Remove global API key rate limiter

Author: Theodus

graph-gateway/src/config.rs

@@ -29,6 +29,10 @@ pub struct Config {
     /// IPFS endpoint with access to the subgraph files
     #[serde_as(as = "DisplayFromStr")]
     pub ipfs: Url,
+    /// IP rate limit per window
+    pub ip_rate_limit: u16,
+    /// Duration of IP rate limiting window in seconds
+    pub ip_rate_limit_window_secs: u8,
     /// See https://github.com/confluentinc/librdkafka/blob/master/CONFIGURATION.md
     #[serde(default)]
     pub kafka: KafkaConfig,
@@ -44,14 +48,6 @@ pub struct Config {
     pub port_metrics: u16,
     pub query_budget_discount: f64,
     pub query_budget_scale: f64,
-    /// Duration of API rate limiting window in seconds
-    pub rate_limit_api_window_secs: u8,
-    /// API rate limit per window
-    pub rate_limit_api_limit: u16,
-    /// Duration of IP rate limiting window in seconds
-    pub rate_limit_ip_window_secs: u8,
-    /// IP rate limit per window
-    pub rate_limit_ip_limit: u16,
     pub restricted_deployments: Option<PathBuf>,
     /// Mnemonic for voucher signing
     #[serde_as(as = "DisplayFromStr")]

graph-gateway/src/main.rs

@@ -257,24 +257,20 @@ async fn main() {
             .expect("Failed to start metrics server")
     });
     let ip_rate_limiter = RateLimiter::<String>::new(
-        config.rate_limit_ip_limit as usize,
-        config.rate_limit_ip_window_secs as usize,
-    );
-    let api_rate_limiter = RateLimiter::<String>::new(
-        config.rate_limit_api_limit as usize,
-        config.rate_limit_ip_window_secs as usize,
+        config.ip_rate_limit as usize,
+        config.ip_rate_limit_window_secs as usize,
     );
     HttpServer::new(move || {
         let cors = Cors::default()
             .allow_any_origin()
             .allow_any_header()
             .allowed_methods(vec!["POST", "OPTIONS"]);
         let api = web::scope("/api")
-            .wrap(cors)
             .wrap(RateLimiterMiddleware {
-                rate_limiter: api_rate_limiter.clone(),
-                key: request_api_key,
+                rate_limiter: ip_rate_limiter.clone(),
+                key: request_host,
             })
+            .wrap(cors)
             .app_data(web::Data::new(client_query_ctx.clone()))
             .app_data(web::JsonConfig::default().error_handler(|err, _| {
                 actix_web::error::InternalError::from_response(
@@ -364,14 +360,6 @@ where
         .forever();
 }
 
-fn request_api_key(request: &ServiceRequest) -> String {
-    format!(
-        "{}/{}",
-        request_host(request),
-        request.match_info().get("api_key").unwrap_or("")
-    )
-}
-
 fn request_host(request: &ServiceRequest) -> String {
     let info = request.connection_info();
     info.realip_remote_addr()