feat(boundary): setup of rate-limit canister

Cargo.toml

@@ -30,6 +30,9 @@ members = [
     "rs/boundary_node/certificate_issuance/certificate_orchestrator",
     "rs/boundary_node/discower_bowndary",
     "rs/boundary_node/ic_boundary",
+    "rs/boundary_node/rate_limits",
+    "rs/boundary_node/rate_limits/api",
+    "rs/boundary_node/rate_limits/canister_client",
     "rs/boundary_node/systemd_journal_gatewayd_shim",
     "rs/canister_client",
     "rs/canister_client/sender",

rs/boundary_node/rate_limits/Cargo.toml

@@ -0,0 +1,21 @@
+[package]
+name = "rate_limits"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+candid = { workspace = true }
+ciborium = { workspace = true }
+ic-cdk = { workspace = true }
+ic-cdk-macros = { workspace = true }
+ic-cdk-timers = { workspace = true }
+ic-stable-structures = { workspace = true }
+rate-limits-api = { path = "./api" }
+serde = { workspace = true }
+
+[lib]
+crate-type = ["cdylib"]
+path = "canister/canister.rs"

rs/boundary_node/rate_limits/api/Cargo.toml

@@ -0,0 +1,14 @@
+[package]
+name = "rate-limits-api"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+candid = {workspace = true}
+serde = {workspace = true}
+
+[lib]
+path = "src/lib.rs"

rs/boundary_node/rate_limits/api/src/lib.rs

@@ -0,0 +1,28 @@
+use candid::CandidType;
+use serde::Deserialize;
+
+pub type Version = u64;
+pub type Timestamp = u64;
+pub type RuleId = String;
+
+pub type GetConfigResponse = Result<ConfigResponse, String>;
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct ConfigResponse {
+    pub version: Version,
+    pub active_since: Timestamp,
+    pub config: OutputConfig,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputConfig {
+    pub rules: Vec<OutputRule>,
+}
+
+#[derive(CandidType, Deserialize, Debug)]
+pub struct OutputRule {
+    pub id: RuleId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+    pub disclosed_at: Option<Timestamp>,
+}

rs/boundary_node/rate_limits/canister/canister.rs

@@ -0,0 +1,23 @@
+use rate_limits_api::{GetConfigResponse, Version};
+use storage::VERSION;
+use types::{ConfigResponse, OutputConfig};
+mod storage;
+mod types;
+
+#[ic_cdk_macros::update]
+fn get_config(version: Option<Version>) -> GetConfigResponse {
+    let test_version_inc = VERSION.with(|v| {
+        let mut ver = v.borrow_mut();
+        let current_version = ver.get(&()).unwrap_or(0);
+        ver.insert((), current_version + 1);
+        current_version
+    });
+
+    let response = ConfigResponse {
+        version: version.unwrap_or(test_version_inc),
+        active_since: 1,
+        config: OutputConfig { rules: vec![] },
+    };
+
+    Ok(response.into())
+}

