[TT-12339] Missing schema updates for enforce timeout by MaciekMis · Pull Request #8319 · TykTechnologies/tyk

MaciekMis · 2026-06-15T13:41:39Z

Description

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)
Refactoring or add test (improvements in base code or adds test coverage to functionality)

Checklist

I ensured that the documentation is up to date
I explained why this PR updates go.mod in detail with reasoning why it's required
I would like a code coverage CI quality gate exception and have explained why

probelabs · 2026-06-15T13:42:39Z

This PR updates the JSON schemas for API definitions to formally support sub-second precision for the enforce timeout middleware. It introduces a new duration field, which accepts a string (e.g., "500ms"), and makes the existing integer-based value field optional to align the schema with existing backend capabilities.

Files Changed Analysis

apidef/mcp/schema/x-tyk-api-gateway.json: Updated the MCP schema to include the duration field and relax the requirement for the value field.
apidef/streams/schema/x-tyk-api-gateway.json: Applied an identical schema change for stream-based APIs, ensuring configuration consistency.

The changes are minimal and consistent across both schema files, indicating a standardized update to the timeout configuration.

Architecture & Impact Assessment

What this PR accomplishes: It aligns the API definition schema with the gateway's existing capability to handle sub-second timeouts, as evidenced by the tyktime.ReadableDuration type in the EnforceTimeout Go struct. This ensures that API configurations using this feature can be correctly validated.
Key technical changes introduced:
- A duration string field has been added to the timeout configuration schema with a regex pattern (^(\\d+(?:\\.\d+)?m)?(\\d+(?:\\.\d+)?s)?(\\d+(?:\\.\d+)?ms)?$) for validation.
- The existing value field (integer for seconds) is no longer required, providing backward compatibility while encouraging the use of the more precise duration field.
Affected system components:
- API Schema Validation: Systems validating API definitions against these schemas will now recognize and validate the duration field.
- Management Control Plane (MCP) & Dashboard: The MCP and any UI (like the Tyk Dashboard) that generates API definitions will need to be aware of this new field to expose it to users.
- API Gateway: The gateway's configuration loading mechanism consumes this value. The code in tyk/gateway/reverse_proxy.go shows that the gateway already prioritizes a duration-based value (TimeoutDuration) over the seconds-based one.

Configuration Flow

sequenceDiagram
    participant User as User/Admin
    participant Dashboard as Tyk Dashboard/API
    participant ControlPlane as Control Plane
    participant Gateway as Tyk Gateway

    User->>Dashboard: Configures API with timeout "500ms"
    Dashboard->>ControlPlane: Sends API Definition with `"duration": "500ms"`
    ControlPlane->>ControlPlane: Validates definition against updated JSON schema
    ControlPlane->>Gateway: Pushes validated API definition
    Gateway->>Gateway: Loads config into `apidef.EnforceTimeout` struct
    Note over Gateway: At runtime, `GetEnforcedTimeoutSettings` reads this value to apply the timeout.

Scope Discovery & Context Expansion

The PR title "Missing schema updates" and the existence of the Duration field in the Go struct apidef.oas.middleware.EnforceTimeout confirm that this is a schema-only change to match a pre-existing backend implementation. The core logic for handling sub-second timeouts is already present in the gateway.

The primary impact is on the configuration and validation layers. By making the schema accurate, it prevents valid configurations from being rejected and enables tooling to correctly present this option to users.

However, the change introduces a potential misconfiguration risk. By making both value and duration optional while enabled is true, a user could enable the timeout without specifying a value. Reviewers should consider if the schema should enforce that at least one of value or duration is present when the feature is enabled, for example, by using a conditional schema (if/then with anyOf).

