Skip to content

[TT-10856/TT-11778] fix quota limit remaining header value when key is created from policy and API is looped#6199

Merged
jeffy-mathew merged 2 commits into
masterfrom
fix/TT-10856/TT-11778/fix-incorrect-ratelimit-remaining
Apr 2, 2024
Merged

[TT-10856/TT-11778] fix quota limit remaining header value when key is created from policy and API is looped#6199
jeffy-mathew merged 2 commits into
masterfrom
fix/TT-10856/TT-11778/fix-incorrect-ratelimit-remaining

Conversation

@jeffy-mathew

@jeffy-mathew jeffy-mathew commented Apr 2, 2024

Copy link
Copy Markdown
Contributor

User description

Description

X-RateLimit-Remaining header was returning 0 when key was created from policy and API is looped with tyk://self
This is because AuthKey middleware is calling CheckSessionAndIdentityForValidKey once again during looping.
This check can be skipped like what we do for RateLimitAndQuotaCheck middleware

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Refactoring or add test (improvements in base code or adds test coverage to functionality)

Checklist

  • I ensured that the documentation is up to date
  • I explained why this PR updates go.mod in detail with reasoning why it's required
  • I would like a code coverage CI quality gate exception and have explained why

Type

bug_fix


Description

  • Fixed an issue where X-RateLimit-Remaining header returned incorrect values for looped requests when the key was created from a policy.
  • Refactored test setup for quota middleware to streamline session creation.
  • Added comprehensive tests to ensure correct quota headers are returned for various key and policy configurations.

Changes walkthrough

Relevant files
Tests
middleware_test.go
Refactor Test Setup for Quota Middleware                                 

gateway/middleware_test.go

  • Removed createSessionWithQuota function as it was replaced with a more
    streamlined session creation in tests.
  • Modified TestQuotaNotAppliedWithURLRewrite to use the new session
    creation method.
  • +17/-28 
    reverse_proxy_test.go
    Extend Tests for Quota Response Headers                                   

    gateway/reverse_proxy_test.go

  • Added tests to verify correct quota headers for keys without policies,
    keys from policies with per API limits, and keys from policies with
    global limits.
  • +112/-31
    Enhancement
    mw_auth_key.go
    Skip Auth Key Check for Looped Requests                                   

    gateway/mw_auth_key.go

  • Added a check to skip auth key verification if the request is looped
    and session limits are not to be checked.
  • +5/-0     

    PR-Agent usage:
    Comment /help on the PR to get a list of all available PR-Agent tools and their descriptions

    @github-actions

    github-actions Bot commented Apr 2, 2024

    Copy link
    Copy Markdown
    Contributor

    PR Description updated to latest commit (086e61e)

    @github-actions

    github-actions Bot commented Apr 2, 2024

    Copy link
    Copy Markdown
    Contributor

    API Changes

    no api changes detected

    @github-actions

    github-actions Bot commented Apr 2, 2024

    Copy link
    Copy Markdown
    Contributor

    PR Review

    ⏱️ Estimated effort to review [1-5]

    4, due to the complexity of the changes related to quota management and the need to ensure that the modifications do not introduce any regressions or unintended behavior changes in the quota handling logic. The PR involves changes across multiple files and includes logic to handle different scenarios such as key creation from policy and API looping. A thorough review is required to ensure the correctness of the logic and its impact on existing functionalities.

    🧪 Relevant tests

    No

    🔍 Possible issues

    Possible Bug: The new check introduced in gateway/mw_auth_key.go to skip auth key check if the request is looped might inadvertently allow requests that should otherwise be authenticated or rate-limited. This could lead to security issues or abuse of the API quota limits.

    Performance Concern: The changes in gateway/middleware_test.go and gateway/reverse_proxy_test.go introduce additional logic for session creation and quota assertion. If not optimized, this could lead to slower test execution times, especially when running a large suite of tests.

