emilsoftware-utilities 2.0.0-dev.66 → 2.0.0-dev.68

package/dist/openapi/OpenApiMerge.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mergeOpenApiDocuments = mergeOpenApiDocuments;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cloneDocument(document) {
+    return JSON.parse(JSON.stringify(document));
+}
+function sameValue(left, right) {
+    return JSON.stringify(left) === JSON.stringify(right);
+}
+function mergeRecord(target, source, policy, section) {
+    if (!source)
+        return target;
+    const merged = Object.assign({}, (target !== null && target !== void 0 ? target : {}));
+    for (const [key, value] of Object.entries(source)) {
+        if (!(key in merged)) {
+            merged[key] = value;
+            continue;
+        }
+        if (sameValue(merged[key], value))
+            continue;
+        if (policy === "keep")
+            continue;
+        if (policy === "overwrite") {
+            merged[key] = value;
+            continue;
+        }
+        throw new Error(`Conflitto OpenAPI in ${section}.${key}.`);
+    }
+    return merged;
+}
+function mergeTags(target, source, policy) {
+    if (!Array.isArray(target) || !Array.isArray(source))
+        return target !== null && target !== void 0 ? target : source;
+    const merged = [...target];
+    for (const tag of source) {
+        if (!isRecord(tag) || typeof tag.name !== "string") {
+            merged.push(tag);
+            continue;
+        }
+        const existingIndex = merged.findIndex((candidate) => isRecord(candidate) && candidate.name === tag.name);
+        if (existingIndex < 0) {
+            merged.push(tag);
+            continue;
+        }
+        const existing = merged[existingIndex];
+        if (sameValue(existing, tag))
+            continue;
+        if (policy === "keep")
+            continue;
+        if (policy === "overwrite") {
+            merged[existingIndex] = tag;
+            continue;
+        }
+        throw new Error(`Conflitto OpenAPI nel tag "${tag.name}".`);
+    }
+    return merged;
+}
+function mergeServers(target, source, policy) {
+    if (!Array.isArray(target) || !Array.isArray(source))
+        return target !== null && target !== void 0 ? target : source;
+    const merged = [...target];
+    for (const server of source) {
+        if (!isRecord(server) || typeof server.url !== "string") {
+            merged.push(server);
+            continue;
+        }
+        const existingIndex = merged.findIndex((candidate) => isRecord(candidate) && candidate.url === server.url);
+        if (existingIndex < 0) {
+            merged.push(server);
+            continue;
+        }
+        const existing = merged[existingIndex];
+        if (sameValue(existing, server))
+            continue;
+        if (policy === "keep")
+            continue;
+        if (policy === "overwrite") {
+            merged[existingIndex] = server;
+            continue;
+        }
+        throw new Error(`Conflitto OpenAPI nel server "${server.url}".`);
+    }
+    return merged;
+}
+/**
+ * Unisce il documento Accessi nel documento OpenAPI dell'host.
+ *
+ * Per default un conflitto su path, schema o security scheme produce errore:
+ * e meglio accorgersi subito di due contratti incompatibili. Usare
+ * `conflict: "overwrite"` solo quando il documento host deve vincere.