References

Go Struct Definition: tyk/apidef/oas/middleware.go#EnforceTimeout
Gateway Timeout Logic: tyk/gateway/reverse_proxy.go#GetEnforcedTimeoutSettings

Metadata

Review Effort: 1 / 5
Primary Label: bug

Powered by Visor from Probelabs

Last updated: 2026-06-17T04:32:21.921Z | Triggered by: pr_updated | Commit: 22b15b8

💡 TIP: You can chat with Visor using /visor ask <your question>

github-actions · 2026-06-15T13:42:39Z

🎯 Recommended Merge Targets

Based on JIRA ticket TT-12339: [BE] Implement sub-second timeout for the Enforced Timeout middleware

Fix Version: Tyk 5.14.0

⚠️ Warning: Expected release branches not found in repository

Required:

master - No matching release branches found. Fix will be included in future releases.

📋 Workflow

Merge this PR to master first

probelabs · 2026-06-15T13:43:06Z

Security Issues (2)

Severity	Location	Issue
🟡 Warning	`apidef/mcp/schema/x-tyk-api-gateway.json:729`	The regex pattern for the `duration` field allows an empty string as a valid value because all its components are optional. This could lead to a Denial of Service (DoS) if the backend logic interprets an empty timeout duration as zero or infinite, causing requests to either fail immediately or hang indefinitely, consuming server resources. The schema should enforce that at least one duration component (m, s, or ms) is provided. 💡 Suggestion Modify the regex to ensure that it does not match an empty string. A positive lookahead can be used to assert that the string is not empty and contains at least one digit. 🔧 Suggested Fix `"pattern": "^(?=.*\\d)(\\d+(?:\\.\\d+)?m)?(\\d+(?:\\.\\d+)?s)?(\\d+(?:\\.\\d+)?ms)?$"`
🟡 Warning	`apidef/streams/schema/x-tyk-api-gateway.json:690`	The regex pattern for the `duration` field allows an empty string as a valid value because all its components are optional. This could lead to a Denial of Service (DoS) if the backend logic interprets an empty timeout duration as zero or infinite, causing requests to either fail immediately or hang indefinitely, consuming server resources. The schema should enforce that at least one duration component (m, s, or ms) is provided. 💡 Suggestion Modify the regex to ensure that it does not match an empty string. A positive lookahead can be used to assert that the string is not empty and contains at least one digit. 🔧 Suggested Fix `"pattern": "^(?=.*\\d)(\\d+(?:\\.\\d+)?m)?(\\d+(?:\\.\\d+)?s)?(\\d+(?:\\.\\d+)?ms)?$"`

Security Issues (2)

Severity	Location	Issue
🟡 Warning	`apidef/mcp/schema/x-tyk-api-gateway.json:729`	The regex pattern for the `duration` field allows an empty string as a valid value because all its components are optional. This could lead to a Denial of Service (DoS) if the backend logic interprets an empty timeout duration as zero or infinite, causing requests to either fail immediately or hang indefinitely, consuming server resources. The schema should enforce that at least one duration component (m, s, or ms) is provided. 💡 Suggestion Modify the regex to ensure that it does not match an empty string. A positive lookahead can be used to assert that the string is not empty and contains at least one digit. 🔧 Suggested Fix `"pattern": "^(?=.*\\d)(\\d+(?:\\.\\d+)?m)?(\\d+(?:\\.\\d+)?s)?(\\d+(?:\\.\\d+)?ms)?$"`
🟡 Warning	`apidef/streams/schema/x-tyk-api-gateway.json:690`	The regex pattern for the `duration` field allows an empty string as a valid value because all its components are optional. This could lead to a Denial of Service (DoS) if the backend logic interprets an empty timeout duration as zero or infinite, causing requests to either fail immediately or hang indefinitely, consuming server resources. The schema should enforce that at least one duration component (m, s, or ms) is provided. 💡 Suggestion Modify the regex to ensure that it does not match an empty string. A positive lookahead can be used to assert that the string is not empty and contains at least one digit. 🔧 Suggested Fix `"pattern": "^(?=.*\\d)(\\d+(?:\\.\\d+)?m)?(\\d+(?:\\.\\d+)?s)?(\\d+(?:\\.\\d+)?ms)?$"`

\n\n ### Architecture Issues (2)