    🔒 Security concerns

    No

    Code feedback:
    relevant filegateway/mw_auth_key.go
    suggestion      

    Consider adding a detailed comment explaining the rationale behind skipping the auth key check for looped requests. This will help future maintainers understand the specific scenarios this change addresses. [important]

    relevant lineif ses := ctxGetSession(r); ses != nil && !ctxCheckLimits(r) {

    relevant filegateway/reverse_proxy_test.go
    suggestion      

    Refactor the repeated code for creating sessions and asserting quotas into helper functions to improve code readability and maintainability. This will also make it easier to add new test cases in the future. [medium]

    relevant line_, authKey := ts.CreateSession(func(s *user.SessionState) {

    relevant filegateway/middleware_test.go
    suggestion      

    Since the createSessionWithQuota function is removed, ensure that all its previous functionalities are adequately covered by the new session creation logic within the tests to avoid losing any test coverage. [important]

    relevant line-func createSessionWithQuota(tb testing.TB, api *apidef.APIDefinition, quotaMax, quotaRenewalRate int64) *user.SessionState {

    relevant filegateway/reverse_proxy_test.go
    suggestion      

    Ensure that the new test cases cover all possible scenarios introduced by the PR changes, including edge cases that might affect the quota limits and header values. Adding more granular test cases can help catch potential issues early. [medium]

    relevant linet.Run("key without policy", func(t *testing.T) {


    ✨ Review tool usage guide:

    Overview:
    The review tool scans the PR code changes, and generates a PR review which includes several types of feedbacks, such as possible PR issues, security threats and relevant test in the PR. More feedbacks can be added by configuring the tool.

    The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on any PR.

    • When commenting, to edit configurations related to the review tool (pr_reviewer section), use the following template:
    /review --pr_reviewer.some_config1=... --pr_reviewer.some_config2=...
    
    [pr_reviewer]
    some_config1=...
    some_config2=...
    

    See the review usage page for a comprehensive guide on using this tool.

    @github-actions

    github-actions Bot commented Apr 2, 2024

    Copy link
    Copy Markdown
    Contributor

    PR Code Suggestions

    CategorySuggestions                                                                                                                                                       
    Enhancement
    Add logging for skipped auth key checks in looped requests.

    Consider adding logging for the case when the auth key check is skipped due to a looped
    request. This will help in debugging and understanding the flow of requests, especially in
    complex scenarios where it's not immediately clear why a request was allowed without an
    auth key check.

    gateway/mw_auth_key.go [98-100]

     // skip auth key check if the request is looped.
     if ses := ctxGetSession(r); ses != nil && !ctxCheckLimits(r) {
    +    log.Debug("Skipping auth key check for looped request")
         return nil, http.StatusOK
     }
     
    Add detailed error messages or logging for failed test cases in quota assertions.

    For the assertQuota function, consider adding more detailed error messages or logging
    within the test cases to provide clearer feedback when a test fails. This can help quickly
    identify which part of the quota assertion failed.

    gateway/reverse_proxy_test.go [1887-1911]

    -_, _ = ts.Run(t, []test.TestCase{
    +_, results := ts.Run(t, []test.TestCase{
         {
             Headers: authorization,
             Path: "/quota-headers-test/",
             Code: http.StatusOK,
             HeadersMatch: map[string]string{
                 header.XRateLimitLimit:     fmt.Sprintf("%d", quotaMax),
                 header.XRateLimitRemaining: fmt.Sprintf("%d", quotaMax-1),
             },
         },
         {
             Headers: authorization,
             Path: "/quota-headers-test/",
             Code: http.StatusOK,
             HeadersMatch: map[string]string{
                 header.XRateLimitLimit:     fmt.Sprintf("%d", quotaMax),
                 header.XRateLimitRemaining: fmt.Sprintf("%d", quotaMax-2),
             },
         },
         {
             Headers: authorization,
             Path: "/quota-headers-test/abc",
             Code: http.StatusForbidden,
         },
     }...)
    +for _, result := range results {
    +    if !result.Success {
    +        t.Logf("Failed test case: %v", result)
    +    }
    +}
     
    Maintainability
    Refactor session creation and quota assertion into a separate function.

    Refactor the repeated code for creating a session and asserting quota headers into a
    separate function. This will reduce code duplication and improve maintainability.

    gateway/reverse_proxy_test.go [1915-1930]

    -_, authKey := ts.CreateSession(func(s *user.SessionState) {
    -    s.AccessRights = map[string]user.AccessDefinition{
    -        spec.APIID: {
    -            APIName:  spec.Name,
    -            APIID:    spec.APIID,
    -            Versions: []string{"default"},
    -            Limit: user.APILimit{
    -                QuotaMax:         quotaMax,
    -                QuotaRenewalRate: quotaRenewalRate,
    -            },
    -            AllowanceScope: spec.APIID,
    -        },
    -    }
    -    s.OrgID = spec.OrgID
    -})
    -assertQuota(t, ts, authKey)
    +createAndAssertSessionWithQuota(t, ts, spec, quotaMax, quotaRenewalRate)
     
    Best practice
    Use constants for quota values to improve code maintainability.

