Rate-limit basert på systembruker_org

[Ceredron]

Description

Når kunder av Broker bruker systembrukertoken er det hensiktsmessig å modellere det slik at rate limiten gjelder per unike systembrukertoken. Dvs, et systembrukertoken utstedes med en maskinporten-integrasjon som definerer hvilken organisasjon de ønsker at systembrukertokenet skal representere. Det kan være mange forskjellige organisasjoner og hver vil få et eget token. Men nå er hvert token i rate limit policien som er definert i APIM nøklet bare basert på client_id som er delt mellom de forskjellige systembrukertokenene. Vi bør endre det slik at keyen hensyntar organisasjonen som brukes i et systembrukertoken.

Eksempel på systembrukertoken:

{
  "authorization_details": {
    "type": "urn:altinn:systemuser",
    "systemuser_org": {
      "authority": "iso6523-actorid-upis",
      "ID": "123456789"
    },
    "systemuser_id": [
      "c0ffee00-bad5-feed-beef-loremafef00d"
    ],
    "system_id": "991825827_system_for_correspondence"
  },
  "scope": "altinn:correspondence.read altinn:serviceowner altinn:events.subscribe",
  "token_type": "Bearer",
  "exp": 1763999629,
  "iat": 1763997829,
  "client_id": "foldbeef-cafe-1337-f00d-facadedecade",
  "consumer": {
    "authority": "iso6523-actorid-upis",
    "ID": "0192:991825827"
  },
  "urn:altinn:org": "digdir",
  "urn:altinn:orgNumber": "991825827"
}

Additional Information

No response

Tasks

No response

Acceptance Criterias

No response

[Ceredron]

Backlink: https://digdir-samarbeid.slack.com/archives/C06982E0UGH/p1763986566078379

[Ceredron]

Dagens polise:

<policies>
    <inbound>
        <set-variable name="cid" value="@(context.Request.Headers.GetValueOrDefault("Authorization","").AsJwt()?.Claims.GetValueOrDefault("client_id",""))" />
        <!-- Set rate limit multiplier based on client_id -->
        <set-variable name="rateLimitMultiplier" value="@{
            string clientId = context.Variables.GetValueOrDefault<string>("cid", "");
            string premiumClients = "{{Broker-Premium-Client-Ids}}"; // Named value containing comma-separated client IDs of premium rate limit clients
            
            // Check if the named value is actually set (not empty, not null, and not the placeholder)
            if (string.IsNullOrWhiteSpace(premiumClients) || 
                premiumClients.StartsWith("{{"))
            {
                // Named value is not configured, use default multiplier
                return 1;
            }
            
            // Split and check if current client is in the premium list
            var clientList = premiumClients.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries)
                                             .Select(c => c.Trim())
                                             .Where(c => !string.IsNullOrWhiteSpace(c));
            
            return clientList.Contains(clientId) ? 10 : 1;
        }" />
        <base />
        <set-backend-service base-url="{{Broker-v1-Service-URL}}" />
        <choose>
            <!-- Initialize a file transfer -->
            <when condition="@(context.Request.Method == "POST" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Upload to an initialized file using a binary stream -->
            <when condition="@(context.Request.Method == "POST" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/[^/]+/upload$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Initialize and upload a file using form-data -->
            <when condition="@(context.Request.Method == "POST" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/upload$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Get information about the file and its current status -->
            <when condition="@(context.Request.Method == "GET" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/[^/]+$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Get more detailed information about the file upload for auditing and troubleshooting purposes -->
            <when condition="@(context.Request.Method == "GET" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/[^/]+/details$"))">
                <rate-limit-by-key calls="@(15 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Search files that can be accessed by the caller according to specified filters -->
            <when condition="@(context.Request.Method == "GET" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer$"))">
                <rate-limit-by-key calls="@(10 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Downloads the file -->
            <when condition="@(context.Request.Method == "GET" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/[^/]+/download$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
            <!-- Confirms that the file has been downloaded -->
            <when condition="@(context.Request.Method == "POST" && Regex.IsMatch(context.Request.OriginalUrl.Path, "^/broker/api/v1/filetransfer/[^/]+/confirmdownload$"))">
                <rate-limit-by-key calls="@(120 * context.Variables.GetValueOrDefault<int>("rateLimitMultiplier", 1))" renewal-period="60" counter-key="@($"{context.Variables.GetValueOrDefault<string>("cid","")}-{context.Operation.Id}")" />
            </when>
        </choose>
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Dvs, vi må extracte systembrukerclaim - hvis den eksisterer - og legge det til i counter-keyen.