+ */
+function mergeOpenApiDocuments(target, source, options = {}) {
+    var _a;
+    if (!target || !source) {
+        throw new Error("mergeOpenApiDocuments richiede due documenti OpenAPI validi.");
+    }
+    const policy = (_a = options.conflict) !== null && _a !== void 0 ? _a : "error";
+    const result = cloneDocument(target);
+    const sourceDocument = source;
+    result.paths = mergeRecord(isRecord(result.paths) ? result.paths : undefined, isRecord(sourceDocument.paths) ? sourceDocument.paths : undefined, policy, "paths");
+    const targetComponents = isRecord(result.components) ? result.components : {};
+    const sourceComponents = isRecord(sourceDocument.components) ? sourceDocument.components : {};
+    const componentSections = new Set([
+        ...Object.keys(targetComponents),
+        ...Object.keys(sourceComponents),
+    ]);
+    const mergedComponents = Object.assign({}, targetComponents);
+    for (const section of componentSections) {
+        mergedComponents[section] = mergeRecord(isRecord(targetComponents[section]) ? targetComponents[section] : undefined, isRecord(sourceComponents[section]) ? sourceComponents[section] : undefined, policy, `components.${section}`);
+    }
+    result.components = mergedComponents;
+    result.tags = mergeTags(result.tags, sourceDocument.tags, policy);
+    result.servers = mergeServers(result.servers, sourceDocument.servers, policy);
+    return result;
+}
+//# sourceMappingURL=OpenApiMerge.js.map

package/dist/openapi/OpenApiMerge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"OpenApiMerge.js","sourceRoot":"","sources":["../../src/openapi/OpenApiMerge.ts"],"names":[],"mappings":";;AAqHA,sDAyCC;AApJD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,aAAa,CAAC,QAAuB;IAC5C,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAA4B,CAAC;AACzE,CAAC;AAED,SAAS,SAAS,CAAC,IAAa,EAAE,KAAc;IAC9C,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,WAAW,CAClB,MAA2C,EAC3C,MAA2C,EAC3C,MAAkC,EAClC,OAAe;IAEf,IAAI,CAAC,MAAM;QAAE,OAAO,MAAM,CAAC;IAC3B,MAAM,MAAM,qBAAiC,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC,CAAE,CAAC;IAE9D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,IAAI,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC;YAAE,SAAS;QAC5C,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,IAAI,GAAG,GAAG,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,SAAS,CAChB,MAAe,EACf,MAAe,EACf,MAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,MAAM,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;QACzB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,CAClE,CAAC;QACF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC;YAAE,SAAS;QACvC,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAC5B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,8BAA8B,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CACnB,MAAe,EACf,MAAe,EACf,MAAkC;IAElC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,MAAM,CAAC;IAC9E,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC3B,KAAK,MAAM,MAAM,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,aAAa,GAAG,MAAM,CAAC,SAAS,CACpC,CAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,CACnE,CAAC;QACF,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACpB,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;QACvC,IAAI,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC;YAAE,SAAS;QAC1C,IAAI,MAAM,KAAK,MAAM;YAAE,SAAS;QAChC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,MAAqB,EACrB,MAAqB,EACrB,UAA+B,EAAE;;IAEjC,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,QAAQ,mCAAI,OAAO,CAAC;IAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,MAA4C,CAAC;IAEpE,MAAM,CAAC,KAAK,GAAG,WAAW,CACxB,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EACjD,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EACjE,MAAM,EACN,OAAO,CACR,CAAC;IAEF,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,MAAM,gBAAgB,GAAG,QAAQ,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9F,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;QAChC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;QAChC,GAAG,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC;KACjC,CAAC,CAAC;IACH,MAAM,gBAAgB,qBAAiC,gBAAgB,CAAE,CAAC;IAC1E,KAAK,MAAM,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACxC,gBAAgB,CAAC,OAAO,CAAC,GAAG,WAAW,CACrC,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAC3E,QAAQ,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,EAC3E,MAAM,EACN,cAAc,OAAO,EAAE,CACxB,CAAC;IACJ,CAAC;IACD,MAAM,CAAC,UAAU,GAAG,gBAAgB,CAAC;IAErC,MAAM,CAAC,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAClE,MAAM,CAAC,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAE9E,OAAO,MAAkC,CAAC;AAC5C,CAAC","sourcesContent":["import type { OpenAPIObject } from \"@nestjs/swagger\";\n\n/** Politica di risoluzione quando due documenti definiscono la stessa chiave. */\nexport type OpenApiMergeConflictPolicy = \"error\" | \"keep\" | \"overwrite\";\n\nexport interface MergeOpenApiOptions {\n  /** Default: `error`. */\n  conflict?: OpenApiMergeConflictPolicy;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction cloneDocument(document: OpenAPIObject): Record<string, unknown> {\n  return JSON.parse(JSON.stringify(document)) as Record<string, unknown>;\n}\n\nfunction sameValue(left: unknown, right: unknown): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction mergeRecord(\n  target: Record<string, unknown> | undefined,\n  source: Record<string, unknown> | undefined,\n  policy: OpenApiMergeConflictPolicy,\n  section: string,\n): Record<string, unknown> | undefined {\n  if (!source) return target;\n  const merged: Record<string, unknown> = { ...