    Instead of hardcoding the quota values (QuotaMax: 2, QuotaRenewalRate: 3600), consider
    using constants or configuration parameters. This will make it easier to adjust these
    values in the future without having to search through the codebase for hardcoded values.

    gateway/middleware_test.go [426-440]

     _, authKey := ts.CreateSession(func(s *user.SessionState) {
         s.AccessRights = map[string]user.AccessDefinition{
             spec.APIID: {
                 APIName:  spec.Name,
                 APIID:    spec.APIID,
                 Versions: []string{"default"},
                 Limit: user.APILimit{
    -                QuotaMax:         2,
    -                QuotaRenewalRate: 3600,
    +                QuotaMax:         defaultQuotaMax,
    +                QuotaRenewalRate: defaultQuotaRenewalRate,
                 },
                 AllowanceScope: spec.APIID,
             },
         }
         s.OrgID = spec.OrgID
     })
     
    Ensure policy names are unique or dynamically generated in tests.

    When creating policies in tests, ensure that the policy names are unique or dynamically
    generated. This prevents potential conflicts or unintended behavior when tests are run in
    parallel or the test environment is not cleanly reset between test runs.

    gateway/reverse_proxy_test.go [1934-1952]

     polID := ts.CreatePolicy(func(p *user.Policy) {
    -    p.Name = "p1"
    +    p.Name = fmt.Sprintf("p1-%d", time.Now().UnixNano())
         p.KeyExpiresIn = 3600
         p.Partitions = user.PolicyPartitions{
             PerAPI: true,
         }
         p.OrgID = spec.OrgID
         p.AccessRights = map[string]user.AccessDefinition{
             spec.APIID: {
                 APIName:  spec.Name,
                 APIID:    spec.APIID,
                 Versions: []string{"default"},
                 Limit: user.APILimit{
                     QuotaMax:         quotaMax,
                     QuotaRenewalRate: quotaRenewalRate,
                 },
                 AllowanceScope: spec.APIID,
             },
         }
     })
     

    ✨ Improve tool usage guide:

    Overview:
    The improve tool scans the PR code changes, and automatically generates suggestions for improving the PR code. The tool can be triggered automatically every time a new PR is opened, or can be invoked manually by commenting on a PR.

    • When commenting, to edit configurations related to the improve tool (pr_code_suggestions section), use the following template:
    /improve --pr_code_suggestions.some_config1=... --pr_code_suggestions.some_config2=...
    
    [pr_code_suggestions]
    some_config1=...
    some_config2=...
    

    See the improve usage page for a comprehensive guide on using this tool.

    @jeffy-mathew
    jeffy-mathew enabled auto-merge (squash) April 2, 2024 16:05
    @TykTechnologies TykTechnologies deleted a comment from github-actions Bot Apr 2, 2024
    @TykTechnologies TykTechnologies deleted a comment from github-actions Bot Apr 2, 2024
    @sonarqubecloud

    sonarqubecloud Bot commented Apr 2, 2024

    Copy link
    Copy Markdown

    Quality Gate Failed Quality Gate failed

    Failed conditions
    50.0% Coverage on New Code (required ≥ 80%)

    See analysis details on SonarCloud

    @jeffy-mathew
    jeffy-mathew merged commit 83cfda1 into master Apr 2, 2024
    @jeffy-mathew
    jeffy-mathew deleted the fix/TT-10856/TT-11778/fix-incorrect-ratelimit-remaining branch April 2, 2024 16:28
    @jeffy-mathew

    Copy link
    Copy Markdown
    Contributor Author

    /release to release-5.3

    @jeffy-mathew

    Copy link
    Copy Markdown
    Contributor Author

    /release to release-5-lts

    @tykbot

    tykbot Bot commented Apr 2, 2024

    Copy link
    Copy Markdown

    Working on it! Note that it can take a few minutes.

