cubeapi: key the rate limiter on the validated identity, not an unvalidated header - #1380

Open

dwin-gharibi wants to merge 7 commits into

TencentCloud:masterfrom

dwin-gharibi:cubeapi-ratelimit-key-bypass

Commits on Aug 19, 2026

fix(CubeAPI/src/middleware/rate_limit.rs): key the rate limiter on the validated identity, not an unvalidated header
dwin-gharibi
committed
97ebc78
fix(CubeAPI/src/middleware/auth.rs): share one bucket per configured key and correct the limiter docs
dwin-gharibi
committed
cf746be
test(CubeAPI/src/routes.rs): pin the rotating X-API-Key bypass at the router level
dwin-gharibi
committed
3ed7ef4
fix(CubeAPI/src/middleware/rate_limit.rs): assert unified_auth runs first and correct the per-identity docs
dwin-gharibi
committed
b06a526
test(CubeAPI/src/routes.rs): cover callback-mode multi-tenant bucket isolation
dwin-gharibi
committed
874fdb4
fix(CubeAPI/src/middleware/auth.rs): hash rate-limit identities instead of storing raw credentials
dwin-gharibi
committed
d7653f9
test(CubeAPI/src/state.rs): cover retain_recent keeping active buckets and reclaiming idle keys
dwin-gharibi
committed
5f48af7