-
Notifications
You must be signed in to change notification settings - Fork 9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Dataset Observability #311
Conversation
…a_volume and route and helper functions
api-service/src/controllers/DataMetrics/DataMetricsController.ts
Dismissed
Show dismissed
Hide dismissed
This reverts commit cb0c60a.
|
||
export const router = express.Router(); | ||
|
||
router.post("/data/in/:datasetId", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); | ||
router.post("/data/query/:datasetId", setDataToRequestObject("api.data.out"), onRequest({ entity: Entity.Data_out }), checkRBAC.handler(), dataOut); | ||
router.post("/data/in/:dataset_id", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce rate limiting to the Express application. The best way to do this is by using the express-rate-limit
package, which allows us to set a maximum number of requests that can be made to the server within a specified time window. We will apply this rate limiter to all routes to ensure that the application is protected from excessive requests.
- Install the
express-rate-limit
package. - Import the
express-rate-limit
package in theRouter.ts
file. - Set up a rate limiter with a reasonable configuration (e.g., 100 requests per 15 minutes).
- Apply the rate limiter to all routes using
app.use(limiter)
.
-
Copy modified lines R36-R41 -
Copy modified lines R74-R76
@@ -35,2 +35,8 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
const limiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
@@ -67 +73,4 @@ | ||
router.post("/dataset/metrics", setDataToRequestObject("api.dataset.metrics"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetMetrics); | ||
|
||
// Apply rate limiter to all routes | ||
router.use(limiter); |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
router.post("/data/in/:datasetId", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); | ||
router.post("/data/query/:datasetId", setDataToRequestObject("api.data.out"), onRequest({ entity: Entity.Data_out }), checkRBAC.handler(), dataOut); | ||
router.post("/data/in/:dataset_id", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); | ||
router.post("/data/query/:dataset_id", setDataToRequestObject("api.data.out"), onRequest({ entity: Entity.Data_out }), checkRBAC.handler(), dataOut); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce rate limiting to the route handler on line 40. The best way to do this is by using the express-rate-limit
package, which allows us to easily set up rate limiting for our Express application. We will create a rate limiter with a specified window and maximum number of requests, and then apply this rate limiter to the relevant route.
- Install the
express-rate-limit
package if it is not already installed. - Import the
express-rate-limit
package in theRouter.ts
file. - Create a rate limiter with the desired configuration.
- Apply the rate limiter to the route handler on line 40.
-
Copy modified lines R36-R41 -
Copy modified line R46
@@ -35,2 +35,8 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
const limiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
@@ -39,3 +45,3 @@ | ||
router.post("/data/in/:dataset_id", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); | ||
router.post("/data/query/:dataset_id", setDataToRequestObject("api.data.out"), onRequest({ entity: Entity.Data_out }), checkRBAC.handler(), dataOut); | ||
router.post("/data/query/:dataset_id", limiter, setDataToRequestObject("api.data.out"), onRequest({ entity: Entity.Data_out }), checkRBAC.handler(), dataOut); | ||
router.post("/datasets/create", setDataToRequestObject("api.datasets.create"), onRequest({ entity: Entity.Management }),telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(),DatasetCreate) |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
router.post("/datasets/create", setDataToRequestObject("api.datasets.create"), onRequest({ entity: Entity.Management }),telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(),DatasetCreate) | ||
router.patch("/datasets/update", setDataToRequestObject("api.datasets.update"), onRequest({ entity: Entity.Management }),telemetryAuditStart({action: telemetryActions.updateDataset, operationType: OperationType.UPDATE}), checkRBAC.handler(), DatasetUpdate) | ||
router.get("/datasets/read/:dataset_id", setDataToRequestObject("api.datasets.read"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.readDataset, operationType: OperationType.GET}), checkRBAC.handler(), DatasetRead) | ||
router.post("/datasets/list", setDataToRequestObject("api.datasets.list"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.listDatasets, operationType: OperationType.LIST}), checkRBAC.handler(), DatasetList) | ||
router.get("/data/exhaust/:datasetId", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.get("/data/exhaust/:dataset_id", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce a rate-limiting middleware to the Express application. The express-rate-limit
package is a well-known library for this purpose. We will set up a rate limiter and apply it to the specific route handler that performs authorization.
- Install the
express-rate-limit
package. - Import the
express-rate-limit
package in the file. - Set up a rate limiter with appropriate configuration.
- Apply the rate limiter to the route handler that performs authorization.
