MEN-7733: Rate limits for devices APIs

[alfrunes]

Added adaptive ratelimiting for devices APIs based on the max_devices
limit. Two new configuration options are exposed:

• ratelimits.interval - duration until the quota resets
• ratelimits.quotas - mapping plan names to quota weights. The final
  burst limit is computed as ratelimits.quotas[plan] * max_devices

The rate limiting counter is independent for each API path (independent
of method and version).

I also added caching for getting limits since the rate limiting depends on getting the device limit.

Tip

To test the implementation you can use the following compose override

# mender-server/docker-compose.override.yml
services:
  redis:
    image: redis:7.2
    networks:
      default:
        aliases: [mender-redis]
  deviceauth:
    environment:
      DEVICEAUTH_REDIS_CONNECTION_STRING: "redis://redis"
      DEVICEAUTH_RATELIMITS_QUOTAS: "enterprise=1.0 professional=0.5 os=0.25"
      DEVICEAUTH_RATELIMITS_INTERVAL: "1m"

By manually setting the max devices for the "empty tenant" you can adjust the rate limits for open source:

// By setting the limit to 5, a single device can perform at most 5 requests per minute.
docker compose exec mongo mongosh --eval 'db.getSiblingDB("deviceauth").limits.insertOne({tenant_id: "", name: "max_devices", limit: 5})'

Note

Open source does not have plans, so the RATELIMITS_QUOTAS configuration is ineffectual (but required). The default quota factor is set to 1.0.

[kjaskiewiczz]

I was also wondering if we need it here at all.

[mender-test-bot]

Merging these commits will result in the following changelog entries:

Changelogs

mender-server (MEN-7733)

New changes in mender-server since main:

Features

• Rate limit authenticated devices API

  Added adaptive ratelimiting for devices APIs based on the max_devices
  limit. Two new configuration options are exposed:

  • ratelimits.interval - duration until the quota resets
  • ratelimits.quotas - mapping plan names to quota weights. The final
    burst limit is computed as ratelimits.quotas[plan] * max_devices

  The rate limiting counter is independent for each API path (independent
  of method and version).
  (MEN-7744)

• Add caching for device limits
  (MEN-7760)