feat(boundary): setup of rate-limit canister

Cargo.toml

@@ -31,6 +31,9 @@ members = [
     "rs/boundary_node/certificate_issuance/certificate_orchestrator",
     "rs/boundary_node/discower_bowndary",
     "rs/boundary_node/ic_boundary",
+    "rs/boundary_node/rate_limits",
+    "rs/boundary_node/rate_limits/api",
+    "rs/boundary_node/rate_limits/canister_client",
     "rs/boundary_node/systemd_journal_gatewayd_shim",
     "rs/canister_client",
     "rs/canister_client/sender",

rs/boundary_node/rate_limits/BUILD.bazel

@@ -0,0 +1,37 @@
+load("//bazel:canisters.bzl", "rust_canister")
+
+package(default_visibility = ["//visibility:public"])
+
+DEPENDENCIES = [
+    # Keep sorted.
+    "//rs/boundary_node/rate_limits/api:rate_limits_api",
+    "//rs/rust_canisters/http_types",
+    "@crate_index//:anyhow",
+    "@crate_index//:bincode",
+    "@crate_index//:candid",
+    "@crate_index//:hex",
+    "@crate_index//:ic-cdk",
+    "@crate_index//:ic-cdk-timers",
+    "@crate_index//:ic-metrics-encoder",
+    "@crate_index//:ic-stable-structures",
+    "@crate_index//:mockall",
+    "@crate_index//:serde",
+    "@crate_index//:serde_json",
+    "@crate_index//:sha2",
+    "@crate_index//:thiserror",
+]
+
+MACRO_DEPENDENCIES = [
+    # Keep sorted.
+    "@crate_index//:ic-cdk-macros",
+]
+
+rust_canister(
+    name = "rate_limit_canister",
+    srcs = glob(["canister/**/*.rs"]),
+    crate_name = "rate_limit_canister",
+    crate_root = "canister/lib.rs",
+    proc_macro_deps = MACRO_DEPENDENCIES,
+    service_file = "canister/interface.did",
+    deps = DEPENDENCIES,
+)

rs/boundary_node/rate_limits/Cargo.toml

@@ -0,0 +1,29 @@
+[package]
+name = "rate_limits"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+bincode = { workspace = true }
+candid = { workspace = true }
+hex = { workspace = true }
+ic-canisters-http-types = { path = "../../rust_canisters/http_types" }
+ic-cdk = { workspace = true }
+ic-cdk-macros = { workspace = true }
+ic-cdk-timers = { workspace = true }
+ic-metrics-encoder = "1"
+ic-stable-structures = { workspace = true }
+mockall = { workspace = true }
+rate-limits-api = { path = "./api" }
+serde = { workspace = true }
+serde_json = { workspace = true }
+sha2 = { workspace = true }
+thiserror = { workspace = true }
+
+[lib]
+crate-type = ["cdylib"]
+path = "canister/lib.rs"

rs/boundary_node/rate_limits/api/BUILD.bazel

@@ -0,0 +1,24 @@
+load("@rules_rust//rust:defs.bzl", "rust_library")
+
+package(default_visibility = ["//visibility:public"])
+
+DEPENDENCIES = [
+    # Keep sorted.
+    "@crate_index//:candid",
+    "@crate_index//:regex",
+    "@crate_index//:serde",
+    "@crate_index//:serde_json",
+]
+
+MACRO_DEPENDENCIES = []
+
+ALIASES = {}
+
+rust_library(
+    name = "rate_limits_api",
+    srcs = glob(["src/**/*.rs"]),
+    aliases = ALIASES,
+    crate_name = "rate_limits_api",
+    proc_macro_deps = MACRO_DEPENDENCIES,
+    deps = DEPENDENCIES,
+)

rs/boundary_node/rate_limits/api/Cargo.toml

@@ -0,0 +1,17 @@
+[package]
+name = "rate-limits-api"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+candid = {workspace = true}
+regex = { workspace = true }
+serde = {workspace = true}
+serde_bytes = { workspace = true }
+serde_json = { workspace = true }
+
+[lib]
+path = "src/lib.rs"