(target ?? {}) };\n\n  for (const [key, value] of Object.entries(source)) {\n    if (!(key in merged)) {\n      merged[key] = value;\n      continue;\n    }\n    if (sameValue(merged[key], value)) continue;\n    if (policy === \"keep\") continue;\n    if (policy === \"overwrite\") {\n      merged[key] = value;\n      continue;\n    }\n    throw new Error(`Conflitto OpenAPI in ${section}.${key}.`);\n  }\n\n  return merged;\n}\n\nfunction mergeTags(\n  target: unknown,\n  source: unknown,\n  policy: OpenApiMergeConflictPolicy,\n): unknown {\n  if (!Array.isArray(target) || !Array.isArray(source)) return target ?? source;\n  const merged = [...target];\n  for (const tag of source) {\n    if (!isRecord(tag) || typeof tag.name !== \"string\") {\n      merged.push(tag);\n      continue;\n    }\n    const existingIndex = merged.findIndex(\n      (candidate) => isRecord(candidate) && candidate.name === tag.name,\n    );\n    if (existingIndex < 0) {\n      merged.push(tag);\n      continue;\n    }\n    const existing = merged[existingIndex];\n    if (sameValue(existing, tag)) continue;\n    if (policy === \"keep\") continue;\n    if (policy === \"overwrite\") {\n      merged[existingIndex] = tag;\n      continue;\n    }\n    throw new Error(`Conflitto OpenAPI nel tag \"${tag.name}\".`);\n  }\n  return merged;\n}\n\nfunction mergeServers(\n  target: unknown,\n  source: unknown,\n  policy: OpenApiMergeConflictPolicy,\n): unknown {\n  if (!Array.isArray(target) || !Array.isArray(source)) return target ?? source;\n  const merged = [...target];\n  for (const server of source) {\n    if (!isRecord(server) || typeof server.url !== \"string\") {\n      merged.push(server);\n      continue;\n    }\n    const existingIndex = merged.findIndex(\n      (candidate) => isRecord(candidate) && candidate.url === server.url,\n    );\n    if (existingIndex < 0) {\n      merged.push(server);\n      continue;\n    }\n    const existing = merged[existingIndex];\n    if (sameValue(existing, server)) continue;\n    if (policy === \"keep\") continue;\n    if (policy === \"overwrite\") {\n      merged[existingIndex] = server;\n      continue;\n    }\n    throw new Error(`Conflitto OpenAPI nel server \"${server.url}\".`);\n  }\n  return merged;\n}\n\n/**\n * Unisce il documento Accessi nel documento OpenAPI dell'host.\n *\n * Per default un conflitto su path, schema o security scheme produce errore:\n * e meglio accorgersi subito di due contratti incompatibili. Usare\n * `conflict: \"overwrite\"` solo quando il documento host deve vincere.\n */\nexport function mergeOpenApiDocuments(\n  target: OpenAPIObject,\n  source: OpenAPIObject,\n  options: MergeOpenApiOptions = {},\n): OpenAPIObject {\n  if (!target || !source) {\n    throw new Error(\"mergeOpenApiDocuments richiede due documenti OpenAPI validi.\");\n  }\n\n  const policy = options.conflict ?? \"error\";\n  const result = cloneDocument(target);\n  const sourceDocument = source as unknown as Record<string, unknown>;\n\n  result.paths = mergeRecord(\n    isRecord(result.paths) ? result.paths : undefined,\n    isRecord(sourceDocument.paths) ? sourceDocument.paths : undefined,\n    policy,\n    \"paths\",\n  );\n\n  const targetComponents = isRecord(result.components) ? result.components : {};\n  const sourceComponents = isRecord(sourceDocument.components) ? sourceDocument.components : {};\n  const componentSections = new Set([\n    ...Object.keys(targetComponents),\n    ...Object.keys(sourceComponents),\n  ]);\n  const mergedComponents: Record<string, unknown> = { ...targetComponents };\n  for (const section of componentSections) {\n    mergedComponents[section] = mergeRecord(\n      isRecord(targetComponents[section]) ? targetComponents[section] : undefined,\n      isRecord(sourceComponents[section]) ? sourceComponents[section] : undefined,\n      policy,\n      `components.${section}`,\n    );\n  }\n  result.components = mergedComponents;\n\n  result.tags = mergeTags(result.tags, sourceDocument.tags, policy);\n  result.servers = mergeServers(result.servers, sourceDocument.servers, policy);\n\n  return result as unknown as OpenAPIObject;\n}\n"]}

package/docs/gateway-rate-limit.md

@@ -0,0 +1,98 @@
+# Gateway rate limit per Accessi Service
+
+Il rate limit applicativo di Accessi protegge login, 2FA, reset password, console entry e service token. Il gateway/API gateway resta utile per una protezione per IP, connessioni e bot prima che la richiesta raggiunga Node.