-
Copy modified lines R36-R41 -
Copy modified line R51
@@ -35,2 +35,8 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
const limiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
@@ -44,3 +50,3 @@ | ||
router.post("/datasets/list", setDataToRequestObject("api.datasets.list"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.listDatasets, operationType: OperationType.LIST}), checkRBAC.handler(), DatasetList) | ||
router.get("/data/exhaust/:dataset_id", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.get("/data/exhaust/:dataset_id", limiter, setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.post("/template/create", setDataToRequestObject("api.query.template.create"), checkRBAC.handler(), createQueryTemplate); |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
router.post("/datasets/create", setDataToRequestObject("api.datasets.create"), onRequest({ entity: Entity.Management }),telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(),DatasetCreate) | ||
router.patch("/datasets/update", setDataToRequestObject("api.datasets.update"), onRequest({ entity: Entity.Management }),telemetryAuditStart({action: telemetryActions.updateDataset, operationType: OperationType.UPDATE}), checkRBAC.handler(), DatasetUpdate) | ||
router.get("/datasets/read/:dataset_id", setDataToRequestObject("api.datasets.read"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.readDataset, operationType: OperationType.GET}), checkRBAC.handler(), DatasetRead) | ||
router.post("/datasets/list", setDataToRequestObject("api.datasets.list"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.listDatasets, operationType: OperationType.LIST}), checkRBAC.handler(), DatasetList) | ||
router.get("/data/exhaust/:datasetId", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.get("/data/exhaust/:dataset_id", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce rate limiting to the dataExhaust
route handler. The best way to achieve this is by using the express-rate-limit
middleware. This middleware allows us to set a maximum number of requests that can be made to the route within a specified time window. We will apply this middleware to the dataExhaust
route to ensure it is protected against excessive requests.
- Install the
express-rate-limit
package if it is not already installed. - Import the
express-rate-limit
package in theRouter.ts
file. - Create a rate limiter with appropriate settings (e.g., maximum 100 requests per 15 minutes).
- Apply the rate limiter to the
dataExhaust
route.
-
Copy modified lines R36-R41 -
Copy modified line R51
@@ -35,2 +35,8 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
const dataExhaustLimiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
@@ -44,3 +50,3 @@ | ||
router.post("/datasets/list", setDataToRequestObject("api.datasets.list"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.listDatasets, operationType: OperationType.LIST}), checkRBAC.handler(), DatasetList) | ||
router.get("/data/exhaust/:dataset_id", setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.get("/data/exhaust/:dataset_id", dataExhaustLimiter, setDataToRequestObject("api.data.exhaust"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.datasetExhaust, operationType: OperationType.GET}), checkRBAC.handler(), dataExhaust); | ||
router.post("/template/create", setDataToRequestObject("api.query.template.create"), checkRBAC.handler(), createQueryTemplate); |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
@@ -52,7 +53,7 @@ | |||
router.post("/files/generate-url", setDataToRequestObject("api.files.generate-url"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), GenerateSignedURL); | |||
router.post("/datasets/status-transition", setDataToRequestObject("api.datasets.status-transition"), onRequest({ entity: Entity.Management }), telemetryAuditStart({action: telemetryActions.createTransformation, operationType: OperationType.CREATE}), checkRBAC.handler(), DatasetStatusTansition); | |||
router.post("/datasets/health", setDataToRequestObject("api.dataset.health"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetHealth); | |||
router.post("/datasets/reset/:datasetId", setDataToRequestObject("api.dataset.reset"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetReset); | |||
router.post("/datasets/reset/:dataset_id", setDataToRequestObject("api.dataset.reset"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetReset); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce rate limiting to the route handler on line 56. The best way to do this is by using the express-rate-limit
package, which allows us to easily set up rate limiting for specific routes or the entire application.
- Install the
express-rate-limit
package. - Import the
express-rate-limit
package in theRouter.ts
file. - Set up a rate limiter with appropriate configuration (e.g., maximum number of requests per minute).
- Apply the rate limiter to the specific route handler on line 56.