rs/boundary_node/rate_limits/canister/interface.did

@@ -0,0 +1,111 @@
+type Version = nat64;           // Represents the config version number
+type Timestamp = nat64;         // Represents timestamp in nanoseconds since the epoch (1970-01-01)
+type RuleId = text;             // Unique identifier for each rule
+type SchemaVersion = nat64;     // Version of the schema for encoding/decoding the rules
+type IncidentId = text;         // Unique identifier for each incident
+
+
+// Input structure for defining a rule with mandatory fields within a config
+type InputRule = record {
+  incident_id: IncidentId; // Unique identifier for the incident
+  rule_raw: blob;          // Raw rule data (in binary format), expected to be a valid json object
+  description: text;       // Textual description of the rule
+};
+
+// Output structure for rules
+// Optional fields rule_raw and description may remain hidden while the rule is under confidentiality restrictions
+type OutputRule = record {
+  id: RuleId;                        // Unique identifier for the rule
+  rule_raw: opt blob;                // Raw rule data (in binary format), expected to be a valid json object, none if the rule is currently confidential
+  description: opt text;             // Textual description of the rule, none if the rule is currently confidential
+  disclosed_at: opt Timestamp;       // Timestamp when the rule was disclosed, none if the rule is still confidential
+};
+
+type OutputConfig = record {
+  rules: vec OutputRule;
+};
+
+// Response structure for returning the requested configuration and associated metadata
+type OutputConfigResponse = record {
+    version: Version;         // Version of the configuration
+    active_since: Timestamp;  // Time when this configuration was added (became active)
+    config: OutputConfig;     // Contains the list of rules
+};
+
+// Verbose details of an individual rule
+// Optional rule_raw and description fields are for restricted publicly viewing access
+type OutputRuleMetadata = record {
+  id: RuleId;                      // Unique identifier for the rule
+  rule_raw: opt blob;              // Raw rule data (binary format), expected to be a valid json object, none if the rule is currently confidential
+  description: opt text;           // Textual description of the rule, none if the rule is currently confidential
+  disclosed_at: opt Timestamp;     // Timestamp when the rule was disclosed, none if the rule is still confidential
+  added_in_version: Version;       // Version when the rule was added (became active)
+  removed_in_version: opt Version; // Version when the rule was deactivated (removed), none if the rule is still active
+};
+
+type GetRuleByIdResponse = variant {
+  Ok: OutputRuleMetadata;
+  Err: text;
+};
+
+type GetConfigResponse = variant {
+  Ok: OutputConfigResponse;
+  Err: text;
+};
+
+type DiscloseRulesResponse = variant {
+  Ok;
+  Err: text;
+};
+
+type OverwriteConfigResponse = variant {
+  Ok;
+  Err: text;
+};
+
+type DiscloseRulesByRuleIdsResponse = variant {
+  Ok;
+  Err: text;
+};
+
+type DiscloseRulesByIncidentIdResponse = variant {
+  Ok;
+  Err: text;
+};
+
+type GetRulesByIncidentIdResponse = variant {
+  Ok: vec RuleId;
+  Err: text;
+};
+
+// Configuration containing a list of rules that replaces the current configuration
+type InputConfig = record {
+  schema_version: SchemaVersion; // schema version used to serialized the rules
+  rules: vec InputRule;
+};
+
+// Initialization arguments for the service
+type InitArg = record {
+  registry_polling_period_secs: nat64; // IDs of existing API boundary nodes are polled from the registry with this periodicity
+};
+
+service : (InitArg) -> {
+  // Replaces the current rate-limit configuration with a new set of rules
+  overwrite_config: (InputConfig) -> (OverwriteConfigResponse);
+
+  // Make the viewing of the specified rules publicly accessible
+  disclose_rules_by_rule_ids: (vec RuleId) -> (DiscloseRulesByRuleIdsResponse);
+
+  // Make the viewing of the specified rules related to an incident ID publicly accessible
+  disclose_rules_by_incident_id: (IncidentId) -> (DiscloseRulesByIncidentIdResponse);
+
+  // Fetches the rate-limit rule configuration for a specified version
+  // If no version is provided, the latest configuration is returned
+  get_config: (opt Version) -> (GetConfigResponse) query;
+
+  // Fetch the rule with metadata by its ID
+  get_rule_by_id: (RuleId) -> (GetRuleByIdResponse) query;
+
+  // Fetch all rules IDs related to an ID of the incident
+  get_rules_by_incident_id: (IncidentId) -> (GetRulesByIncidentIdResponse) query;
+}