    1 similar comment
    @tykbot

    tykbot Bot commented Apr 2, 2024

    Copy link
    Copy Markdown

    Working on it! Note that it can take a few minutes.

    tykbot Bot pushed a commit that referenced this pull request Apr 2, 2024
    …s created from policy and API is looped (#6199)
    
    ## **User description**
    <!-- Provide a general summary of your changes in the Title above -->
    
    ## Description
    `X-RateLimit-Remaining` header was returning `0` when key was created
    from policy and API is looped with `tyk://self`
    This is because `AuthKey` middleware is calling
    `CheckSessionAndIdentityForValidKey` once again during looping.
    This check can be skipped like what we do for `RateLimitAndQuotaCheck`
    middleware
    ## Related Issue
    
    <!-- This project only accepts pull requests related to open issues. -->
    <!-- If suggesting a new feature or change, please discuss it in an
    issue first. -->
    <!-- If fixing a bug, there should be an issue describing it with steps
    to reproduce. -->
    <!-- OSS: Please link to the issue here. Tyk: please create/link the
    JIRA ticket. -->
    
    ## Motivation and Context
    
    <!-- Why is this change required? What problem does it solve? -->
    
    ## How This Has Been Tested
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    ## Screenshots (if appropriate)
    
    ## Types of changes
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [x] Bug fix (non-breaking change which fixes an issue)
    - [ ] New feature (non-breaking change which adds functionality)
    - [ ] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [ ] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    ## Checklist
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [ ] I ensured that the documentation is up to date
    - [ ] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [ ] I would like a code coverage CI quality gate exception and have
    explained why
    
    
    ___
    
    ## **Type**
    bug_fix
    
    
    ___
    
    ## **Description**
    - Fixed an issue where `X-RateLimit-Remaining` header returned incorrect
    values for looped requests when the key was created from a policy.
    - Refactored test setup for quota middleware to streamline session
    creation.
    - Added comprehensive tests to ensure correct quota headers are returned
    for various key and policy configurations.
    
    
    ___
    
    
    
    ## **Changes walkthrough**
    <table><thead><tr><th></th><th align="left">Relevant
    files</th></tr></thead><tbody><tr><td><strong>Tests</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>middleware_test.go</strong><dd><code>Refactor Test
    Setup for Quota Middleware</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/middleware_test.go
    <li>Removed <code>createSessionWithQuota</code> function as it was
    replaced with a more <br>streamlined session creation in tests.<br> <li>
    Modified <code>TestQuotaNotAppliedWithURLRewrite</code> to use the new
    session <br>creation method.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-6a09a08e3f82cc5e9d8c6b5c8426d75ea1e5d85e15ab008fca1f512e7c49c1e6">+17/-28</a>&nbsp;
    </td>
    </tr>                    
    
    <tr>
      <td>
        <details>
    <summary><strong>reverse_proxy_test.go</strong><dd><code>Extend Tests
    for Quota Response Headers</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/reverse_proxy_test.go
    <li>Added tests to verify correct quota headers for keys without
    policies, <br>keys from policies with per API limits, and keys from
    policies with <br>global limits.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-ce040f6555143f760fba6059744bc600b6954f0966dfb0fa2832b5eabf7a3c3f">+112/-31</a></td>
    </tr>                    
    </table></td></tr><tr><td><strong>Enhancement</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>mw_auth_key.go</strong><dd><code>Skip Auth Key Check
    for Looped Requests</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/mw_auth_key.go
    <li>Added a check to skip auth key verification if the request is looped
    <br>and session limits are not to be checked.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-aeba053023a54c723dd9f83837e29ca0b2d9a212bc98fa6ad4bbb062669a1cf0">+5/-0</a>&nbsp;
    &nbsp; &nbsp; </td>
    </tr>                    
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > ✨ **PR-Agent usage**:
    >Comment `/help` on the PR to get a list of all available PR-Agent tools
    and their descriptions
    
    (cherry picked from commit 83cfda1)
    @tykbot

    tykbot Bot commented Apr 2, 2024

    Copy link
    Copy Markdown

    @jeffy-mathew Succesfully merged PR

    tykbot Bot pushed a commit that referenced this pull request Apr 2, 2024
    …s created from policy and API is looped (#6199)
    