+
+Regole consigliate:
+
+- `/api/accessi/auth/*`: soglia bassa, burst contenuto
+- `/api/accessi/console/entry/exchange`: soglia bassa
+- `/api/accessi/*`: soglia media
+- `/accessi/openapi*` e `/accessi/.well-known/jwks.json`: soglia alta o cache CDN
+
+## Nginx
+
+```nginx
+limit_req_zone $binary_remote_addr zone=accessi_auth:10m rate=2r/s;
+limit_req_zone $binary_remote_addr zone=accessi_api:10m rate=10r/s;
+limit_conn_zone $binary_remote_addr zone=accessi_conn:10m;
+
+server {
+    # Se Accessi e dietro un proxy/load balancer, configura real_ip
+    # prima di usare $binary_remote_addr.
+
+    location /api/accessi/auth/ {
+        limit_req zone=accessi_auth burst=10 nodelay;
+        limit_conn accessi_conn 20;
+        proxy_pass http://accessi_service;
+    }
+
+    location /api/accessi/ {
+        limit_req zone=accessi_api burst=50 nodelay;
+        limit_conn accessi_conn 20;
+        proxy_pass http://accessi_service;
+    }
+
+    location /accessi/ {
+        limit_req zone=accessi_api burst=50 nodelay;
+        proxy_pass http://accessi_service;
+    }
+}
+```
+
+## Traefik
+
+```yaml
+http:
+  middlewares:
+    accessi-auth-ratelimit:
+      rateLimit:
+        average: 2
+        burst: 10
+        period: 1s
+    accessi-api-ratelimit:
+      rateLimit:
+        average: 10
+        burst: 50
+        period: 1s
+  routers:
+    accessi-auth:
+      rule: PathPrefix(`/api/accessi/auth/`)
+      middlewares: [accessi-auth-ratelimit]
+      service: accessi
+    accessi-api:
+      rule: PathPrefix(`/api/accessi/`) || PathPrefix(`/accessi/`)
+      middlewares: [accessi-api-ratelimit]
+      service: accessi
+```
+
+## Cloudflare
+
+Regole di rate limiting:
+
+- path `/api/accessi/auth/*`: 10 richieste/minuto per IP, azione `managed challenge`
+- path `/api/accessi/console/entry/exchange`: 30 richieste/5 minuti per IP
+- path `/api/accessi/*`: 300 richieste/minuto per IP, azione `block`
+- path `/accessi/.well-known/jwks.json`: cache CDN, limite alto
+
+Aggiungere bot fight mode/WAF secondo il piano disponibile.
+
+## AWS WAF / API Gateway
+
+- rate-based rule: 300 richieste/5 minuti per IP
+- scope-down statement: `URI starts with /api/accessi`
+- regola più severa su `/api/accessi/auth/*`
+- AWS Shield/WAF Bot Control se disponibile
+
+## Rapporto con `edgeRateLimit` della libreria
+
+`edgeRateLimit` e un ultimo livello applicativo:
+
+- usa lo stesso `RateLimitStore` Redis dei rate limit per account;
+- copre Accessi anche se il gateway non ha regole specifiche;
+- non sostituisce WAF, bot protection, limiti di connessione o protezione DDoS.
+
+In produzione usare entrambi:
+
+```text
+Client -> CDN/WAF -> API gateway -> edgeRateLimit Accessi -> rate limit per account
+```