api: add ingress request throttling

apps/admin-api/src/main.rs

@@ -1,6 +1,7 @@
 mod app;
 mod auth;
 mod error;
+mod rate_limit;
 mod request_context;
 mod routes;
 mod service;
@@ -20,7 +21,9 @@ use crate::{
     service::AdminService,
     state::AppState,
 };
-use crank_runtime::{RuntimeExecutor, RuntimeLimits, SecretCrypto};
+use crank_runtime::{
+    RequestRateLimitConfig, RequestRateLimiter, RuntimeExecutor, RuntimeLimits, SecretCrypto,
+};
 
 #[tokio::main]
 async fn main() -> Result<(), Box<dyn std::error::Error>> {
@@ -58,6 +61,7 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         },
     };
     let runtime_limits = RuntimeLimits::from_env()?;
+    let api_rate_limit = admin_api_rate_limit_config_from_env()?;
     let secret_crypto = SecretCrypto::new(&env::var("CRANK_MASTER_KEY")?)?;
     let runtime = RuntimeExecutor::with_limits(runtime_limits);
     let service = AdminService::new_with_runtime(
@@ -71,7 +75,10 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
     if env_flag("CRANK_DEMO_SEED") {
         service.seed_demo_assets().await?;
     }
-    let state = AppState { service };
+    let state = AppState {
+        service,
+        api_rate_limiter: RequestRateLimiter::new(api_rate_limit),
+    };
     let app = build_app(state);
     let listener = TcpListener::bind(socket_addr).await?;
 
@@ -80,6 +87,8 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         runtime_max_concurrent_window = runtime_limits.max_concurrent_window,
         runtime_max_concurrent_sessions = runtime_limits.max_concurrent_sessions,
         runtime_max_concurrent_jobs = runtime_limits.max_concurrent_jobs,
+        admin_rate_limit_rps = api_rate_limit.requests_per_second,
+        admin_rate_limit_burst = api_rate_limit.burst,
         max_connections = pool_config.max_connections,
         min_connections = pool_config.min_connections,
         acquire_timeout_ms = pool_config.acquire_timeout_ms,
@@ -105,6 +114,20 @@ fn env_flag(name: &str) -> bool {
     )
 }
 
+fn admin_api_rate_limit_config_from_env()
+-> Result<RequestRateLimitConfig, Box<dyn std::error::Error>> {
+    let requests_per_second = env::var("CRANK_ADMIN_RATE_LIMIT_RPS")
+        .ok()
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(30);
+    let burst = env::var("CRANK_ADMIN_RATE_LIMIT_BURST")
+        .ok()
+        .and_then(|value| value.parse::<u32>().ok())
+        .unwrap_or(60);
+
+    Ok(RequestRateLimitConfig::new(requests_per_second, burst)?)
+}
+
 fn database_options_from_env() -> Result<PgConnectOptions, Box<dyn std::error::Error>> {
     if let Ok(database_url) = env::var("CRANK_DATABASE_URL") {
         return Ok(database_url.parse::<PgConnectOptions>()?);