    <!-- Provide a general summary of your changes in the Title above -->
    
    `X-RateLimit-Remaining` header was returning `0` when key was created
    from policy and API is looped with `tyk://self`
    This is because `AuthKey` middleware is calling
    `CheckSessionAndIdentityForValidKey` once again during looping.
    This check can be skipped like what we do for `RateLimitAndQuotaCheck`
    middleware
    
    <!-- This project only accepts pull requests related to open issues. -->
    <!-- If suggesting a new feature or change, please discuss it in an
    issue first. -->
    <!-- If fixing a bug, there should be an issue describing it with steps
    to reproduce. -->
    <!-- OSS: Please link to the issue here. Tyk: please create/link the
    JIRA ticket. -->
    
    <!-- Why is this change required? What problem does it solve? -->
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [x] Bug fix (non-breaking change which fixes an issue)
    - [ ] New feature (non-breaking change which adds functionality)
    - [ ] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [ ] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [ ] I ensured that the documentation is up to date
    - [ ] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [ ] I would like a code coverage CI quality gate exception and have
    explained why
    
    ___
    
    bug_fix
    
    ___
    
    - Fixed an issue where `X-RateLimit-Remaining` header returned incorrect
    values for looped requests when the key was created from a policy.
    - Refactored test setup for quota middleware to streamline session
    creation.
    - Added comprehensive tests to ensure correct quota headers are returned
    for various key and policy configurations.
    
    ___
    
    <table><thead><tr><th></th><th align="left">Relevant
    files</th></tr></thead><tbody><tr><td><strong>Tests</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>middleware_test.go</strong><dd><code>Refactor Test
    Setup for Quota Middleware</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/middleware_test.go
    <li>Removed <code>createSessionWithQuota</code> function as it was
    replaced with a more <br>streamlined session creation in tests.<br> <li>
    Modified <code>TestQuotaNotAppliedWithURLRewrite</code> to use the new
    session <br>creation method.
    
    </details>
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-6a09a08e3f82cc5e9d8c6b5c8426d75ea1e5d85e15ab008fca1f512e7c49c1e6">+17/-28</a>&nbsp;
    </td>
    </tr>
    
    <tr>
      <td>
        <details>
    <summary><strong>reverse_proxy_test.go</strong><dd><code>Extend Tests
    for Quota Response Headers</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/reverse_proxy_test.go
    <li>Added tests to verify correct quota headers for keys without
    policies, <br>keys from policies with per API limits, and keys from
    policies with <br>global limits.
    
    </details>
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-ce040f6555143f760fba6059744bc600b6954f0966dfb0fa2832b5eabf7a3c3f">+112/-31</a></td>
    </tr>
    </table></td></tr><tr><td><strong>Enhancement</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>mw_auth_key.go</strong><dd><code>Skip Auth Key Check
    for Looped Requests</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/mw_auth_key.go
    <li>Added a check to skip auth key verification if the request is looped
    <br>and session limits are not to be checked.
    
    </details>
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-aeba053023a54c723dd9f83837e29ca0b2d9a212bc98fa6ad4bbb062669a1cf0">+5/-0</a>&nbsp;
    &nbsp; &nbsp; </td>
    </tr>
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > ✨ **PR-Agent usage**:
    >Comment `/help` on the PR to get a list of all available PR-Agent tools
    and their descriptions
    
    (cherry picked from commit 83cfda1)
    @tykbot

    tykbot Bot commented Apr 2, 2024

    Copy link
    Copy Markdown

    @jeffy-mathew Succesfully merged PR

    buger added a commit that referenced this pull request Apr 2, 2024
    … header value when key is created from policy and API is looped (#6199)
    
    [TT-10856/TT-11778] fix quota limit remaining header value when key is created from policy and API is looped (#6199)
    
    ## **User description**
    <!-- Provide a general summary of your changes in the Title above -->
    
    ## Description
    `X-RateLimit-Remaining` header was returning `0` when key was created
    from policy and API is looped with `tyk://self`
    This is because `AuthKey` middleware is calling
    `CheckSessionAndIdentityForValidKey` once again during looping.
    This check can be skipped like what we do for `RateLimitAndQuotaCheck`
    middleware
    ## Related Issue
    