Severity	Location	Issue
🟡 Warning	`apidef/mcp/schema/x-tyk-api-gateway.json:732`	The schema for `X-Tyk-EnforceTimeout` allows the feature to be enabled without specifying a timeout value. By making `value` optional and only requiring `enabled`, a configuration with `"enabled": true` but no `duration` or `value` becomes valid according to the schema. This can lead to unexpected behavior or require defensive error handling in the backend, whereas the schema should enforce a valid configuration. Additionally, the regex for the new `duration` field (`^(\d+(?:\.\d+)?m)?(\d+(?:\.\d+)?s)?(\d+(?:\.\d+)?ms)?$`) incorrectly validates an empty string, as all its components are optional. 💡 Suggestion Strengthen the schema to require either `value` or `duration` when `enabled` is `true`. This can be achieved using JSON Schema's conditional subschemas (e.g., `if`/`then` with `anyOf`). Also, update the regex for `duration` to prevent it from matching an empty string, for instance, by using a positive lookahead: `^(?=.+)(\d+(?:\.\d+)?m)?(\d+(?:\.\d+)?s)?(\d+(?:\.\d+)?ms)?$`.
🟡 Warning	`apidef/streams/schema/x-tyk-api-gateway.json:692`	The schema for `X-Tyk-EnforceTimeout` allows the feature to be enabled without specifying a timeout value. By making `value` optional and only requiring `enabled`, a configuration with `"enabled": true` but no `duration` or `value` becomes valid according to the schema. This can lead to unexpected behavior or require defensive error handling in the backend, whereas the schema should enforce a valid configuration. Additionally, the regex for the new `duration` field (`^(\d+(?:\.\d+)?m)?(\d+(?:\.\d+)?s)?(\d+(?:\.\d+)?ms)?$`) incorrectly validates an empty string, as all its components are optional. 💡 Suggestion Strengthen the schema to require either `value` or `duration` when `enabled` is `true`. This can be achieved using JSON Schema's conditional subschemas (e.g., `if`/`then` with `anyOf`). Also, update the regex for `duration` to prevent it from matching an empty string, for instance, by using a positive lookahead: `^(?=.+)(\d+(?:\.\d+)?m)?(\d+(?:\.\d+)?s)?(\d+(?:\.\d+)?ms)?$`.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Quality Issues (4)

Severity	Location	Issue
🟠 Error	`apidef/mcp/schema/x-tyk-api-gateway.json:728`	The regex pattern for the 'duration' field allows an empty string as a valid value because all its components are optional. An empty string is not a valid duration and could lead to unexpected behavior or runtime errors if not handled properly by the consumer. 💡 Suggestion To prevent empty strings from being considered valid durations, add a `minLength: 1` constraint to the `duration` property. This ensures that the string must contain at least one character, forcing a duration value to be specified.
🟠 Error	`apidef/mcp/schema/x-tyk-api-gateway.json:732`	The schema only requires the 'enabled' field to be present. If 'enabled' is set to true, neither 'value' nor the new 'duration' field is required. This could lead to a configuration where the timeout is enabled but no timeout value is specified, potentially causing runtime errors or unexpected default behavior. 💡 Suggestion Use conditional validation to ensure that if 'enabled' is true, at least one of 'value' or 'duration' is provided. This can be achieved using an 'if-then' construct with 'anyOf' in the JSON schema.
🟠 Error	`apidef/streams/schema/x-tyk-api-gateway.json:689`	The regex pattern for the 'duration' field allows an empty string as a valid value because all its components are optional. An empty string is not a valid duration and could lead to unexpected behavior or runtime errors if not handled properly by the consumer. 💡 Suggestion To prevent empty strings from being considered valid durations, add a `minLength: 1` constraint to the `duration` property. This ensures that the string must contain at least one character, forcing a duration value to be specified.
🟠 Error	`apidef/streams/schema/x-tyk-api-gateway.json:693`	The schema only requires the 'enabled' field to be present. If 'enabled' is set to true, neither 'value' nor the new 'duration' field is required. This could lead to a configuration where the timeout is enabled but no timeout value is specified, potentially causing runtime errors or unexpected default behavior. 💡 Suggestion Use conditional validation to ensure that if 'enabled' is true, at least one of 'value' or 'duration' is provided. This can be achieved using an 'if-then' construct with 'anyOf' in the JSON schema.

