limit) {
+        if (!this._isCustomResponseBodyKeySet(customResponseBodyKey)) {
+            this.withCustomResponseBody(customResponseBodyKey, {
+                content: `Request rate is limited to ${limit} requests in a 5 minute window.`,
+                contentType: "TEXT_PLAIN"
+            });
+        }
+    }
+    _logMissingLimit(method) {
+        logger.warn({
+            method: `acl-builder.${method}`,
+            message: `'limit' was not defined. Not setting a throttle rule`
+        });
+    }
     build() {
         if (this._rules.length === 0) {
             throw new Error("No rules defined for WebACL");
         }
+        const uniqueRuleNames = new Set(this._rules.map(rule => rule.name));
+        if (uniqueRuleNames.size != this._rules.length) {
+            throw new Error("Tried to create an Access Control List with multiple rules having the same name");
+        }
         const acl = new CfnWebACL(this._construct, this._name, {
             defaultAction: { allow: {} },
             scope: this._scope,
@@ -68,11 +158,75 @@ export class AclBuilder {
                 sampledRequestsEnabled: false
             },
             rules: this._rules,
-            //            customResponseBodies
+            customResponseBodies: this._customResponseBodies,
         });
         return acl;
     }
 }
+const CUSTOM_KEYS_IP_AND_URI_PATH = [
+    {
+        uriPath: {
+            textTransformations: [
+                {
+                    priority: 1,
+                    type: "LOWERCASE"
+                },
+                {
+                    priority: 2,
+                    type: "NORMALIZE_PATH"
+                },
+                {
+                    priority: 3,
+                    type: "MD5"
+                }
+            ]
+        }
+    },
+    {
+        ip: {}
+    }
+];
+function notStatement(statement) {
+    return {
+        notStatement: {
+            statement
+        }
+    };
+}
+function createThrottleStatement(limit, isHeaderRequired, isBasedOnIpAndUriPath) {
+    // this statement matches empty digitraffic-user -header
+    const matchStatement = {
+        sizeConstraintStatement: {
+            comparisonOperator: isHeaderRequired ? "GT" : "GE",
+            fieldToMatch: {
+                singleHeader: {
+                    Name: "digitraffic-user"
+                }
+            },
+            textTransformations: [{ priority: 0, type: "NONE" }],
+            size: 0
+        }
+    };
+    // header present       -> size > 0
+    // header not present   -> NOT(size >= 0)
+    if (isBasedOnIpAndUriPath) {
+        return {
+            rateBasedStatement: {
+                aggregateKeyType: "CUSTOM_KEYS",
+                customKeys: CUSTOM_KEYS_IP_AND_URI_PATH,
+                limit: limit,
+                scopeDownStatement: isHeaderRequired ? matchStatement : notStatement(matchStatement)
+            }
+        };
+    }
+    return {
+        rateBasedStatement: {
+            aggregateKeyType: "IP",
+            limit: limit,
+            scopeDownStatement: isHeaderRequired ? matchStatement : notStatement(matchStatement)
+        }
+    };
+}
 function createAWSCommonRuleSet() {
     return createRuleProperty("AWS-AWSManagedRulesCommonRuleSet", 70, {
         statement: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@digitraffic/common",
-  "version": "2024.05.13-1",
+  "version": "2024.06.14-1",
   "description": "",
   "type": "module",
   "repository": {