    <!-- This project only accepts pull requests related to open issues. -->
    <!-- If suggesting a new feature or change, please discuss it in an
    issue first. -->
    <!-- If fixing a bug, there should be an issue describing it with steps
    to reproduce. -->
    <!-- OSS: Please link to the issue here. Tyk: please create/link the
    JIRA ticket. -->
    
    ## Motivation and Context
    
    <!-- Why is this change required? What problem does it solve? -->
    
    ## How This Has Been Tested
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    ## Screenshots (if appropriate)
    
    ## Types of changes
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [x] Bug fix (non-breaking change which fixes an issue)
    - [ ] New feature (non-breaking change which adds functionality)
    - [ ] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [ ] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    ## Checklist
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [ ] I ensured that the documentation is up to date
    - [ ] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [ ] I would like a code coverage CI quality gate exception and have
    explained why
    
    
    ___
    
    ## **Type**
    bug_fix
    
    
    ___
    
    ## **Description**
    - Fixed an issue where `X-RateLimit-Remaining` header returned incorrect
    values for looped requests when the key was created from a policy.
    - Refactored test setup for quota middleware to streamline session
    creation.
    - Added comprehensive tests to ensure correct quota headers are returned
    for various key and policy configurations.
    
    
    ___
    
    
    
    ## **Changes walkthrough**
    <table><thead><tr><th></th><th align="left">Relevant
    files</th></tr></thead><tbody><tr><td><strong>Tests</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>middleware_test.go</strong><dd><code>Refactor Test
    Setup for Quota Middleware</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/middleware_test.go
    <li>Removed <code>createSessionWithQuota</code> function as it was
    replaced with a more <br>streamlined session creation in tests.<br> <li>
    Modified <code>TestQuotaNotAppliedWithURLRewrite</code> to use the new
    session <br>creation method.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-6a09a08e3f82cc5e9d8c6b5c8426d75ea1e5d85e15ab008fca1f512e7c49c1e6">+17/-28</a>&nbsp;
    </td>
    </tr>                    
    
    <tr>
      <td>
        <details>
    <summary><strong>reverse_proxy_test.go</strong><dd><code>Extend Tests
    for Quota Response Headers</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/reverse_proxy_test.go
    <li>Added tests to verify correct quota headers for keys without
    policies, <br>keys from policies with per API limits, and keys from
    policies with <br>global limits.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-ce040f6555143f760fba6059744bc600b6954f0966dfb0fa2832b5eabf7a3c3f">+112/-31</a></td>
    </tr>                    
    </table></td></tr><tr><td><strong>Enhancement</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>mw_auth_key.go</strong><dd><code>Skip Auth Key Check
    for Looped Requests</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/mw_auth_key.go
    <li>Added a check to skip auth key verification if the request is looped
    <br>and session limits are not to be checked.
    
    
    </details>
        
    
      </td>
    <td><a
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-aeba053023a54c723dd9f83837e29ca0b2d9a212bc98fa6ad4bbb062669a1cf0">+5/-0</a>&nbsp;
    &nbsp; &nbsp; </td>
    </tr>                    
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > ✨ **PR-Agent usage**:
    >Comment `/help` on the PR to get a list of all available PR-Agent tools
    and their descriptions
    jeffy-mathew added a commit that referenced this pull request Apr 2, 2024
    …ng header value when key is created from policy and API is looped (#6199) (#6201)
    
    [TT-10856/TT-11778] fix quota limit remaining header value when key is
    created from policy and API is looped (#6199)
    
    ## **User description**
    <!-- Provide a general summary of your changes in the Title above -->
    
    ## Description
    `X-RateLimit-Remaining` header was returning `0` when key was created
    from policy and API is looped with `tyk://self`
    This is because `AuthKey` middleware is calling
    `CheckSessionAndIdentityForValidKey` once again during looping.
    This check can be skipped like what we do for `RateLimitAndQuotaCheck`
    middleware
    ## Related Issue
    
    <!-- This project only accepts pull requests related to open issues. -->
    <!-- If suggesting a new feature or change, please discuss it in an
    issue first. -->
    <!-- If fixing a bug, there should be an issue describing it with steps
    to reproduce. -->
    <!-- OSS: Please link to the issue here. Tyk: please create/link the
    JIRA ticket. -->
    