rs/boundary_node/rate_limits/canister/storage.rs

@@ -0,0 +1,31 @@
+use std::cell::RefCell;
+
+use ic_stable_structures::{
+    memory_manager::{MemoryId, MemoryManager, VirtualMemory},
+    DefaultMemoryImpl, StableBTreeMap,
+};
+
+use crate::types::Version;
+
+// Stable Memory
+type Memory = VirtualMemory<DefaultMemoryImpl>;
+
+type StableMap<K, V> = StableBTreeMap<K, V, Memory>;
+type _StableSet<T> = StableMap<T, ()>;
+type StableValue<T> = StableMap<(), T>;
+
+const MEMORY_ID_VERSION: u8 = 0;
+
+// Memory
+thread_local! {
+    static MEMORY_MANAGER: RefCell<MemoryManager<DefaultMemoryImpl>> =
+        RefCell::new(MemoryManager::init(DefaultMemoryImpl::default()));
+}
+
+thread_local! {
+    pub static VERSION: RefCell<StableValue<Version>> = RefCell::new(
+        StableValue::init(
+            MEMORY_MANAGER.with(|m| m.borrow().get(MemoryId::new(MEMORY_ID_VERSION))),
+        )
+    );
+}

rs/boundary_node/rate_limits/canister/types.rs

@@ -0,0 +1,49 @@
+pub type Version = u64;
+pub type Timestamp = u64;
+pub type RuleId = String;
+
+pub struct ConfigResponse {
+    pub version: Version,
+    pub active_since: Timestamp,
+    pub config: OutputConfig,
+}
+
+pub struct OutputConfig {
+    pub rules: Vec<OutputRule>,
+}
+
+pub struct OutputRule {
+    pub id: RuleId,
+    pub rule_raw: Option<Vec<u8>>,
+    pub description: Option<String>,
+    pub disclosed_at: Option<Timestamp>,
+}
+
+impl From<OutputRule> for rate_limits_api::OutputRule {
+    fn from(value: OutputRule) -> Self {
+        rate_limits_api::OutputRule {
+            description: value.description,
+            disclosed_at: value.disclosed_at,
+            id: value.id,
+            rule_raw: value.rule_raw,
+        }
+    }
+}
+
+impl From<OutputConfig> for rate_limits_api::OutputConfig {
+    fn from(value: OutputConfig) -> Self {
+        rate_limits_api::OutputConfig {
+            rules: value.rules.into_iter().map(|r| r.into()).collect(),
+        }
+    }
+}
+
+impl From<ConfigResponse> for rate_limits_api::ConfigResponse {
+    fn from(value: ConfigResponse) -> Self {
+        rate_limits_api::ConfigResponse {
+            version: value.version,
+            active_since: value.active_since,
+            config: value.config.into(),
+        }
+    }
+}

rs/boundary_node/rate_limits/canister_client/Cargo.toml

@@ -0,0 +1,13 @@
+[package]
+name = "canister_client"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+description.workspace = true
+documentation.workspace = true
+
+[dependencies]
+rate-limits-api = { path = "../api" }
+ic-agent = { workspace = true }
+tokio = { workspace = true }
+candid = { workspace = true }

rs/boundary_node/rate_limits/canister_client/src/main.rs

@@ -0,0 +1,33 @@
+use candid::{Decode, Encode, Principal};
+use ic_agent::{identity::AnonymousIdentity, Agent};
+use rate_limits_api::GetConfigResponse;
+
+const RATE_LIMIT_CANISTER_ID: &str = "zwbmv-jyaaa-aaaab-qacaa-cai";
+const IC_DOMAIN: &str = "https://ic0.app";
+
+#[tokio::main]
+async fn main() {
+    let agent = Agent::builder()
+        .with_url(IC_DOMAIN)
+        .with_identity(AnonymousIdentity {})
+        .build()
+        .expect("failed to build the agent");
+
+    agent.fetch_root_key().await.unwrap();
+
+    let canister_id = Principal::from_text(RATE_LIMIT_CANISTER_ID).unwrap();
+
+    // let args = Encode!(&Some(1u64)).unwrap();
+    let args = Encode!(&None::<u64>).unwrap();
+
+    let response = agent
+        .update(&canister_id, "get_config")
+        .with_arg(args)
+        .call_and_wait()
+        .await
+        .expect("update call failed");
+
+    let decoded = Decode!(&response, GetConfigResponse).expect("failed to decode candid response");
+
+    println!("get_config response: {decoded:#?}");
+}