feat(boundary): setup of rate-limit canister

Cargo.toml

@@ -31,6 +31,9 @@ members = [
     "rs/boundary_node/certificate_issuance/certificate_orchestrator",
     "rs/boundary_node/discower_bowndary",
     "rs/boundary_node/ic_boundary",
+    "rs/boundary_node/rate_limits",
+    "rs/boundary_node/rate_limits/api",
+    "rs/boundary_node/rate_limits/canister_client",
     "rs/boundary_node/systemd_journal_gatewayd_shim",
     "rs/canister_client",
     "rs/canister_client/sender",

rs/boundary_node/rate_limits/Cargo.toml

@@ -0,0 +1,26 @@
+[package]
+name = "rate_limits"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+bincode = { workspace = true }
+candid = { workspace = true }
+hex = { workspace = true }
+ic-cdk = { workspace = true }
+ic-cdk-macros = { workspace = true }
+ic-cdk-timers = { workspace = true }
+ic-stable-structures = { workspace = true }
+rate-limits-api = { path = "./api" }
+serde = { workspace = true }
+serde_json = { workspace = true }
+sha2 = { workspace = true }
+thiserror = { workspace = true }
+
+[lib]
+crate-type = ["cdylib"]
+path = "canister/canister.rs"

rs/boundary_node/rate_limits/api/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "rate-limits-api"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+candid = {workspace = true}
+serde = {workspace = true}
+
+[lib]
+path = "src/lib.rs"

rs/boundary_node/rate_limits/api/src/lib.rs

@@ -0,0 +1,76 @@
+use candid::CandidType;
+use candid::Principal;
+use serde::{Deserialize, Serialize};
+pub type Version = u64;
+pub type Timestamp = u64;
+pub type RuleId = String;
+pub type IncidentId = String;
+pub type SchemaVersion = u64;
+
+pub type GetConfigResponse = Result<ConfigResponse, String>;
+pub type AddConfigResponse = Result<(), String>;
+pub type GetRuleByIdResponse = Result<OutputRuleMetadata, String>;
+pub type DiscloseRulesResponse = Result<(), String>;
+
+#[derive(CandidType, Deserialize, Debug)]
+pub enum DiscloseRulesArg {
+    RuleIds(Vec<RuleId>),
+    IncidentIds(Vec<IncidentId>),
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct ConfigResponse {
+    pub version: Version,
+    pub active_since: Timestamp,
+    pub config: OutputConfig,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputConfig {
+    pub schema_version: SchemaVersion,
+    pub rules: Vec<OutputRule>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InputConfig {
+    pub schema_version: SchemaVersion,
+    pub rules: Vec<InputRule>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InputRule {
+    pub incident_id: IncidentId,
+    pub rule_raw: Vec<u8>,
+    pub description: String,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputRule {
+    pub id: RuleId,
+    pub incident_id: IncidentId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputRuleMetadata {
+    pub id: RuleId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+    pub disclosed_at: Option<Timestamp>,
+    pub added_in_version: Version,
+    pub removed_in_version: Option<Version>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct InitArg {
+    pub registry_polling_period_secs: u64,
+}
+
+#[derive(CandidType, Deserialize, Clone, Copy, PartialEq, Eq)]
+pub struct GetApiBoundaryNodeIdsRequest {}
+
+#[derive(CandidType, Serialize, Deserialize, Clone, PartialEq, Debug, Eq)]
+pub struct ApiBoundaryNodeIdRecord {
+    pub id: Option<Principal>,
+}

rs/boundary_node/rate_limits/canister/access_control.rs

@@ -0,0 +1,52 @@
+use candid::Principal;
+
+use crate::storage::API_BOUNDARY_NODE_PRINCIPALS;
+
+const FULL_ACCESS_ID: &str = "";
+const FULL_READ_TESTING_ID: &str = ""; // TODO: remove this
+
+pub trait ResolveAccessLevel {
+    fn get_access_level(&self) -> AccessLevel;
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum AccessLevelError {}
+
+#[derive(PartialEq, Eq)]
+pub enum AccessLevel {
+    FullAccess,
+    FullRead,
+    RestrictedRead,
+}
+
+#[derive(Clone)]
+pub struct AccessLevelResolver {
+    pub caller_id: Principal,
+}
+
+impl AccessLevelResolver {
+    pub fn new(caller_id: Principal) -> Self {
+        Self { caller_id }
+    }
+}
+
+impl ResolveAccessLevel for AccessLevelResolver {
+    fn get_access_level(&self) -> AccessLevel {
+        let full_access_principal = Principal::from_text(FULL_ACCESS_ID).unwrap();
+
+        API_BOUNDARY_NODE_PRINCIPALS.with(|cell| {
+            let mut full_read_principals = cell.borrow_mut();
+            // TODO: this is just for testing, remove later
+            let full_read_id = Principal::from_text(FULL_READ_TESTING_ID).unwrap();
+            let _ = full_read_principals.insert(full_read_id);
+
+            if self.caller_id == full_access_principal {
+                return AccessLevel::FullAccess;
+            } else if full_read_principals.contains(&self.caller_id) {
+                return AccessLevel::FullRead;
+            }
+
+            AccessLevel::RestrictedRead
+        })
+    }
+}