Powered by Visor from Probelabs

Last updated: 2026-06-17T04:31:30.801Z | Triggered by: pr_updated | Commit: 22b15b8

💡 TIP: You can chat with Visor using /visor ask <your question>

…or-the-enforced-timeout-middleware-missing-schemas

sentinelone-cnapp-eu1 · 2026-06-17T04:29:28Z

SentinelOne CNS Hardcoded Secret Detector
✅ Congratulations, your code is safe

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

github-actions · 2026-06-17T04:29:54Z

🚨 Jira Linter Failed

Commit: 22b15b8
Failed at: 2026-06-17 04:29:52 UTC

The Jira linter failed to validate your PR. Please check the error details below:

🔍 Click to view error details

failed to get Jira issue: failed to fetch Jira issue TT-12339: Issue does not exist or you do not have permission to see it.: request failed. Please analyze the request body for more details. Status code: 404

Next Steps

Ensure your branch name contains a valid Jira ticket ID (e.g., ABC-123)
Verify your PR title matches the branch's Jira ticket ID
Check that the Jira ticket exists and is accessible

This comment will be automatically deleted once the linter passes.

sonarqubecloud · 2026-06-17T05:04:32Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

missing schemas

03bc1eb

MaciekMis requested a review from kofoworola June 15, 2026 13:41

kofoworola approved these changes Jun 15, 2026

View reviewed changes

Merge branch 'master' into TT-12339-be-implement-sub-second-timeout-f…

22b15b8

…or-the-enforced-timeout-middleware-missing-schemas

radkrawczyk merged commit f5c944c into master Jun 17, 2026
53 of 56 checks passed

radkrawczyk deleted the TT-12339-be-implement-sub-second-timeout-for-the-enforced-timeout-middleware-missing-schemas branch June 17, 2026 08:09

mativm02 mentioned this pull request Jun 17, 2026

[TT-17515] Sub-second enforced timeout for Tyk Classic (duration field + round-up) #8332

Closed

4 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[TT-12339] Missing schema updates for enforce timeout#8319

[TT-12339] Missing schema updates for enforce timeout#8319
radkrawczyk merged 2 commits into
masterfrom
TT-12339-be-implement-sub-second-timeout-for-the-enforced-timeout-middleware-missing-schemas

MaciekMis commented Jun 15, 2026

Uh oh!

probelabs Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

probelabs Bot commented Jun 15, 2026 •

edited

Loading

Uh oh!

sentinelone-cnapp-eu1 Bot commented Jun 17, 2026

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

sonarqubecloud Bot commented Jun 17, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

MaciekMis commented Jun 15, 2026

Description

Related Issue

Motivation and Context

How This Has Been Tested

Screenshots (if appropriate)

Types of changes

Checklist

Uh oh!

probelabs Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Files Changed Analysis

Architecture & Impact Assessment

Configuration Flow

Scope Discovery & Context Expansion

References

Uh oh!

github-actions Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎯 Recommended Merge Targets

Fix Version: Tyk 5.14.0

📋 Workflow

Uh oh!

probelabs Bot commented Jun 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Security Issues (2)

Security Issues (2)

✅ Performance Check Passed

Quality Issues (4)

Uh oh!

sentinelone-cnapp-eu1 Bot commented Jun 17, 2026

SentinelOne CNS is a cloud-agnostic, agentless CSPM & CWPP solution that continuously detects and prevents vulnerabilities that have the highest probability of being exploited in Azure, AWS, Google Cloud, and Kubernetes.

Uh oh!

github-actions Bot commented Jun 17, 2026

🚨 Jira Linter Failed

Next Steps

Uh oh!

sonarqubecloud Bot commented Jun 17, 2026

Quality Gate passed

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

probelabs Bot commented Jun 15, 2026 •

edited

Loading

github-actions Bot commented Jun 15, 2026 •

edited

Loading

probelabs Bot commented Jun 15, 2026 •

edited

Loading