    ## Motivation and Context
    
    <!-- Why is this change required? What problem does it solve? -->
    
    ## How This Has Been Tested
    
    <!-- Please describe in detail how you tested your changes -->
    <!-- Include details of your testing environment, and the tests -->
    <!-- you ran to see how your change affects other areas of the code,
    etc. -->
    <!-- This information is helpful for reviewers and QA. -->
    
    ## Screenshots (if appropriate)
    
    ## Types of changes
    
    <!-- What types of changes does your code introduce? Put an `x` in all
    the boxes that apply: -->
    
    - [x] Bug fix (non-breaking change which fixes an issue)
    - [ ] New feature (non-breaking change which adds functionality)
    - [ ] Breaking change (fix or feature that would cause existing
    functionality to change)
    - [ ] Refactoring or add test (improvements in base code or adds test
    coverage to functionality)
    
    ## Checklist
    
    <!-- Go over all the following points, and put an `x` in all the boxes
    that apply -->
    <!-- If there are no documentation updates required, mark the item as
    checked. -->
    <!-- Raise up any additional concerns not covered by the checklist. -->
    
    - [ ] I ensured that the documentation is up to date
    - [ ] I explained why this PR updates go.mod in detail with reasoning
    why it's required
    - [ ] I would like a code coverage CI quality gate exception and have
    explained why
    
    
    ___
    
    ## **Type**
    bug_fix
    
    
    ___
    
    ## **Description**
    - Fixed an issue where `X-RateLimit-Remaining` header returned incorrect
    values for looped requests when the key was created from a policy.
    - Refactored test setup for quota middleware to streamline session
    creation.
    - Added comprehensive tests to ensure correct quota headers are returned
    for various key and policy configurations.
    
    
    ___
    
    
    
    ## **Changes walkthrough**
    <table><thead><tr><th></th><th align="left">Relevant
    
    files</th></tr></thead><tbody><tr><td><strong>Tests</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>middleware_test.go</strong><dd><code>Refactor Test
    Setup for Quota Middleware</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/middleware_test.go
    <li>Removed <code>createSessionWithQuota</code> function as it was
    replaced with a more <br>streamlined session creation in tests.<br> <li>
    Modified <code>TestQuotaNotAppliedWithURLRewrite</code> to use the new
    session <br>creation method.
    
    
    </details>
        
    
      </td>
    <td><a
    
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-6a09a08e3f82cc5e9d8c6b5c8426d75ea1e5d85e15ab008fca1f512e7c49c1e6">+17/-28</a>&nbsp;
    </td>
    </tr>                    
    
    <tr>
      <td>
        <details>
    <summary><strong>reverse_proxy_test.go</strong><dd><code>Extend Tests
    for Quota Response Headers</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/reverse_proxy_test.go
    <li>Added tests to verify correct quota headers for keys without
    policies, <br>keys from policies with per API limits, and keys from
    policies with <br>global limits.
    
    
    </details>
        
    
      </td>
    <td><a
    
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-ce040f6555143f760fba6059744bc600b6954f0966dfb0fa2832b5eabf7a3c3f">+112/-31</a></td>
    </tr>                    
    </table></td></tr><tr><td><strong>Enhancement</strong></td><td><table>
    <tr>
      <td>
        <details>
    <summary><strong>mw_auth_key.go</strong><dd><code>Skip Auth Key Check
    for Looped Requests</code>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
    &nbsp; &nbsp; </dd></summary>
    <hr>
    
    gateway/mw_auth_key.go
    <li>Added a check to skip auth key verification if the request is looped
    <br>and session limits are not to be checked.
    
    
    </details>
        
    
      </td>
    <td><a
    
    href="https://github.com/TykTechnologies/tyk/pull/6199/files#diff-aeba053023a54c723dd9f83837e29ca0b2d9a212bc98fa6ad4bbb062669a1cf0">+5/-0</a>&nbsp;
    &nbsp; &nbsp; </td>
    </tr>                    
    </table></td></tr></tr></tbody></table>
    
    ___
    
    > ✨ **PR-Agent usage**:
    >Comment `/help` on the PR to get a list of all available PR-Agent tools
    and their descriptions
    
    ---------
    
    Co-authored-by: Jeffy Mathew <[email protected]>
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

    Projects

    None yet

    Development

    Successfully merging this pull request may close these issues.

    2 participants