rs/boundary_node/rate_limits/api/src/lib.rs

@@ -0,0 +1,144 @@
+use candid::CandidType;
+use candid::Principal;
+use schema_versions::v1::RateLimitRule;
+use serde::{Deserialize, Serialize};
+
+mod schema_versions;
+pub use schema_versions::v1;
+
+pub type Version = u64;
+pub type Timestamp = u64;
+pub type RuleId = String;
+pub type IncidentId = String;
+pub type SchemaVersion = u64;
+
+pub type GetConfigResponse = Result<ConfigResponse, String>;
+pub type AddConfigResponse = Result<(), String>;
+pub type GetRuleByIdResponse = Result<OutputRuleMetadata, String>;
+pub type DiscloseRulesResponse = Result<(), String>;
+
+#[derive(CandidType, Deserialize, Debug)]
+pub enum DiscloseRulesArg {
+    RuleIds(Vec<RuleId>),
+    IncidentIds(Vec<IncidentId>),
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct ConfigResponse {
+    pub version: Version,
+    pub active_since: Timestamp,
+    pub config: OutputConfig,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputConfig {
+    pub schema_version: SchemaVersion,
+    pub rules: Vec<OutputRule>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InputConfig {
+    pub schema_version: SchemaVersion,
+    pub rules: Vec<InputRule>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InputRule {
+    pub incident_id: IncidentId,
+    pub rule_raw: Vec<u8>,
+    pub description: String,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputRule {
+    pub id: RuleId,
+    pub incident_id: IncidentId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputRuleMetadata {
+    pub id: RuleId,
+    pub incident_id: IncidentId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+    pub disclosed_at: Option<Timestamp>,
+    pub added_in_version: Version,
+    pub removed_in_version: Option<Version>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InitArg {
+    pub registry_polling_period_secs: u64,
+}
+
+#[derive(CandidType, Deserialize, Clone, Copy, PartialEq, Eq)]
+pub struct GetApiBoundaryNodeIdsRequest {}
+
+#[derive(CandidType, Serialize, Deserialize, Clone, PartialEq, Debug, Eq)]
+pub struct ApiBoundaryNodeIdRecord {
+    pub id: Option<Principal>,
+}
+
+const INDENT: &str = "  ";
+const DOUBLE_INDENT: &str = "    ";
+
+impl std::fmt::Display for ConfigResponse {
+    fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
+        writeln!(f, "\nConfiguration details:")?;
+        writeln!(f, "{INDENT}Version: {}", self.version)?;
+        writeln!(f, "{INDENT}Active Since: {}", self.active_since)?;
+        writeln!(f, "{INDENT}{}", self.config)?;
+        Ok(())
+    }
+}
+
+impl std::fmt::Display for OutputConfig {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        writeln!(f, "Schema version: {}", self.schema_version)?;
+        for (i, rule) in self.rules.iter().enumerate() {
+            writeln!(f, "{DOUBLE_INDENT}Rule {}:", i + 1)?;
+            writeln!(f, "{DOUBLE_INDENT}ID: {}", rule.id)?;
+            writeln!(f, "{DOUBLE_INDENT}Incident ID: {}", rule.incident_id)?;
+            if let Some(ref description) = rule.description {
+                writeln!(f, "{DOUBLE_INDENT}Description: {description}")?;
+            }
+            if let Some(ref rule_raw) = rule.rule_raw {
+                let decoded_rule = RateLimitRule::from_bytes_json(rule_raw.as_slice()).unwrap();
+                writeln!(f, "{DOUBLE_INDENT}Rate-limit rule:\n{decoded_rule}")?;
+            }
+        }
+        Ok(())
+    }
+}
+
+impl std::fmt::Display for OutputRuleMetadata {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        writeln!(f, "\nOutputRuleMetadata")?;
+        writeln!(f, "{INDENT}ID: {}", self.id)?;
+        writeln!(
+            f,
+            "{INDENT}Disclosed at: {}",
+            self.disclosed_at
+                .map(|v| v.to_string())
+                .unwrap_or_else(|| "None".to_string())
+        )?;
+        writeln!(f, "{INDENT}Added in version: {}", self.added_in_version)?;
+        writeln!(
+            f,
+            "{INDENT}Removed in version: {}",
+            self.removed_in_version
+                .map(|v| v.to_string())
+                .unwrap_or_else(|| "None".to_string())
+        )?;
+        if let Some(ref description) = self.description {
+            writeln!(f, "{INDENT}Description: {description}")?;
+        }
+        if let Some(ref rule_raw) = self.rule_raw {
+            let decoded_rule = RateLimitRule::from_bytes_json(rule_raw.as_slice()).unwrap();
+            writeln!(f, "{INDENT}Rate-limit rule:\n{decoded_rule}")?;
+        }
+        Ok(())
+    }
+}

rs/boundary_node/rate_limits/api/src/schema_versions/mod.rs

@@ -0,0 +1 @@
+pub mod v1;

rs/boundary_node/rate_limits/api/src/schema_versions/v1.rs

@@ -0,0 +1,69 @@
+use candid::Principal;
+use regex::Regex;
+use serde::{Deserialize, Deserializer, Serialize, Serializer};
+
+const DOUBLE_INDENT: &str = "      ";
+
+// Defines the rate-limit rule to be stored in the canister
+#[derive(Serialize, Deserialize, Debug)]
+pub struct RateLimitRule {
+    pub canister_id: Option<Principal>,
+    pub subnet_id: Option<Principal>,
+    #[serde(with = "regex_serde")]
+    pub methods: Regex,
+    pub limit: String,
+}
+
+impl std::fmt::Display for RateLimitRule {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        writeln!(
+            f,
+            "{DOUBLE_INDENT}Canister ID: {}",
+            format_principal_option(&self.canister_id)
+        )?;
+        writeln!(
+            f,
+            "{DOUBLE_INDENT}Subnet ID: {}",
+            format_principal_option(&self.subnet_id)
+        )?;
+        writeln!(f, "{DOUBLE_INDENT}Methods: {}", &self.methods)?;
+        write!(f, "{DOUBLE_INDENT}Limit: {}", &self.limit)?;
+        Ok(())
+    }
+}
+
+fn format_principal_option(principal: &Option<Principal>) -> String {
+    match principal {
+        Some(p) => p.to_string(),
+        None => "None".to_string(),
+    }
+}
+
+mod regex_serde {
+    use super::*;
+
+    pub fn serialize<S>(regex: &Regex, serializer: S) -> Result<S::Ok, S::Error>
+    where
+        S: Serializer,
+    {
+        regex.as_str().serialize(serializer)
+    }
+
+    pub fn deserialize<'de, D>(deserializer: D) -> Result<Regex, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        let s = String::deserialize(deserializer)?;
+        Regex::new(&s).map_err(serde::de::Error::custom)
+    }
+}
+
+impl RateLimitRule {
+    pub fn to_bytes_json(&self) -> Result<Vec<u8>, serde_json::Error> {
+        serde_json::to_vec(self)
+    }
+
+    pub fn from_bytes_json(bytes: &[u8]) -> Result<Self, serde_json::Error> {
+        serde_json::from_slice(bytes)
+    }
+}