Eric Allam
2d8a41b18b
* Denormalize run tags, increase character limit to 128 * WIP realtime subscribing to runs * extracted the stream stuff into core, made it more reusable * WIP tags * Remove tags for now because it’s not support in electric * Support async iterables, readable stream, and callback style subscription styles * Remove tags streaming endpoint * Add realtime rate limits and scope them to the /realtime path * WIP rate limt per org * Introduce per org rate limits * WIP JWT auth * Move migrations into new internal db package * Resolve pnpm lock file * Authenticating to the realtime API with JWTs are working * realtime in the client * Created react-hooks package and starting to move stuff in there * Improve types for hooks * schema tasks * Added useBatch hook * build uploadthing/fal demo and change how run metadata is synced to the server * tweaks * WIL realtime concurrency tracking * Implement test for realtime client using testcontainers also updated electric to latest version * Allow customizing the expiration time of the automatic JWT created after triggering a task * Add support for subscribing to run tags * Improve auth types and API * finalize the realtime API * Fixed some example stuff * Allow up to 10 run tags * Remove core from docker-provider tsconfig paths to prevent it from being typechecked * do the same for the kubernetes provider * Fixing some typecheck errors * Fix webapp type errors * Update @trigger.dev/platform to 1.0.13 * Fix attw error * Remove from/to in subscribeToRuns query params * Add tests for the rate limit middleware and add custom JWT rate limits * turn off webapp test parallelism * Finish renaming jwt -> publicAccessToken and automatically give the JWT read access to the tags when using trigger * Add changeset * Attempt to fix unit tests in CI * Skip running the auth rate limit middleware tests for now * Try a beefier machine * Try and run webapp tests separately * Setup env vars * Make sliding window test more reliabile
63 lines
2.4 KiB
TypeScript
63 lines
2.4 KiB
TypeScript
import { env } from "~/env.server";
|
|
import { authenticateAuthorizationHeader } from "./apiAuth.server";
|
|
import { authorizationRateLimitMiddleware } from "./authorizationRateLimitMiddleware.server";
|
|
import { Duration } from "./rateLimiter.server";
|
|
|
|
export const apiRateLimiter = authorizationRateLimitMiddleware({
|
|
keyPrefix: "api",
|
|
defaultLimiter: {
|
|
type: "tokenBucket",
|
|
refillRate: env.API_RATE_LIMIT_REFILL_RATE,
|
|
interval: env.API_RATE_LIMIT_REFILL_INTERVAL as Duration,
|
|
maxTokens: env.API_RATE_LIMIT_MAX,
|
|
},
|
|
limiterCache: {
|
|
fresh: 60_000 * 10, // Data is fresh for 10 minutes
|
|
stale: 60_000 * 20, // Date is stale after 20 minutes
|
|
},
|
|
limiterConfigOverride: async (authorizationValue) => {
|
|
const authenticatedEnv = await authenticateAuthorizationHeader(authorizationValue, {
|
|
allowPublicKey: true,
|
|
allowJWT: true,
|
|
});
|
|
|
|
if (!authenticatedEnv) {
|
|
return;
|
|
}
|
|
|
|
if (authenticatedEnv.type === "PUBLIC_JWT") {
|
|
return {
|
|
type: "fixedWindow",
|
|
window: env.API_RATE_LIMIT_JWT_WINDOW,
|
|
tokens: env.API_RATE_LIMIT_JWT_TOKENS,
|
|
};
|
|
} else {
|
|
return authenticatedEnv.environment.organization.apiRateLimiterConfig;
|
|
}
|
|
},
|
|
pathMatchers: [/^\/api/],
|
|
// Allow /api/v1/tasks/:id/callback/:secret
|
|
pathWhiteList: [
|
|
"/api/internal/stripe_webhooks",
|
|
"/api/v1/authorization-code",
|
|
"/api/v1/token",
|
|
"/api/v1/usage/ingest",
|
|
/^\/api\/v1\/tasks\/[^\/]+\/callback\/[^\/]+$/, // /api/v1/tasks/$id/callback/$secret
|
|
/^\/api\/v1\/runs\/[^\/]+\/tasks\/[^\/]+\/callback\/[^\/]+$/, // /api/v1/runs/$runId/tasks/$id/callback/$secret
|
|
/^\/api\/v1\/http-endpoints\/[^\/]+\/env\/[^\/]+\/[^\/]+$/, // /api/v1/http-endpoints/$httpEndpointId/env/$envType/$shortcode
|
|
/^\/api\/v1\/sources\/http\/[^\/]+$/, // /api/v1/sources/http/$id
|
|
/^\/api\/v1\/endpoints\/[^\/]+\/[^\/]+\/index\/[^\/]+$/, // /api/v1/endpoints/$environmentId/$endpointSlug/index/$indexHookIdentifier
|
|
"/api/v1/timezones",
|
|
"/api/v1/usage/ingest",
|
|
"/api/v1/auth/jwt/claims",
|
|
/^\/api\/v1\/runs\/[^\/]+\/attempts$/, // /api/v1/runs/$runFriendlyId/attempts
|
|
],
|
|
log: {
|
|
rejections: env.API_RATE_LIMIT_REJECTION_LOGS_ENABLED === "1",
|
|
requests: env.API_RATE_LIMIT_REQUEST_LOGS_ENABLED === "1",
|
|
limiter: env.API_RATE_LIMIT_LIMITER_LOGS_ENABLED === "1",
|
|
},
|
|
});
|
|
|
|
export type RateLimitMiddleware = ReturnType<typeof authorizationRateLimitMiddleware>;
|