-
Copy modified lines R36-R41 -
Copy modified line R62
@@ -35,2 +35,8 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
const limiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
@@ -55,3 +61,3 @@ | ||
router.post("/datasets/health", setDataToRequestObject("api.dataset.health"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetHealth); | ||
router.post("/datasets/reset/:dataset_id", setDataToRequestObject("api.dataset.reset"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetReset); | ||
router.post("/datasets/reset/:dataset_id", limiter, setDataToRequestObject("api.dataset.reset"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetReset); | ||
router.post("/datasets/dataschema", setDataToRequestObject("api.datasets.dataschema"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), DataSchemaGenerator); |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
router.post("/data/metrics", setDataToRequestObject("api.data.metrics"), onRequest({ entity: Entity.Data_out }), datasetMetrics) | ||
|
||
router.post("/data/metrics", setDataToRequestObject("api.data.metrics"), onRequest({ entity: Entity.Data_out }), dataMetrics) | ||
router.post("/dataset/metrics", setDataToRequestObject("api.dataset.metrics"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetMetrics); |
Check failure
Code scanning / CodeQL
Missing rate limiting High
authorization
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix AI 23 days ago
To fix the problem, we need to introduce rate limiting to the Express application. The best way to do this is by using the express-rate-limit
package, which allows us to set up rate limiting middleware easily. We will configure the rate limiter to allow a maximum of 100 requests per 15 minutes and apply it to the specific route handler that performs authorization.
- Install the
express-rate-limit
package. - Import the
express-rate-limit
package in theRouter.ts
file. - Configure the rate limiter with the desired settings.
- Apply the rate limiter to the specific route handler.
-
Copy modified line R36 -
Copy modified lines R67-R72
@@ -35,5 +35,5 @@ | ||
import datasetMetrics from "../controllers/DatasetMetrics/DatasetMetricsController"; | ||
import rateLimit from "express-rate-limit"; | ||
|
||
export const router = express.Router(); | ||
|
||
router.post("/data/in/:dataset_id", setDataToRequestObject("api.data.in"), onRequest({ entity: Entity.Data_in }), telemetryAuditStart({action: telemetryActions.createDataset, operationType: OperationType.CREATE}), checkRBAC.handler(), dataIn); | ||
@@ -66,2 +66,7 @@ | ||
router.post("/data/metrics", setDataToRequestObject("api.data.metrics"), onRequest({ entity: Entity.Data_out }), dataMetrics) | ||
router.post("/dataset/metrics", setDataToRequestObject("api.dataset.metrics"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetMetrics); | ||
const limiter = rateLimit({ | ||
windowMs: 15 * 60 * 1000, // 15 minutes | ||
max: 100, // limit each IP to 100 requests per windowMs | ||
}); | ||
|
||
router.post("/dataset/metrics", limiter, setDataToRequestObject("api.dataset.metrics"), onRequest({ entity: Entity.Management }), checkRBAC.handler(), datasetMetrics); |
-
Copy modified lines R69-R70
@@ -68,3 +68,4 @@ | ||
"winston": "~2.4.3", | ||
"winston-daily-rotate-file": "~3.2.1" | ||
"winston-daily-rotate-file": "~3.2.1", | ||
"express-rate-limit": "^7.5.0" | ||
}, |
Package | Version | Security advisories |
express-rate-limit (npm) | 7.5.0 | None |
cb0c60a
to
edff55d
Compare
@@ -58,7 +58,7 @@ const getMetricLabels = (req: any, res: Response) => { | |||
const { statusCode = 200 } = res | |||
const request_size = req.socket.bytesRead | |||
const response_size = res.getHeader("content-length"); | |||
const dataset_id = _.get(req, ["body", "request", "dataset_id"]) || _.get(req, ["params", "dataset_id"]) || null | |||
const dataset_id = _.get(req, ["body", "request", "datasetId"]) || _.get(req, ["params", "datasetId"]) || null |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
fix the param in the urls
@@ -0,0 +1,395 @@ | |||
import dayjs from "dayjs"; | |||
|
|||
export const processingTimeQuery = (intervals: string, dataset: string) => ({ |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
param should be datasetId across all the methods
intervals: intervals, | ||
granularity: { | ||
type: "all", | ||
timeZone: "Asia/Kolkata" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This should be read from config or dataset config, Needs discussion
@@ -0,0 +1,238 @@ | |||
import axios from "axios"; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Move this file to services folder and rename methods to get instead of handle
const { category, volume_by_days = 10 }: any = req.body.request; | ||
const defaultThreshold = (typeof config?.data_observability?.default_freshness_threshold === 'number' ? config?.data_observability?.default_freshness_threshold : 5) * 60 * 1000; // 5 minutes in milliseconds | ||
const dateFormat = 'YYYY-MM-DDTHH:mm:ss'; | ||
const startDate = '2000-01-01T00:00:00+05:30'; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The also needs discussion
Sample response