Repository navigation
feat(identity): escalating signature-throttle policy and instrumentation seam (2/3) - #2602
Open
SurbhiAgarwal1 wants to merge 2 commits into
Open
SurbhiAgarwal1 wants to merge 2 commits into
SurbhiAgarwal1 wants to merge 2 commits into
Conversation
…servation vocabulary (1/3) Part 1 of 3 for LFDT-Panurus#1643 (supersedes LFDT-Panurus#2439 from LFDT-Panurus#2084), addressing review feedback: - ratelimit: require canReclaimIdleBucket (idle >= idleTTL and accrued >= max(b.burst, s.burst)) before evicting idle buckets so slow overrides are never refunded a full default burst after idleTTL - ratelimit: replace O(maxKeys) eviction scan with O(1) intrusive doubly-linked LRU lists for non-overridden and overridden buckets, admit new keys at the MRU head under saturation while bounding initial tokens via minEvictedTokens, and reclaim abandoned overrides on bounded sets - sigobserve: quote non-enum Op, Role, and Outcome values in AuditLogger to prevent log injection, guard nil receiver/field and nil clock function in AuditLogger.SetNow, and preserve driver.Verifier in InstrumentSigner when driver.SigningIdentity is not implemented Co-authored-by: Effi-S <effi.szt@gmail.com> Signed-off-by: Effi-S <effi.szt@gmail.com> Signed-off-by: Surbhi Agarwal <SurbhiAgarwal1@users.noreply.github.com>
…ion seam (2/3) Part 2 of 3 for LFDT-Panurus#1643 (supersedes LFDT-Panurus#2440 from LFDT-Panurus#2084): - sigpolicy: introduces Stack bundling policy observers, gates, and lifecycle management - throttle: introduces the Escalator policy engine with automated multi-tier throttling (normal, soft, blocked), configurable duration/error thresholds, and O(1) LRU eviction - principalkey: introduces enrollment-ID principal-key resolver to prevent pseudonym rotation bypass - sigobserve: adds <empty> sentinel handling and unattributed principal support to prevent shared bucket collisions - ratelimit: adds EvictIdleNow for deterministic sweep control and settles idle gap at the old override rate on ClearRate - token: wires signature gating, options, and instrumentation seams across deserializer, provider, and TMS Co-authored-by: Effi-S <effi.szt@gmail.com> Signed-off-by: Effi-S <effi.szt@gmail.com> Signed-off-by: Surbhi Agarwal <SurbhiAgarwal1@users.noreply.github.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part 2 of 3 for #1643 (supersedes #2440 from #2084, co-authored with @Effi-S). Stacks on #2531.
Adds the policy engine, throttle configuration, and makes the signature services instrumentable, while leaving the feature dormant (no driver wires it yet, so the observer stays
Nopand the gate staysnilwith zero behavior change or hot-path overhead until activated in Part 3):token/services/identity/throttle:Escalatorimplementing bothObserverandGate, automated multi-tier throttling (Normal,Soft,Blocked), sliding violation window, cooldown recovery, block re-arming, memory bounding via O(1) LRU eviction lists (lruNormal,lruSoft), andConfigwith validated defaults.token/services/identity/sigpolicy:Stackassembling policy observers and gates behind a unified lifecycle interface.token/principalkey.go:enrollmentKeyResolvermapping rotating anonymous pseudonyms to stable enrollment IDs (eid:...) from local audit information so pseudonym rotation cannot bypass per-principal quotas.token/services/identity/sigobserve&token/services/ratelimit: Added<empty>sentinel andunattributed()handling inaudit.go, and addedEvictIdleNow()alongside old-rate override settling inClearRate.token/sig.go: The single gated surface with theSignatureThrottledsentinel,WithSignatureObserver/WithSignatureGate/WithPrincipalKeyResolveroptions, and theallow()helper.token/core/common/deserializer.go&token/services/identity/provider.go:SetObserverand instrumentation of verifier and signer operations with a lock-freeNopfast path.token/core/common/tms.go&token/tms.go:SignatureInstrumentationplumbing and enrollment key resolver wiring so drivers can install the stack.Tests
stack_test.go,config_test.go,escalator_test.go,principalkey_test.go,sig_gate_test.go,deserializer_observe_test.go,provider_observe_test.go, andtms_test.go.Part of #1643
Supersedes #2440